Permissions guide
One role plus Sales add-ons: every role, every add-on rule, the full table of what each role can do by area, and what giving a role turns on.
On this page · 12 sections
A person's access is one role plus Sales add-ons. The role decides projects, time, the service desk, money and admin. The Sales add-ons (CRM access, then Full CRM, then Sales manager) are set per person on top of the role, and each one includes the one before it. Mailbox sync is a separate privacy switch.
A Tenant admin sets both in Settings › Users and roles › People: click a person's row, then use Role and Sales add-ons in the panel that opens. Settings › Users and roles › Roles and permissions shows the same rules as a card for each role, and its Compare side by side view is the table further down this page. The database enforces every rule here, whatever a screen shows.
This guide says partner for the businesses you serve. Your workspace shows its own word (Partner, Client, Customer) wherever a role or a rule names them.
The roles
Everyone has exactly one role. Service manager and Dispatcher are offered only in a workspace that runs its tickets in Current; everywhere else they are left out of the role picker and of Roles and permissions, along with the Service desk rows below. Sales manager is an older role: Current no longer offers it for new assignments, people who hold it keep it, and new sales managers get the Sales manager add-on. Super admin is not one of the ten roles. It is a flag on Current's own staff.
| Role | In one line | What it covers |
|---|---|---|
| Tenant admin | Runs one workspace | Owns a single workspace end to end: members and roles, projects, sync config, integrations, invitations, and the audit log. Cannot cross into other workspaces or grant super-admin. |
| Service manager | Runs the service desk and projects | Everything a project manager does, plus running the service desk: dispatch, anyone's tickets, deleting tickets, device decisions, shared boards, Time saved, and Pods and Skills. The rest of the desk's setup stays with tenant admins. |
| Dispatcher | Hands out the desk's work | An engineer who also runs dispatch: hands any desk ticket to anyone from the dispatch board and the Dispatcher page, and sees everyone's lane. The desk's setup, device decisions, deleting tickets, Time saved, and Pods and Skills stay with managers. |
| Project manager | Runs projects and time | Creates and edits projects, phases, and tasks, manages time entries, and runs project membership. Sees financials. Leaves tenant-admin work (integrations, workspace-wide roles) to an admin. |
| Engineer | Does the assigned work | A technician on the delivery team. Edits the tasks they're assigned, logs their own time, and comments. Sees project data and financials on projects they're on. |
| vCIO | Advises accounts, works the CRM | A technical advisor to partners. Works projects and the service desk like an engineer, and has the whole CRM on every company (Full CRM, on with the role). Never commissions or cost rates. A Tenant admin may also give a vCIO the Sales manager add-on. |
| Finance | Reads the money, changes nothing | Reads the money for every partner: cost rates, profitability with the cost of each person, margin, contracts, billing items and ticket time. Reads companies, projects, hours and desk tickets without changing them. Never commissions. |
| Account executive | Sales: own opportunities only | A sales rep. A narrow sales lens: sees only their own won opportunities and the projects those opportunities converted into. Cannot manage or write project work. |
| Read-only (Partner) | External partner, view only | An external partner. Sees only the projects they're a member of (status, timeline, tasks, progress, shared docs) and posts co-managed comments. Never any financial data. |
| Sales manager (older role) | Runs the CRM | Owns the sales side end to end: companies, opportunities, campaigns, and commissions across the workspace. Reads staff project data like an engineer, but doesn't manage project work, members, or integrations. |
Sales add-ons
The add-ons sit under Sales add-ons in a person's panel, as three numbered steps. Each step includes the one before it, so Full CRM and Sales manager stay dimmed until CRM access is on.
| Step | What it opens | Who can have it |
|---|---|---|
| 1. CRM access | Opens the Sales area. What they see inside depends on the role. | Any staff role. On with Service manager, Finance and vCIO. |
| 2. Full CRM | Every account, not only their own book: the whole CRM on every company in the workspace, including opportunities, notes, Business Reviews, campaigns and every website lead. Never commissions, sales management such as goals, coaching and approvals, the team's performance views, or cost rates. | Account executive, Service manager, Project manager, Engineer and vCIO (on with the role). Needs CRM access. |
| 3. Sales manager | The whole team's book, pipeline and reports, plus sales management: goals, coaching, approvals and pipelines. It opens commissions for an Account executive. On a Service manager, Dispatcher, Project manager, Engineer or vCIO it never does. | Anyone with CRM access except Finance and Read-only. Tenant admins always have it. |
Mailbox sync sits below the three steps and is not one of them. While it is on, the person's mailbox syncs to company pages. Turning it off asks first, because it also removes the mail already synced from that mailbox, and that mail does not come back. An Email off mark in the Sales area column shows who has it off. See "Which mailboxes sync to the CRM, and how to exclude one".
Why a switch isn't there
Wherever an add-on can't be changed, the row prints the reason in place of its switch.
| What the row says | What it means |
|---|---|
| Needs CRM access | Shown on Full CRM and Sales manager while CRM access is off, for a role that can hold them. Turn CRM access on first. |
| Not available with Dispatcher | Shown on Full CRM. A Dispatcher can hold CRM access and Sales manager, and the role has no Full CRM. |
| Not available with Finance | Shown on Full CRM and Sales manager. Finance can hold CRM access only. |
| Included as sales manager | Shown on Full CRM for anyone who has Sales manager, because Sales manager already covers it. |
| Always for tenant admins | Shown on Sales manager for a Tenant admin. CRM access stays a switch: with it off, the row reads Needs CRM access and the Sales area stays shut for them. |
| Via role | Shown on Sales manager for someone who holds the older Sales manager role. |
| Always | Shown on CRM access and Sales manager for a super admin. |
| On with this role | Shown under the CRM access switch for a Service manager, Finance member or vCIO, and under the Full CRM switch for a vCIO. The role turned it on. The switch still works, so a Tenant admin can turn it off. |
A Read-only (Partner) person has no Sales add-ons at all: the section is replaced by one line, because partners never reach the Sales area. An API agent's CRM access is set in the API agents section, not here.
What giving a role changes
Some roles change the add-ons the moment you give them, and the role picker says so on the role's row before you pick it.
- Service manager: CRM access turns on. A Tenant admin can turn it off afterwards under Sales add-ons.
- Finance: CRM access turns on, so they can open company records. Sales manager turns off, and it isn't offered for the role.
- vCIO: CRM access and Full CRM turn on. A Tenant admin can turn either off afterwards, and can turn on Sales manager.
- Read-only: Sales add-ons turn off.
- Tenant admin: Sales manager is included once CRM access is on.
Apart from these, a role change leaves the add-ons as they are. A change that takes away running the service desk, dispatch or Finance's access to money asks you to confirm before it saves. Every other change saves the moment you pick it and applies on the person's next click, with no sign-out needed. Only a Tenant admin changes a role or an add-on, and nobody can change their own role.
Every role, side by side
The tables below are the full matrix, grouped by area, the same one Compare side by side shows. Yes means full access, Limited means part of it and says which part, and No means none. A name followed by a colon carries that role's qualifier. In these tables tenant means your workspace, PM+ means the roles that manage projects (Tenant admin, Service manager and Project manager), and Sales manager role means the older role, never the add-on.
Projects
| What | Yes | Limited | No |
|---|---|---|---|
| Projects in the workspace | Tenant admin, Service manager, Project manager. Dispatcher, Engineer, vCIO: all tenant projects. Finance: reads all tenant projects. Sales manager role: reads all tenant projects (staff). | Account executive: only projects converted from their own opportunities. Read-only: only projects they're a member of. | None |
| Phases, tasks & dependency breakdown | Tenant admin, Service manager, Project manager. Dispatcher, Engineer, vCIO: on tenant projects. Finance: reads, changes nothing. Sales manager role: on tenant projects (staff read). | Read-only: tasks on their projects, via partner-safe views. | Account executive: sees the project row only, no breakdown. |
| Create & edit projects / phases | Tenant admin, Service manager, Project manager. | None | Read-only. Dispatcher, Engineer, vCIO: not a manager role. Finance: reads only. Account executive: blocked (write-blocked). Sales manager role: not a project role. |
| Edit tasks | Tenant admin, Service manager, Project manager: any task. | Dispatcher, Engineer, vCIO: assigned tasks only. | Finance: reads only. Account executive: blocked. Read-only: read-only. Sales manager role: reads tasks, can't edit. |
| Comment on projects | Tenant admin, Service manager, Project manager. Dispatcher, Engineer, vCIO: on projects they can view. Sales manager role: on projects they can view (staff). | Read-only: co-managed comments on shared projects. | Finance: reads only. Account executive: blocked. |
| Manage project membership | Tenant admin, Service manager, Project manager. | None | Dispatcher, Engineer, vCIO, Finance, Read-only. Account executive: blocked. Sales manager role: not a project role. |
| Won-quote pipeline & opportunities | Tenant admin, Service manager, Project manager: all tenant quotes. | Account executive: their own opportunities only. | Dispatcher, Engineer, vCIO, Finance: not a PM+ role. Read-only: blocked entirely. Sales manager role: uses the CRM; won-quote pipeline is PM+. |
| Convert won quotes (wizard) | Tenant admin. Service manager, Project manager: PM+ runs the conversion. | None | Dispatcher, Engineer, vCIO, Finance, Read-only. Account executive: sees own opportunities but can't convert. Sales manager role: runs the CRM, not conversions (PM+). |
Time
| What | Yes | Limited | No |
|---|---|---|---|
| Own time entries | Tenant admin, Service manager, Project manager. Dispatcher, Engineer, vCIO: own only. | Sales manager role: own only, but rarely logs time. | Finance: logs no time. Account executive: blocked entirely. Read-only: no time rows at all. |
| Log time | None | Tenant admin, Service manager, Project manager: own entries. Dispatcher, Engineer, vCIO: own entries only. Sales manager role: own entries (rarely used). | Finance: reads only. Account executive, Read-only: blocked. |
| Other users' time entries | Tenant admin. Service manager, Project manager: read all tenant time. Finance: reads every entry. | None | Account executive, Read-only. Dispatcher, Engineer, vCIO: own only. Sales manager role: not a project-management role. |
Finance's No on Edit tasks, Comment on projects and Log time has one exception: billing work assigned to them. See "Roles & permissions: who sees what".
Service desk
These rows apply only in a workspace that runs its tickets in Current.
| What | Yes | Limited | No |
|---|---|---|---|
| Work the service desk | Tenant admin, Service manager, Dispatcher, Project manager, Engineer, vCIO. | Finance: reads every ticket, changes none. | Read-only. Account executive, Sales manager role: not a desk role. |
| Change or act on anyone's ticket | Tenant admin, Service manager. | Dispatcher: hands anyone's ticket on, changes only their own. Project manager, Engineer, vCIO: their own tickets only. | Account executive, Read-only, Sales manager role. Finance: reads only. |
| Delete a ticket | Tenant admin, Service manager. | None | Finance, Account executive, Read-only, Sales manager role. Dispatcher, Project manager, Engineer, vCIO: tenant admins and service managers. |
| Dispatch other people's work | Tenant admin, Service manager, Dispatcher. | None | Finance, Account executive, Read-only, Sales manager role. Project manager, Engineer, vCIO: tenant admins, service managers and dispatchers. |
| Decide devices | Tenant admin, Service manager. | None | Dispatcher, Project manager, Engineer, vCIO, Finance, Account executive, Read-only, Sales manager role. |
| Share boards with the team | Tenant admin, Service manager. | Dispatcher, Project manager, Engineer, vCIO: private boards only. | Finance, Account executive, Read-only, Sales manager role. |
| See Time saved | Tenant admin, Service manager. | None | Dispatcher, Project manager, Engineer, vCIO, Finance, Account executive, Read-only, Sales manager role. |
| Edit Pods and Skills | Tenant admin, Service manager. | None | Dispatcher, Project manager, Engineer, vCIO, Finance, Account executive, Read-only, Sales manager role. |
| Change the rest of the desk's setup | Tenant admin. | None | Dispatcher, Project manager, Engineer, vCIO, Finance, Account executive, Read-only, Sales manager role. Service manager: tenant admins only. |
Money
| What | Yes | Limited | No |
|---|---|---|---|
| Cost rates, charges & margins | Tenant admin, Service manager, Project manager. Dispatcher, Engineer, vCIO: on projects they can view. Finance: every partner, cost rates included. Sales manager role: staff, on projects they can view. | Account executive: sell + margin on their own opportunities only. | Read-only: financial firewall. |
| Actual hours, budget burn & Current Score | Tenant admin, Service manager, Project manager. Dispatcher, Engineer, vCIO: on projects they can view. Finance: every project. Sales manager role: staff, on projects they can view. | None | Account executive: blocked (carries cost data). Read-only: financial firewall. |
Only Tenant admins and Finance read the four cost-rate tables themselves. A Yes on the first row for any other staff role covers the financial figures on the projects they can view, never those rate tables. An Account executive can also read account-level gross margin, cost to serve, effective hourly rate and total hours for a company they can view, in its renewal dossier.
Sales and CRM
These rows describe each role with no add-on beyond what the role turns on by itself. CRM access, Full CRM and Sales manager change them for that person, as described under Sales add-ons. For example, an Account executive with CRM access can view any company in the workspace and find it in search, and still edits only their own book.
| What | Yes | Limited | No |
|---|---|---|---|
| Companies & opportunities | Tenant admin: with CRM access. vCIO: Full CRM, on with the role. Sales manager role: full CRM: all companies & opportunities. | Service manager: companies only, CRM access on by default. Finance: reads company records and their money. | Dispatcher, Project manager: no CRM access by default. Engineer, Read-only: no CRM access. Account executive: uses My opportunities, not the CRM. |
| Campaigns & commissions | Tenant admin: with CRM access. Sales manager role: full CRM: campaigns & commissions. | vCIO: campaigns only, never commissions. | Service manager: not part of their CRM access. Dispatcher, Project manager: no CRM access by default. Engineer, Account executive, Read-only: no CRM access. Finance: not part of their access. |
| Manage CRM records (companies, opportunities, campaigns, commissions) | Tenant admin: with CRM access. Sales manager role: full CRM management. | Service manager: company records only, CRM access on by default. vCIO: companies, opportunities and campaigns, never commissions. | Dispatcher, Project manager: no CRM access by default. Engineer, Read-only: no CRM access. Finance: reads company records, changes none. Account executive: no CRM write access. |
People and workspace
| What | Yes | Limited | No |
|---|---|---|---|
| Staff roster / member list | Tenant admin, Service manager, Project manager. Dispatcher, Engineer, vCIO, Finance: full roster. Sales manager role: full roster (staff). | None | Account executive: self only. Read-only: only people on shared projects, no roster. |
| Manage members & roles (workspace-wide) | None | Tenant admin: any role except super-admin. | Dispatcher, Engineer, vCIO, Finance, Account executive, Read-only. Service manager, Project manager: project membership only, not roles. Sales manager role: not an admin role. |
| Invite users | Tenant admin. | None | Dispatcher, Engineer, vCIO, Finance, Account executive, Read-only. Service manager, Project manager, Sales manager role: admin-only invitations. |
| Configure integrations (PSA / M365 / Quoter) | Tenant admin. | None | Dispatcher, Engineer, vCIO, Finance, Account executive, Read-only. Service manager, Project manager, Sales manager role: tenant-admin action. |
| Audit log | Tenant admin. | None | Dispatcher, Engineer, vCIO, Account executive, Read-only. Service manager, Project manager, Finance, Sales manager role: admin-only. |
No role reaches another workspace.
Partner portal
| What | Yes | Limited | No |
|---|---|---|---|
| External partner portal view | Read-only: their sole surface, partner-safe views. | None | Service manager, Dispatcher, Project manager, Engineer, vCIO, Finance, Account executive, Sales manager role. Tenant admin: staff use the internal app. |