Roles & Permissions

Workspace & admin7 min read

SiteHut uses workspace roles for day-to-day access and optional custom roles when you need finer control. Job team roles can narrow or extend what someone sees on a single project.

Workspace membership roles

When you invite someone under Settings → Workspace settings → Users, you assign a membership role:

Role	Typical use
Owner	Billing, full workspace control, integrations, and user management
Admin	Full operational control without billing ownership
Editor	Site managers—create and edit jobs, tasks, finances, and directory records
Viewer	Read-only across modules they can see

Note

Legacy labels like “Member” may still appear on older accounts; new invites use Editor or Viewer style roles. The in-app Users screen is always the source of truth for your workspace.

What changes between roles (summary)

• Owner — can manage billing, workspace settings, integrations, and all RBAC.
• Admin — same operational power as Owner for most modules, but not workspace billing ownership.
• Editor — can work across assigned jobs: tasks, diary, quotes, expenses, and uploads (exact modules follow the role’s permission keys).
• Viewer — read-only; cannot approve expenses, send quotes, or edit records.

If a menu item is missing, your role does not include that scope (for example quotes:write or integrations:manage).

Custom roles (RBAC)

Settings → Workspace settings → Roles lists system roles (Owner, Admin, Editor, Viewer) and any custom roles you create.

1

Create a custom role

Click New role, name it (e.g. “Accounts clerk”), and tick only the permission bundles required—read vs write vs manage per area (projects, expenses, invoices, and so on).

2

Assign to members

Open Users, edit a member, and assign the custom role instead of a built-in Editor/Viewer role where supported.

3

Review periodically

Duplicate or edit roles when responsibilities change. Delete unused custom roles so old permission sets are not left assigned.

Warning

Custom roles are powerful—prefer least privilege. Grant integrations:manage or billing:manage only to people who need them.

Job-level roles

Inside a job → Team, you can add people who are not on every workspace job:

Job role	Purpose
Project Admin	Full control on that job
Editor	Edit tasks, diary, and job content
Viewer	Read-only on the job
Customer Contact	Client-side visibility where enabled
Collaborator	External partner with limited write access
Contract Administrator	Commercial / variation workflow on contract jobs

Snags (workspace permission keys)

Key	Typical use
snags:read	View the snag register on jobs you can access
snags:write	Create and edit snags
snags:manage	Assign snags and manage the register
snags:close	Close or reopen snags

Built-in Editor roles usually include read and write; Admin and Owner include manage and close. Custom roles can grant only the bundles you need—see Snagging.

Workspace members often inherit their workspace role on the job. You can override with a job-specific role when a subbie should only see one site.

Tip

At least one Project Admin should remain on each active job—SiteHut prevents removing the last admin accidentally.

Invites and pending users

1. Settings → Users → Invite — enter email and pick workspace role.
2. The invitee accepts by email link and joins with that role’s permissions.
3. Pending invitations can be resent or revoked from the same screen.

Only users with user management rights can invite or change roles. If you cannot invite, ask an Owner or Admin.

Common questions

• “I can’t see Finances” — your role may lack quotes, invoices, or expenses read/write scopes.
• “I can’t connect Xero” — needs integrations:manage (typically Owner/Admin).
• “Client should not edit tasks” — use Customer Contact or Viewer on the job team.