Roles & access

OtiumWork separates org-hierarchy roles (who reports to whom, who approves timesheets) from module access (who sees Finance, HR, Legal). Roles live on a hierarchy; modules are independent on/off flags.

The three roles

Each employee has one role, set in Manage → Employees. Roles are about org hierarchy and approval rights — they do not unlock any module by themselves.

Role	Sees own time	Sees team time	Approvals	Admin settings
employee	✓	✗	✗	✗
manager	✓	direct reports	✓ for own team	✗
admin	✓	full company	✓	✓

• Employee — the default. Captures their own time, taps tiles in My Day, edits their own events. Never sees dollar figures.
• Manager — leads a team. Approves timesheets, sees their direct reports' hours, billable %, capacity, scenarios, utilization. Full Team / Capacity / Scenario / Utilization / Reports access.
• Admin — owns the workspace. Full settings, employees, rules, integrations, billing. Implicitly has all three module flags.

One exception worth knowing: an employee who is named a project's Project Manager (or carries a PM / Lead role on the project team) can edit and plan that project — see Projects and clients. It's per-project authority, not a role change: no team time, no approvals, no dollar figures.

The three module-access flags

Finance, HR, and Legal are gated by independent per-employee flags, not by role. Admin always has all three. Anyone else — manager or employee — sees the corresponding sidebar section (and can reach the routes) only if their flag is set.

Flag	Unlocks
has_finance_access	Finance sidebar section: dashboard, profitability, departments, sales, commissions, R&D report, monthly snapshots, finance inbox, QuickBooks, entities & FX. Also: ability to edit hourly_cost on the employee form, and access to billing settings.
has_hr_access	HR sidebar section: dashboard, org chart, checklists, all per-employee HR tabs (docs, key dates, certs, reviews, goals, 1:1s, salary history, disciplinary). Also people admin: HR → Employees to add and edit employees (see below), and the whole company's hours in the time report (no $).
has_legal_access	Legal sidebar section: dashboard, contracts, compliance, IP, insurance, litigation, DSR/GDPR, templates.

The flags are fully independent: granting Finance does not grant HR or Legal. Someone with all three sees all three; someone with none sees none. Without a flag, the section is invisible in the sidebar and direct URL access returns 403.

HR access can add and edit employees

You don't need to make someone an admin so they can add people or look at everyone's time. The HR flag is enough. Someone with HR access (role employee or manager) can, from HR → Employees:

• See the whole company's employee list (no cost or rate columns).
• Add an employee: name, email, department, employment type, annual vacation entitlement, business entity, managers (any active employee) and role employee or manager. The new person always gets an invite email to set their own password.
• Edit those same fields for any employee who isn't an admin.
• Send / resend the invite, and deactivate / reactivate anyone who isn't an admin.

What stays with an admin:

• Granting the admin role, or editing / inviting / deactivating an admin account.
• Every module flag (Finance, HR, Legal, Partner, Developer, Block Finance).
• Hourly cost (that needs Finance access, as before).
• Deleting employees, bulk CSV import, install info, send manual.
• Setting someone's password, and changing the login email of anyone who holds a module flag. (An HR-flag holder who is also a manager keeps the manager rules for passwords.)
• An HR-flag holder can't change their own role.

All of it is enforced on the server, and every add, edit and (de)activation is written to the audit log under the person who did it.

Admin without the money — "Block Finance"

Admin normally implies Finance. When you need someone to administer people — add employees, set roles, grant module flags — without seeing company money, tick Block Finance — even for admins on the employee form (directly under the Finance grant, admin-only).

It is a hard veto that beats both the admin role and the Finance flag:

• No Finance section, billing, invoices, quotes, expenses, or commissions.
• No cost / rate / $ column anywhere — reports, team, projects, customer P&L.
• Direct URLs return 403, and hourly_cost cannot be written even by a hand-crafted POST.
• Ticking it clears the Finance grant, so the row can't say two things at once.

What it does not do — the difference from a developer account: the person stays real staff. They still count in utilization, headcount, the org chart and survey denominators, they still appear in team rosters and people pickers, and they get no extra integration-config visibility. They also keep the employment-terms fields that are HR, not money: employment type, annual vacation entitlement, and business entity.

Typical use: an HR or Legal director who is also the workspace people-admin. Role = admin, has_hr_access + has_legal_access on, Block Finance ticked.

Two things worth knowing before you use it:

• Sales and Marketing are not covered. Deal amounts and pipeline values stay visible, because OtiumWork does not classify them as Finance — sales reps see their own pipeline without any finance flag. If you need those hidden too, that is a separate change.
• An admin can untick the box on their own record. This is a separation-of-duties control, not a security boundary against a hostile admin — the change is written to the audit log either way.

Why flags instead of more roles

Roles encode the org hierarchy (who manages whom). Module access encodes responsibility areas (who handles money, people files, contracts). They are orthogonal: a manager might also handle HR, or a finance person might also be the legal contact. Flags compose; roles can't.

Setting a role and granting access

Admins manage both at Manage → Employees → [person] → Edit:

• Role — dropdown (employee / manager / admin).
• Module access (admin-only) fieldset — three checkboxes: "Grant Finance access", "Grant HR access", "Grant Legal access". Tick the ones this person needs. Save.

Managers can edit their direct reports' name, dept, etc. but cannot toggle the access flags or grant the admin role.

Sidebar by role + flags

User	Sidebar sections shown
employee, no flags	Your work · Projects · Market intel
employee + Finance flag	Above · Team (incl. Utilization) · Reports · Finance
employee + HR flag	Your work · Projects · Market intel · Reports · HR (incl. Employees)
manager, no flags	Your work · Projects · Team · Reports · Market intel
manager + Finance flag	Above · Finance
manager + HR + Legal flags	Manager view · HR · Legal
admin	Everything: Manage, Finance, HR, Legal

Sales Coach and Engineering Coach

People on customer calls get one coach in Your work: Sales Coach for sales and marketing (department, or the salesperson flag), Engineering Coach for everyone else (demos, support, customer training). Each person sees only their own side's calls, training and practice; a manager sees their reports on their own side only. Admins see both coaches. See Meeting Coach for details.

Developer accounts

A developer account is a special login for the Otium engineering team to debug and support the product. Tick Account type → Developer account on the employee form (admin-only). It is not a fourth role — it's a flag layered on top of admin:

• Admin-equivalent read + act across this workspace — sees and can edit almost everything an admin can.
• Full integration visibility — Salesforce, Outlook/MS Graph, and company-API data and config pages, so integration bugs can be reproduced. Secret values (client secrets, API keys) stay masked, same as for everyone.
• Never sees any financial data — Finance, billing, invoices, quotes, expenses, commissions, and every cost / rate / $ column (reports, team, projects, customer P&L) are blocked, even though the account is technically an admin.
• Excluded from people analytics — does not count toward utilization, headcount, org-chart, or survey response rates, and never appears in team rosters or people pickers (a developer is a real login, not real staff).
• No platform owner access — can never reach the /ops platform area (Stripe / Anthropic keys, cross-tenant billing), even if its email is on the owner allowlist.

Ticking the box forces the role to admin and clears any Finance flag. Do not also add a developer's email to the platform owner allowlist (OPS_ACCESS_EMAILS).

Common combinations

• CFO / controller — role = employee (or manager if they lead an FP&A team), has_finance_access only.
• HR director — role = employee or manager, has_hr_access only. Adds and edits employees and sees everyone's hours without being an admin.
• General counsel — role = employee, has_legal_access only.
• Operations lead handling money + people — role = manager, both has_finance_access and has_hr_access.
• HR/Legal director who also administers the workspace — role = admin, has_hr_access + has_legal_access, Block Finance ticked. Full employee and permission management, zero visibility into costs or margins.
• Workspace owner — role = admin. All three flags implicit.