Roles & permissions

A role decides what a member can see and do. Foreman ships with a set of built-in roles so you can get started without configuring anything — and you can adjust most of them when you need finer control.

Open the Roles tab

From the sidebar, click Organization.
Click the Roles tab.

Roles are grouped into Internal Roles, Client Roles, and Vendor Roles. Click any role on the left to see its access matrix on the right.

Don’t see this?

Editing roles is usually limited to the organization owner and admins. If the access matrix is read-only, your role doesn't include role management — ask your owner.

The built-in roles

Every organization comes with these presets. Each carries a preset badge — they can't be renamed, deleted, or re-categorized.

Owner — full access to everything, including billing. There is exactly one owner, and it can't be reassigned.
Admin — everything the owner can do except manage billing.
Member — day-to-day work across projects, budgets, records, schedule, and more, but no team, billing, or settings management.
Field — a lighter set aimed at crews: daily logs, time tracking, tasks, files, and read access to projects.
Client and Vendor — view-level access for the people outside your company, scoped to only what's shared with them.

See what a role can do

You don't have to memorize the matrix. To check a specific person:

Go to the Members tab and click their row.
The panel shows their role under Permissions and a plain-language What they can do summary grouped by area.

Adjust an editable role

Most presets can be fine-tuned — Admin, Member, Field, Client, and Vendor. Only Owner is fully locked.

On the Roles tab, select the role.
For each resource row, pick an access level (for example, None, View, or View & Edit).
Where a row offers a scope dropdown, choose All or Only if given access.

Changes save as you go. Everyone with that role picks up the new permissions the next time they load the app.

Note

Client and Vendor roles are capped to view-level access plus a few basics — Foreman won't let you grant them operator-level powers, so external people can never reach into your team's tools.