ForemanFOREMAN

Roles & permissions

Understand the built-in roles, see exactly what each one can do, and fine-tune permissions on the editable presets from the Roles tab.

A role decides what a member can see and do. Foreman ships with a set of built-in roles so you can get started without configuring anything — and you can adjust most of them when you need finer control.

Open the Roles tab

  1. From the sidebar, click Organization.
  2. Click the Roles tab.

The tab opens on a table of every role — Role, Category (Internal, Client, or Vendor), Type (Preset or Custom), and Members. Search by name, or click Filters and pick a Category to narrow it. Click a role's row to open its access matrix; the back arrow beside the role name returns you to the table.

Don’t see this?

Editing roles is usually limited to the organization owner and admins. If the access matrix is read-only, your role doesn't include role management — ask your owner.

The built-in roles

Every organization comes with these presets. They can't be renamed, deleted, or re-categorized.

  • Owner — full access to everything, including billing. There is exactly one owner, and it can't be reassigned.
  • Admin — everything the owner can do except manage billing.
  • Member — day-to-day work across projects, budgets, records, schedule, and more, but no team, billing, or settings management.
  • Field — a lighter set aimed at crews: daily logs, time tracking, to-dos, files, and read access to projects.
  • Client and Vendor — view-level access for the people outside your company, scoped to only what's shared with them.

See what a role can do

You don't have to memorize the matrix. To check a specific person:

  1. Go to the Members tab and click their row.
  2. The panel shows their role under Permissions and a plain-language What they can do summary grouped by area.

Adjust an editable role

Most presets can be fine-tuned — Admin, Member, Field, Client, and Vendor. Only Owner is fully locked.

  1. On the Roles tab, select the role.
  2. For each resource row, pick an access level from the segmented control — power increases left to right, starting at None. Most rows offer View and View & Edit; some go further, for example Requests adds Edit & Send (creating a bid request and sending it to vendors are separate permissions), Client Finances adds Edit, Void & Record Payments, Vendor Agreements adds Edit & Send, and Vendor Finances offers View & Code and Approve & Pay.
  3. Where a row offers a scope dropdown, choose All or Only if given access.

Note

Under Budgets there's a second row, Hidden budget lines, separate from Budget itself. Set it to View and members in that role can see budget lines a saved view hides; leave it at None and those lines stay out of sight even for someone who can edit the budget. Out of the box only Owner and Admin have it, and it's an internal-only row — Client and Vendor roles never see it.

Two cards sit above the resource sections:

  • Financials (derived) — a read-out, not a knob. It shows whether this role can see Cost, Price, and Margin, derived from the record access you granted: vendor records unlock cost, client records unlock price, and margin needs both.
  • Portal (internal roles only) — toggle whether members in this role appear as a project contact in the client or vendor portal by default.

Changes save as you go. Everyone with that role picks up the new permissions the next time they load the app.

Note

Client and Vendor roles are capped to view-level access plus a few basics — Foreman won't let you grant them operator-level powers, so external people can never reach into your team's tools.

Note

Creating brand-new custom roles isn't available right now. Tune the built-in roles above to fit your team.

Related

NextProject access scope