Use this guide to change a role's project, daily log, photo, and financial access yourself, review everything else a role can do, export the matrix, and understand why a user may still see only some records.
Learn how roles combine with project membership, record sharing, and status in Permissions and Data Visibility.
Start here
- Change what a role can open: Set project, daily log, photo, and financial access.
- Audit access: Review the permission matrix.
- Change any other permission: Edit permissions and access levels.
- Add, rename, archive, or restore a role: Request role-structure changes.
- A tool or record is still missing: Understand permission consequences.
- A control is unavailable: Troubleshoot Roles and Permissions.
Review and edit access
Set project, daily log, photo, and financial access
Need subcontractors to stop seeing daily logs, or a new field role to open every job? The Essentials tab on Roles and Permissions changes that access for everyone in a role with one choice, without working through the full permission list.
- Open Roles and Permissions. It opens on Essentials; the full list is on the All permissions tab beside it.
- Find the role under Internal (your team) or External (outside companies). Type in Search roles to narrow a long list. Each role shows how many active people have it.
- In the column you want to change, open the dropdown and pick an option. On a phone, each role is a card with the same choices stacked underneath its name.
- If a confirmation appears, read the count of people affected and confirm.
The change saves as soon as you pick it, and a message names the role and its new setting. Changed the wrong role? Select Undo in that message to put the column back the way it was.
Each column writes a set of permissions together. You'll see the result in All permissions:
- Project access decides which projects the role can open: All projects or Projects they're added to. It's the Level of project access on View all projects in your organization — All Projects or Only projects I belong to.
- Daily logs offers Full access, Daily log photos only, or No access. Full access lets the role view, create, and edit daily logs and see the daily log photo album. Daily log photos only keeps the album but hides the logs. Full access turns off Limited Daily Log Entry, and the other two choices also turn off Manage daily log settings, including custom fields.
- Photos offers View, add, and edit photos, View photos, or No access. It covers project photos outside daily logs; daily log photos follow the Daily logs column.
- Financials appears only when your organization has the Financial package. My company only shows the role commitments, invoices, and change orders for its own company. All financials shows every budget, commitment, invoice, and change order. For roles based on Admin, Manager, or Subcontractor, All financials also includes the financial editing those roles start with. For roles based on Employee, Consultant, or Owner, it's view-only. No access turns off every financial permission that can be changed for a role.
We ask before the changes that are easiest to regret:
- Moving an external role to All projects asks you to confirm how many people will be able to open every project in the organization. Select Show all projects to continue.
- Widening Financials asks you to confirm how many people will see the money. Select Show financials to continue.
- Lowering your own role's access, or replacing a Custom setting on it, asks Reduce your own access? Select Reduce access only if you mean it — you can lose the access you're using right now.
Note: Custom with a dashed outline means the role's permissions in that area don't match any single option, usually because they were tailored in All permissions. Picking an option replaces those settings for that column. Check All permissions first if you're not sure what you'd be overwriting.
Bidder and archived roles don't appear on Essentials; review them in All permissions. Without Edit permissions for all user roles, you'll see each role's current choice but no dropdowns.
Your roles now open exactly the projects, daily logs, photos, and financials you chose, and every person with the role picks up the change.
Review the permission matrix
- Open Roles and Permissions and select All permissions.
- Review the Internal, External, and, when shown, Archived role groups.
- Search with Search permissions....
- Expand permission groups.
- Review each role cell:
- OFF means the action is disabled.
- ON means it is enabled.
- ON with a summary underneath means it is enabled with an access limit.
- Use Actions → Download as PDF or Download as CSV for an offline review.
Built-in roles are Admin, Manager, Employee, Subcontractor, Consultant, Owner, and Bidder. Names are not proof of current access because organizations can customize editable permissions. Use the matrix for the current result.
Edit permissions and access levels
When a role needs a change that isn't one of the Essentials columns — a single permission, a child permission, or an access level like Only my time cards — Constructable support makes it for you. Cells in All permissions are read-only for customers; the edit control on each cell is a Constructable staff tool.
- In All permissions, find the permission row and the role column, and note the cell's current ON or OFF state and any access limit.
- Email
support@constructable.aiwith the role name, the permission text exactly as the matrix shows it, whether it should be on or off, and the access level you want. - After support confirms, review the cell again, along with any child permissions nested under it.
Project access, daily logs, photos, and financials are faster to change yourself on Essentials. See Set project, daily log, photo, and financial access.
Access levels use exact product labels, including:
- All Projects or Only projects I belong to
- All RFIs or Only non-draft RFIs and my drafts
- All Meetings or Only meetings I'm a participant in
- All documents and folders or Only documents and folders I created
- All time cards or Only my time cards
- All Change Events or Related to my company
- All statuses or Non-draft or billable
Other tools have equivalent limits. An enabled but limited permission still allows the action, but only for matching records. Some child permissions require a parent permission and cannot be enabled first.
Request role-structure changes
Add Role, Modify, Archive, Unarchive, and Reset All Permissions to Default are visible but limited to Constructable super users. Email support@constructable.ai with the requested change.
For a new custom role, provide its name, whether it's for your team or outside companies, and the existing role it should start with. That can be any active internal or external role, including another custom role — copying your "Field Engineer" role to make "Senior Field Engineer" carries over everything you've tailored on it. Bidder can't be copied. Without a starting role, a team role starts with the same access as Employee and an outside-company role starts like Subcontractor.
The new role begins with the starting role's current permissions. Later edits to the starting role don't carry over, while newly released permissions follow the default of the built-in role it's ultimately based on.
When archiving a role, specify its replacement. Current users move to that role. Admin and Bidder cannot be archived. Restoring an archived role preserves its permission configuration.
Warning: Reset All Permissions to Default removes all manual permission changes across every role and rebuilds custom roles from their source roles. It cannot be undone.
Understand permission consequences
Access is the combination of several controls:
- A role permission decides whether the user can reach a tool or action.
- Its access level limits which projects or records qualify.
- Organization and project membership determine where the role applies.
- Record sharing can narrow the audience for an individual record.
- Status can move a record out of an active view.
- Package and feature availability can hide an entire section.
- Notification settings decide only whether activity is delivered; they never grant access.
Turning off a permission can remove a tool or action from every member of that role. Narrowing an access level leaves the action enabled but can immediately hide unrelated projects, drafts, meetings, RFIs, Submittals, or other records. Review affected users and dependent child permissions before saving.
Role changes do not set anyone's email, desktop, or mobile notification preferences. Each user configures delivery under My Account.
A few permissions are worth checking deliberately, because their default breadth surprises people. Unless one belongs to an Essentials column, changing it for a role is a request to support — see Edit permissions and access levels.
- Delete projects is Admin-only by default and nested under project write. It removes a project and its records without an in-app undo, so leave it with the smallest group that can be accountable for it.
- View closeout packages and Generate closeout packages are on for every role by default, including subcontractors, consultants, owners, and bidders. Each person still only sees the export sections their own read permissions cover, and only the packages they generated themselves — but if a role shouldn't be assembling handoffs at all, turn Closeout off for it explicitly.
- Respond to submittals hides the Respond button rather than disabling it, so an approver missing it sees a stage waiting on them with nothing to select. Check it first whenever someone reports that they "can't respond."
- Delete documents and folders is its own permission, separate from Add, rename, move, and change sharing for documents. A role can be allowed to upload, rename, move, and reshare files while never being able to remove them. Its Level of document deletion access narrows that further to Only documents and folders I created.
- Create/edit change events, Create/edit vendor change orders, and Create/edit prime change orders are independent of Manage financials like change orders, contracts, receipts (excluding financial reporting). Grant the first two without the third to let a project engineer price the subcontract side without touching owner billing. Prepare for Esigning still needs the financials permission even when a role can create both sides. Read access is split the same way (Read change events, Read vendor change orders, Read prime change orders), and Change Order read can be limited to Related to my company and Non-draft or billable.
- Edit a commitment's schedule of values after it has been executed sits under Financials and defaults to Admin and Manager, along with custom roles built on them. It's needed, on top of Manage financials like change orders, contracts, receipts (excluding financial reporting), to add, edit, delete, import, or lock SOV lines on a Fully Executed Commitment or Prime Contract. It doesn't gate the contract details or scope of work, which follow Create new commitments, make changes to existing commitments at any status, and it never opens an executed Change Order — those stay locked until moved back to Draft. Unlocking a locked SOV is separate: Unlock the SOV for editing on a commitment is Admin-only by default.
- View time cards and Create, update, and delete time cards each carry a level. Employees get Only my time cards by default, which is why a foreman may be able to log their own hours but not their crew's.
- Update existing projects, hide projects is project write: editing and hiding projects, including This is a template project. Creating a project is a nested permission, Create new projects, so write does not automatically include New Project.
- Add people to the project team is independent of project write. Staffing a Project Team and sending invitation emails — from Team or from a person's Global Directory profile — uses this permission, not write. A coordinator who needs to staff jobs needs this permission, not a directory permission. Custom roles that already had project write when this split shipped received Add people to the project team automatically; a role created after that has to be granted it on its own.
- Open organization settings is what puts Organization Settings in the nav. Sync core organization data makes org-wide catalogs available in project and financial tools, but it does not open the page. Company roles can have catalog sync without Open.
- Add, edit, and archive equipment and other material assets defaults to Admin, Manager, and Employee. It's what puts Equipment in the organization sidebar and lets someone add, edit, bulk edit, archive, and restore machines and their attachments. Managing equipment categories and types under Organization Settings → Equipment also needs Open organization settings. Creating equipment from a Daily Log picker uses this same permission. View equipment and other material assets is on for Admin, Manager, Employee, Subcontractor, Consultant, and Owner and can't be changed — it's what lets people open a machine's page from its QR code. See Equipment.
- Limited Daily Log Entry is default-off and assignable to Subcontractor, Consultant, and Owner. Ask support to turn it on when those companies should log their own Personnel rows without the rest of the Daily Log. It isn't one of the Daily logs choices on Essentials, so a role using it shows Custom there, and picking any option in that column turns it off. See Record personnel with limited Daily Log entry.
- Manage daily log settings, including custom fields defaults to Admin and Manager. It's what lets someone hide Daily Log sections and fields on a project, add custom fields, and build custom sections in Project Settings → Daily Log Settings. Filling those fields in on a log still uses Create new daily logs, make changes to existing daily logs. See Customize Daily Logs for one project.
- Configure custom field definitions is Admin-only by default. It is what opens Custom Fields on a list; filling in those fields on an item still uses Add new punch list items, make changes to existing punch list items. See Configure custom fields on a list. Incident and record forms are configured from Incident Settings with Manage incident settings, including incident types. See Configure incident settings and forms.
- Add, edit, reorder and remove inspection sections and items is nested under Create new inspections, make changes to existing inspections and defaults to Admin, Manager, and Employee, along with custom roles built on them. Ask Constructable support to turn it off for a role that should run inspections without rewriting the checklist: members can still edit the overview, record results and comments, attach files, and change status, but can't add, edit, move, or delete sections and items or change an item's Response type. Without it, a new draft has to start from an organization inspection template. Templates themselves follow Update organization-level settings. See Inspections.
- View incidents, Report incidents, make changes to existing incidents, Close and reopen incidents, and Manage incident settings, including incident types are the Incidents policy. View and write default to Admin, Manager, and Employee. Close/reopen and settings default to Admin and Manager. See Incidents.
- View work plans carries Level of work plan access. Admin, Manager, and Employee see All work plans; Subcontractor, Consultant, and Owner see only published plans their company authorizes, signs, or accepts. Work on items: change status, write proof of work, add and remove attachments has its own Which items level — Admin and Manager get All items, everyone else gets Only items that I or anyone at my company signs. Create work plans, edit drafts, publish and close plans defaults to Admin, Manager, and Employee. Edit published work plans, which moves them back to Draft and deletes their signatures, Delete work plans, Record signatures on someone else's behalf, and Manage work plan types and templates default to Admin and Manager. Signing your own sign-off needs only view access and being the named signer. See Work Plans.
- Create and use skills is nested under Create, update, and delete AI chats. Level of skill access is Organization skills or Only my skills. Admin, Manager, and Employee default to organization; Subcontractor, Consultant, Owner, and Bidder default to personal. Personal-access roles see and run only their own skills, not organization-shared ones. See Create and share a custom skill.
- Share saved views with everyone on the project, set the default view, and delete shared views is the only permission under Saved Views. It defaults to Admin and Manager, along with custom roles built on them. Without it, people still save, apply, and delete their own private views on any report or table they can open, but they can't share a view, set a table's default view, or delete a shared view. It covers Global Reports too, where sharing reaches everyone in the organization. Saved payment application layouts don't use it; they follow full financial access. See Save, share, and set a default view.
- Merge companies in the organization global directory is Admin-only by default and separate from creating companies. The dialog warns that the merge cannot be undone from this screen, so keep it narrow.
- Submit invoices for approval is editable, including Level of invoice submission access. Admin and Manager default to All Commitments; Subcontractor defaults to Only companies I belong to. If a custom role should submit billing, have this turned on rather than granting full financial write.
- Approve invoices is who can approve a vendor invoice. Approve invoices on behalf of others lets someone complete another person's sequential step; Admin has it by default. View invoice approval workflows and Manage invoice approval workflows control the Subcontractor Invoice Approvals list in Project Settings — the settings panel itself is gated by Manage.
- Invite new bidders, add and change bid packages, message bidders, View bids, and Respond bid requests sent to me can be changed per role like any other cell in the matrix. If your organization sends bid invitations from a role other than Admin or Manager, that's the role to ask support to change.
Access and platforms
- View permissions for all user roles opens Roles and Permissions — both Essentials and All permissions — and the PDF and CSV exports. Admin receives it by default. It can be granted to another role, so someone can audit access without changing it.
- Edit permissions for all user roles is nested under View and is what turns on the Essentials dropdowns. Admin receives it by default, and custom roles copied from Admin start with it. It can't be switched on for any other role, and it doesn't unlock individual cells in All permissions.
- Essentials and the permission matrix work on desktop web, mobile web, and the native app. On a phone, Essentials shows each role as a card.
- New roles, role-structure changes, full resets, and any change outside the Essentials columns require Constructable support.
Troubleshoot Roles and Permissions
Roles and Permissions is missing
Confirm View permissions for all user roles. The built-in Admin role has it by default. Support can grant it to another role, which lets someone open the page without receiving Edit permissions for all user roles.
Essentials has no dropdowns or no Financials column
Without Edit permissions for all user roles, Essentials shows each role's current choice as plain text. Admin has that permission by default, along with custom roles copied from Admin. The Financials column appears only for organizations on the Financial package. Bidder and archived roles never appear on Essentials; find them in All permissions.
An Essentials column shows Custom
The role's permissions in that area don't match any one option, usually because support tailored them or the role uses Limited Daily Log Entry. Leave it alone to keep that setup. Picking an option replaces it for that column; select Undo in the message that appears after the save if you change your mind.
Add Role, Modify, Archive, Unarchive, or Reset is disabled
These actions require a Constructable super user. Email support@constructable.ai; this is not a missing customer permission.
A child permission cannot be enabled
A child permission depends on the permission it's nested under. While the parent is off, the child shows OFF for that role whatever its own setting. When you ask support for the child, ask for the parent too.
A role can open the tool but sees only some records
In All permissions, find the role cell and read its access level, then check project membership, record sharing, and status.
A teammate still cannot see a newly enabled tool
Confirm the changed role is actually assigned to that user in the relevant organization or project, the feature is in the organization's package, and any required parent permission is enabled.
Changing notifications did not fix access
Notification settings do not control visibility. Check the role permission, access level, project membership, and record sharing.