The right access for each person

One installation serves one team. It can contain multiple projects, with members receiving access to the tasks and materials they need.

Owner and deputies

An installation has exactly one owner with full access. Ownership is a separate system position rather than an ordinary assignable role.

The owner can appoint deputies. A deputy receives almost full access and acts under their own account, but cannot transfer ownership.

Invite colleagues

A member with invitation permission sends an email invitation. The new member verifies their address, sets a password and receives the assigned access. Open self-registration is not available.

Delivery depends on the configured email transport. The operator can inspect the queue and message status. See email delivery.

Roles and individual rules

A user can have multiple roles alongside direct permissions and denials. For ordinary members, an explicit denial overrides a role’s permission.

For example, a role may allow task editing while a direct denial blocks deletion. Access management should explain which rule produced the final decision.

Project access and permission for a specific action are checked together. Watching a task does not grant editing rights.

Where restrictions apply

Authorization covers tasks, history, comments, search, files and events. API tokens cannot bypass their owner’s permissions; their scope further limits projects and actions.

Related: API and integrations.