Members and Teams permissions

This guide explains exactly what members and teams are allowed to do in Uku — what each company access level unlocks, how the per-team View/Edit/All permissions matrix works, and how per-client permissions add access on individual clients. To add, organize, or change members and teams themselves, see Members and Teams.

• Company Owners and Company Admins grant and change permissions — they edit team permission matrices, set company access levels, and assign per-client permissions.
• Company Members can see the permissions they hold (on their own profile and on team matrices), but can’t grant permissions to themselves or others.

Three independent layers combine into what a person can actually do:

1. Company access level — Company Owner, Company Admin, or Company Member. Company Owners and Company Admins bypass every permission check; Company Members start with almost nothing and rely on the next two layers.
2. Team permissions — each team carries a Permissions matrix. A Company Member’s access is the sum of what all their teams grant.
3. Per-client permission — on any client, a member is Client Admin or Client Member, which controls what they can do on that specific client.

The rest of this guide takes each layer in turn.

Capability	Company Owner	Company Admin	Company Member
View and work on assigned tasks	Yes	Yes	Yes
Track time	Yes	Yes	Yes
Access assigned clients	Yes	Yes	Yes
Create and edit clients	Yes	Yes	Default No*
Edit any task (not just own)	Yes	Yes	Default No*
Manage project workflow templates	Yes	Yes	Default No*
Add, edit, or deactivate members	Yes	Yes	Default No*
Edit company settings	Yes	Unless locked by Owner	No
Access BI Analytics	Yes	Yes	Default No*
Manage contracts and invoices	Yes	Yes	Default No*
Delete clients	Yes	No	No
Lock settings for all members	Yes	No	No
Delete company	Yes	No	No

* Default No means the capability is off by default for a Company Member but can be granted through team permissions. Company Owners and Company Admins have these rights by default.

Unrestricted access. Capabilities exclusive to the Company Owner:

• Delete a client (permanently)
• Lock company settings for all members (Disable company settings edit for all members toggle)
• Delete the company account

Everything a Company Member can do, plus:

• Edit company settings (unless the Company Owner has locked them)
• Add, edit, and deactivate members (not the Company Owner)
• Create, edit, assign, and administer every client in the company
• Edit any task (not just their own)
• Manage workflow templates
• Access BI Analytics
• Full billing access across all clients
• Manage email integrations and templates

Company Admins bypass the team permissions matrix entirely — removing a permission from a team never restricts them.

Baseline access: view and work on assigned tasks, track time, and open the clients they’re assigned to. Everything beyond that comes from team permissions and per-client permissions, covered below.

Beyond a Company Member’s baseline, every company-wide capability is granted per team. Each team carries a Permissions matrix, and a Company Member gets the sum of what all their teams grant.

Every team has a Permissions matrix: one row per capability (such as Clients, Time entries, or Invoices) and up to three level columns — View, Edit, and All. Not every capability uses all three levels; some are Edit-only or View-only, so those columns are absent on those rows.

The levels stack as a ladder. Ticking All automatically ticks Edit and View; unticking View clears Edit and All as well. A higher level always includes the lower ones.

In the table below, each capability is one row of the matrix, and each cell tells you what that level grants for that capability — a description means the level has a checkbox and explains what ticking it does, while a dash (—) means the capability has no checkbox at that level.

Capability	View	Edit	All
Invoices ↑	See invoices on clients you already access	Create and modify invoices	Also delete, void, send to client, export, import
Contracts ↑	—	View and modify client contracts (on clients you access)	Also delete
Products ↑	—	Add and modify products	Also delete products
Workflow templates ↑	—	Create and modify project workflow templates	—
Client management	—	Add new clients, and modify any client you’re assigned to	—
Task management	—	—	Force-delete any task (without it, members can still delete tasks they own or are assigned to)
Topics	—	Create and modify task topics	—
Time entries	—	Add and modify time entries, including ones other members logged	Also delete entries and correct locked periods
Notes (type Document)	—	Change notes of type Document	Also delete them
Vacations ↑	—	Approve or decline other members’ vacation requests	—
Member profiles ↑	See members’ profile data (info, notes, agreements, vacation history)	Also edit member info, notes, and agreements	Also deactivate members
BI Analytics ↑	Open BI Analytics (menu, client BI tabs, profile BI report)	—	—

↑ Shows in the matrix only when the matching app is enabled (Billing, Projects, Workforce Management, BI Analytics).

The matrix only governs Company Members. Whether it applies to someone depends on their level in the company:

• Company Owners and Company Admins bypass every check. They always have every capability, regardless of what any team’s matrix says. Removing a permission from a team never restricts a Company Owner or a Company Admin.
• Company Members are governed entirely by team permissions. A Company Member starts with no capabilities and gains only what their teams grant.

Permissions are cumulative across teams. A member’s effective access is the combination (a logical OR) of every team they belong to — including the company-wide All users team that everyone is on. If any one of a member’s teams grants Edit on Clients, that member can edit clients.

Each team’s Permissions matrix lives on the team’s own page, alongside its name and members.

Path: Members → Teams → open a team

1. Go to Members and open the Teams tab.
2. Click a team to open its page.
3. Scroll to the Permissions matrix on the team’s page.
4. Tick or untick View, Edit, or All for each capability. The ladder cascades automatically.
5. Click Save.

Changes take effect immediately. For creating, renaming, and adding members to teams, see Members and Teams.

New companies start with two system teams already seeded, so members aren’t left with zero access:

• All users (every member belongs to it) is seeded with Edit on Topics, Clients, Time entries, and Notes (type Document). So out of the box, every Company Member can manage task topics, create and edit clients, add and edit time entries, and edit Document-type notes.
• Administrators is seeded with Products so Company Admins can add, modify, and delete billing products by default.

Everything else — Invoices, Contracts, BI Analytics, Member profiles, Confirm vacations, force-deleting tasks, and Workflow templates — is not granted by default. A Company Admin must add it to a team for Company Members to get it.

On top of company-wide access, each member holds a permission on every specific client they’re assigned to. This is independent of their company access level — a Company Member can be Client Admin on some clients and Client Member on others.

Per-client permissions are set in the client view’s Members tab. When a member is assigned to a client, they get one of two permissions:

• Client Admin — full edit access to that specific client’s record and its tasks and workflow. Other capabilities — invoices, contracts, and the like — come from team permissions, not from being Client Admin.
• Client Member — can view and work on the client’s tasks, but has limited management capability on that client.

Company Owners automatically have Client Admin-level access on every client. Company Admins have broad management access across all clients; for Company Members, client permissions are set per client.

A member’s permission on a specific client is set on the client’s edit form, in the Members tab — independent of the team matrix.

Path: Clients → [client name] → Edit → Members

1. Open the client and click Edit to open its edit form.
2. Go to the Members tab.
3. Find the member and open the permission dropdown next to their name.
4. Select Client Admin or Client Member.
5. The change saves immediately.

Client Portal users are external — they’re your clients, not your team members — so they sit outside the company-access and team-permission systems entirely. Portal access is controlled by a single Access enabled checkbox on the contact, in the client’s Contacts tab. Turning it on gives the contact the standard portal experience: they can view the tasks shared with them, upload files, send messages, and sign documents. To grant it, see Grant Client Portal access to a contact.

Permissions are cumulative across teams, so check every team the member belongs to — the capability has to be granted on at least one of them. Open the member’s profile to see the combined permissions they actually hold and which team each one comes from. If no team grants it (including All users), add the capability to one of their teams.

Company Owners and Company Admins bypass the matrix entirely, so editing a team’s permissions never restricts them. The matrix only changes what Company Members can do. To limit a Company Admin, you would have to remove their Company Admin status on the Members page — see Members and Teams.

Product management for Company Admins comes from the Products permission seeded on the Administrators team. If someone revoked that row, only the Company Owner can manage products. Re-grant Products (Edit or All) on the Administrators team to restore it.

Permission changes push to the member’s session automatically, but an open tab can lag. Ask the member to refresh the page or sign out and back in. If it still hasn’t applied, confirm you clicked Save on the Permissions matrix.