Access and sharing scopes
Understand roles, effective capabilities, archived projects, client access, and guest permissions.
To get started, you need a WorkCloud account and suitable project access. Being an organization Owner/Admin can qualify you to create a project; it does not grant every action on every project. Inside a project, your role and effective capabilities determine what you can read and change. Team role assignment and permission management have additional limits. UI controls are convenience cues; the server enforces access.
| Situation | What to expect |
|---|---|
| Reading versus editing | Read, create/manage, propose, and approve are separate. Reading Rates does not permit proposing or approving rates; reading Bookings does not allow edits. |
| Team and tasks | Team/department management does not grant task-review rights. Task state and requester/assignee relationships further restrict actions. |
| Archived project | Authorized historical data remains readable; new mutations are disabled. Some menus, such as Team, can still open for historical inspection. |
| Documents and reports | Reading, uploading, managing, and publishing are different permissions. A report draft is not a published snapshot. |
| Signed-in client | Viewer/Approver is granted through Settings for a specific email, time period, and project. The client portal does not expose all internal records. |
| Guest | Links can expire, require email/password, and grant only selected read/comment/approve/file/album permissions. Revocation ends access; never publish a share token. |
Record visibility, project permissions, client access, and guest-link permissions are distinct layers: setting ClientVisible alone does not publish content or authorize every reader. Confirm the recipient before sharing a report. Do not use guest links as substitutes for internal project membership.
If a permission was recently changed but the menu is still missing, refresh the project and ask a manager to review effective capabilities. See the FAQ to distinguish access failures from unavailable catalogs.