Roles and permissions
What owners, admins, managers, developers and viewers can do.
Everyone in a workspace has one workspace role. The role decides what they can change. Everybody can see all projects in the workspace.
Separately, people can have a team role such as Product Owner, Scrum Master, Tech Lead, Developer, QA, Business Analyst or Designer. Team roles describe what someone does on a team. They don't change permissions. Set them in Settings › Teams.
Workspace roles
| Role | Who it's for | In short |
|---|---|---|
| Owner | The person who created the workspace | Everything, including cancelling the plan |
| Admin | Whoever runs NaatOps for the company | Everything except cancelling the plan |
| Manager | Delivery managers, project managers, Scrum Masters, product owners | Plans projects, releases, roadmaps and capacity |
| Developer | Developers, testers, analysts, designers, tech leads | Does the work: issues, sprints, tests, API checks, docs |
| Viewer | Stakeholders who only need to look | Reads everything, changes nothing except their own notifications and saved views |
| Client | People at your client's company. Free, takes no seat | Sees only the projects shared with them in the client portal, raises bugs and requests, and replies to comments |
Most of your team should be Developers. Choose Manager for the people who plan, and keep Admin for one or two people.
What each role can do
| Task | Owner | Admin | Manager | Developer | Viewer |
|---|---|---|---|---|---|
| See projects, issues, boards, reports | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create and edit issues, comment, attach files | ✓ | ✓ | ✓ | ✓ | |
| Create and run sprints, write retrospectives | ✓ | ✓ | ✓ | ✓ | |
| Write test cases and record test runs | ✓ | ✓ | ✓ | ✓ | |
| Build and send API requests | ✓ | ✓ | ✓ | ✓ | |
| Write and publish docs | ✓ | ✓ | ✓ | ✓ | |
| Delete a test run | ✓ | ✓ | ✓ | ||
| Create projects | ✓ | ✓ | ✓ | ||
| Create releases and share client reports | ✓ | ✓ | ✓ | ||
| Roadmaps, PI planning, allocations, teams | ✓ | ✓ | ✓ | ||
| See and set project budgets | ✓ | ✓ | ✓ | ||
| Set bill and cost rates | ✓ | ✓ | |||
| Import issues, automation rules | ✓ | ✓ | ✓ | ||
| Issue templates and recurring issues | ✓ | ✓ | ✓ | ||
| Rename or delete labels | ✓ | ✓ | ✓ | ||
| Invite people and change roles | ✓ | ✓ | |||
| Workflows, issue types, custom fields, time zone | ✓ | ✓ | |||
| Repositories, bots, chat alerts | ✓ | ✓ | |||
| Archive and restore projects, restore deleted issues | ✓ | ✓ | |||
| Billing and invoices | ✓ | ✓ | |||
| Cancel the plan | ✓ |
Giving a client access
You don't need to add your client to the workspace to show them progress. Send them a client release report link instead: it shows what shipped and how it was tested, and nothing else. See Releases and client reports.
If a client should follow their project, report bugs and ask for changes, invite them with the free Client role. They see only the projects you share with them, and comments you mark Team only stay hidden. See Client access and the client portal.
Don't invite a client as a Viewer: viewers see every project in the workspace and use a seat.
Change a role or remove someone
Owners and admins open Settings › Members. Each person has a role list and a remove button next to their name.
Active members with a role list and a remove button on each row
- To change a role, pick the new one from the list next to the person. It applies straight away.
- To remove someone who has left, choose the remove button next to their name and confirm. They lose access at once and their API tokens stop working. Their issues, comments and history stay, and you can invite them back later.
Only an owner can change or remove another owner, and a workspace always keeps at least one owner. To leave a workspace yourself, use the same button on your own row.
A pending invitation can be withdrawn with Revoke under Pending invitations, as long as it hasn't been accepted. Every role change, removal and invitation is recorded in Settings › Audit log.