Permission matrix
Authorization is enforced server-side on every page, action, export, and API call. This is the authoritative map of who can do what.
Legend: ✅ allowed · 👁 read-only · — not allowed (403).
Screens
| Screen | Route | Engineer | Reviewer | Finance | Admin |
|---|---|---|---|---|---|
| Overview | /overview | ✅ | ✅ | ✅ | ✅ |
| My time | /my-time | ✅ | ✅ | ✅ | ✅ |
| Customers and projects | /customers | 👁 | 👁 | ✅ | ✅ |
| Customer detail | /customers/{id} | 👁 | 👁 | ✅ | ✅ |
| Agreements and rates | /agreements | 👁 | 👁 | ✅ | ✅ |
| Review queue | /review | — | ✅ | ✅ | ✅ |
| Billing | /billing | — | 👁 | ✅ | ✅ |
| Reports | /reports | ✅ | ✅ | ✅ | ✅ |
| Reports CSV export | /reports/export | ✅ | ✅ | ✅ | ✅ |
| Administration | /administration | — | — | — | ✅ |
Time entries
| Action | Engineer | Reviewer | Finance | Admin |
|---|---|---|---|---|
| Create own entry | ✅ | ✅ | ✅ | ✅ |
| Edit own draft/rejected | ✅ | ✅ | ✅ | ✅ |
| Submit own draft/rejected | ✅ | ✅ | ✅ | ✅ |
| Delete own non-approved | ✅ | ✅ | ✅ | ✅ |
| Approve / reject any | — | ✅ | ✅ | ✅ |
| Approve all pending | — | ✅ | ✅ | ✅ |
Editing/deleting is restricted to your own entries; a different engineer's entry returns 403.
Customers, projects, commercials
| Action | Engineer | Reviewer | Finance | Admin |
|---|---|---|---|---|
| Create/edit customer | — | — | ✅ | ✅ |
| Archive/reactivate customer | — | — | ✅ | ✅ |
| Create project / change status | — | — | ✅ | ✅ |
| Assign/unassign engineer | — | — | ✅ | ✅ |
| Create agreement / allowance / rate | — | — | ✅ | ✅ |
| Close/reopen/recalculate billing | — | — | ✅ | ✅ |
Administration
| Action | Engineer | Reviewer | Finance | Admin |
|---|---|---|---|---|
| Change a user's role | — | — | — | ✅ |
| Enable/disable a user | — | — | — | ✅ |
| Manage personal API tokens | — | — | — | ✅ |
| Manage service clients | — | — | — | ✅ |
| Read the audit trail | — | — | — | ✅ |
API
API callers need both the right role and, for tokens, the right scope. Scopes are intersected with the principal's role. See API quickstart and Personal API tokens.
Landing routes
/ redirects admin and finance to /overview; reviewer and
engineer to /my-time.