# Users and Permissions PAI has two account types, **Workspace User** and **Staff Resource**, and four user roles that apply to Workspace Users. The role sets a user's baseline: what they can see and do across the workspace. On top of that, per-user **permission overrides** grant or revoke individual capabilities for one person. This page covers the role model, the overrides, the **View In-House Internal Cost** permission that keeps in-house staff costs confidential, adding and removing users, and controlling access to specific projects. --- ## Adding Users Go to **Settings → Users** and click **Add User**. The first step asks which account type you're creating: - **Workspace User**: "Login access with permissions to manage projects and more." Choose this for anyone who needs to work in PAI directly. - **Staff Resource**: "Assignable to projects, expenses, & call sheets. Optional login access for logging hours." Choose this for people whose only involvement is being scheduled, costed, or reporting their own time. Click **Continue**. Both forms ask for **Email**, **First Name**, and **Last Name** (required), plus optional **Phone** and **Title**. The panel on the right previews the person and what their access will be, and updates as you change the form. ### Workspace Users Choose a **Role** (the preview lists that role's permissions as you change it) and, optionally, an **Account Expiration**: **Never** (the default), **7 Days**, **30 Days**, **60 Days**, **90 Days**, or **Custom...**. Click **Create & Invite User**: the person gets an email with login instructions, creates their account, and has access right away. ### Staff Resources The form's **Role** is set to **Staff Resource**. A Staff Resource has no permission set to speak of: they can be *assigned* to projects, budget expense lines, and call sheets, which makes them usable as a scheduled, costed person without giving them the run of the workspace. Assigning is not sharing: a Staff Resource can't be shared on a project, whether or not they've been invited to log hours. **Send Invite to Log Hours** decides whether they can sign in at all: - **Don't Invite** (the default): they're created as a record with no login. The preview reads "This user won't have login access to PAI." They're still fully assignable and costable. - **Invite to Log Hours**: they get an invite to sign in, and the preview reads "This user will be able to log in to PAI" and "They can only log hours on expenses they've been assigned to." Their entire app is [HQ](../00-Understanding-PAI/Navigating-PAI.md#the-dashboard) with the **Log Hours** widget: no projects, budgets, or settings. See [Hours Reporting](../04-Executing-the-Job/Hours-Reporting.md). Click **Create Staff Resource** to finish. > [!note] > Being invited to log hours and being a member of the workspace are two different things. An invited Staff Resource can sign in to report hours, but they stay outside the workspace proper: you can't share a project with them the way you would with a Workspace User. ### Users Created Without an Invitation A user in the list who has never been invited is a **staff record**: a real record you can assign and cost, with no login attached. Its **Registration Status** reads **Not Invited**. Creating a Staff Resource with **Don't Invite** is how one comes about; Workspace Users are invited as part of being created. A staff record isn't permanent. To give the person access later, open their record and click **Send Invite**. To invite them to log hours, keep **Role** on **Staff Resource** and set **Send Invite to Log Hours** to **Invite to Log Hours**, then click **Update & Invite**. Choosing a workspace role instead turns them into a Workspace User. Once invited, their status changes to **Invited** and the button becomes **Resend Invite**. > [!note] > "Staff record" and "Staff Resource" are different things. A **Staff Resource** is the account type. A **staff record** is the state of not having been invited. An invited Staff Resource is still a Staff Resource; it just isn't a staff record anymore. --- ## User Roles Roles apply to Workspace Users. The **Role** field on a user also lists **Staff Resource**, because that's where the account type is recorded, but it isn't a fifth role: a Staff Resource's access is fixed at hours reporting, as described above. | Permission | Workspace Owner | Workspace Admin | Project Admin | Guest | |---|---|---|---|---| | **Project visibility** | All projects | All projects | Only projects created or assigned to | Only assigned projects | | **Campaign access** | Full | Full | Only campaigns they created | None | | **Rate card** | Can modify | No access | No access | No access | | **User management** | All users including admins and owners | All users except admins and owners | None | None | | **Project sharing** | Can assign any user | Can assign any user | None | None | | **Financial visibility** | Full | Full | Full | Limited | | **Organization Settings** | Full, including Billing | Full, including Billing | None | None | | **AP access** | Organization-wide | Organization-wide | Assigned projects only (via project tab) | None | | **Contacts** | Full | Full | Full | Limited view | | **Tags** | Create, modify, apply | Create, modify, apply | Create and manage within their projects | None | | **View In-House Internal Cost** | On by default | Off (Owner can grant) | Off (Owner can grant) | Off | | **Insights** | On by default | Off (Owner can grant) | Off (Owner can grant) | Off | | **Export CSV** | On by default | Off (can be granted) | Off (can be granted) | Off | | **Campaign Projects** | On by default | On by default | Off (can be granted) | Off | Only an Owner can grant View In-House Internal Cost and Insights. The other overrides are covered under [Per-User Permissions](#per-user-permissions). ### Workspace Owner Full control over the workspace — all users, all projects, all settings. Can modify or revoke access for any user including other owners and admins. Typically limited to account holders or senior administrators. ### Workspace Admin Extensive administrative access to all projects and settings. Can manage most users but cannot modify or revoke access for other admins or owners. The appropriate role for operations managers and department leads who need full visibility without owner-level control. ### Project Admin Focused access to the projects they created or have been assigned to. Full financial visibility on their projects. Cannot access organization settings, manage other users, or see projects they haven't been assigned to. The standard role for producers and project managers. ### Guest The most restricted role. Can only access projects they've been explicitly assigned to. Guests run production logistics (call sheets, budget expense statuses, and vendor assignments) but can't see project estimates or financial margins, view invoices or manage AP, access campaigns or organization settings, or create or modify tags. Designed for external collaborators or team members who need to work within a project without seeing client-facing financial details. > [!note] > Enterprise accounts can request additional custom roles with tailored permission sets. Contact [email protected] for details. --- ## The User Record Each user has a record under **Settings → Users → (user)**. The header shows their email and when they were created, with **Send Invite** / **Resend Invite** before they've signed up, or **Send Sign-In Link** once they have. The **⋯** menu holds **Send Password Reset** (for signed-up users), **Set Expiration Date**, **Clear Expiration Date** and **Delete User**. The record has these tabs: - **Profile**: name, email, phone, **Role**, **Registration Status** (**Not Invited**, **Invited**, **Confirmed**), title, and **Internal Notes**. - **Permissions**: per-user overrides on top of the role baseline (below). - **Default Rates**: the person's default **Hourly**, **Daily**, and **Flat** rates, each with external and internal values, used when they're assigned to an estimate or budget line. - **Custom Rates**: item-specific rates for this person, by rate card, project type, and unit. These override the default rates when they're assigned to that item. See [Staff Rates](./Staff-Rates.md). - **Utilization**: **Capacity (hours/week)**, **Utilization Target (%)**, and **Week Starts On**, plus the hours they've reported and their timecards over a chosen range. - **Calendar**: what the person is scheduled on, filterable by day type and by event type (**Project Days**, **In-House Assignments**, **Tasks**). Date-range assignments made through the **Dates** field on a line feed this calendar, so a person's record shows their committed time across projects. Internal rates on **Default Rates** and **Custom Rates** are gated by View In-House Internal Cost (below). **Every user carries rate tabs**, Workspace Users and Staff Resources alike, invited or not. Anyone who can be assigned to a line needs rates behind them, so rates don't depend on having a login. --- ## Per-User Permissions The **Permissions** tab manages overrides for one user, on top of what their role grants. It has four toggles: - **View In-House Internal Cost**: view and edit in-house internal cost on estimates and expenses (see below). - **Insights**: view project financial insights, including staff rates. See [Insights](../06-Financial-Visibility/Insights.md). - **Export CSV**: export grid data as CSV. - **Campaign Projects**: view the campaign projects tab. > [!important] > **Insights requires View In-House Internal Cost.** The Insights toggle stays disabled until View In-House Internal Cost is on. Insights is built on blended in-house and out-of-pocket totals, so granting it on its own would expose the in-house costs the permission exists to protect. --- ## View In-House Internal Cost In-house staff costs reveal what your organization actually pays to deliver work in-house — and the margin it makes on internal labor. That's sensitive financial information, so PAI keeps it behind its own permission and lets you decide who can see it. **View In-House Internal Cost** controls who can see and edit the *internal* side of in-house lines — on estimates, on budgets, on the Expenses report, on a project's [Track Hours](../04-Executing-the-Job/Hours-Reporting.md) page, and on the user record's rate tabs. **It's on by default for Owners only.** Workspace Admins, Project Admins, and the staff members themselves do not see in-house internal rates unless the permission is granted to them. **Only an Owner can grant it** — an Admin cannot enable it for themselves or others. A staff member cannot see their own internal rate. **What's hidden when the permission is off.** On **in-house lines only**, these fields show an eye-slash icon in place of a value: - Internal Rate - Internal Subtotal - Internal Fringe - Internal Total - Margin $ - Margin % Totals that would include those values are hidden the same way: in-house group totals and SUM footers in the estimate, budget and Track Hours grids, and the in-house rows, **Subtotal** and **Grand Total** in [Live Margins](../06-Financial-Visibility/Live-Margins.md). Where PAI can give an honest figure without in-house cost, it does: the floating totals box and Live Margins show an **Out Of Pocket** read (internal, margin and working total from out-of-pocket lines only) next to the blended external total. **What stays visible.** Everything else remains fully accessible. On in-house lines, users without the permission still see the external rate, external subtotal, external total, and all logistics — hours, days, flat amounts, Assigned To, and Dates — so they can run the external and scheduling side of internal work without ever seeing what it costs the organization. And on **out-of-pocket lines, nothing is hidden**: the internal (vendor cost) and margin stay visible to everyone, exactly as before. The gate is specific to in-house internal costs. > [!important] > "Internal" means the cost side on every line. On out-of-pocket lines that's the vendor cost, which everyone sees. View In-House Internal Cost hides only the internal values on **in-house** lines. If a user reports they can see internal numbers on some lines but not others, this is why — and it's working as intended. One place the permission has no bearing: [Hours Reporting](../04-Executing-the-Job/Hours-Reporting.md). The reporting modal deals only in hours and shows no rates, subtotals, or totals to anyone, whether they hold View In-House Internal Cost or not. The permission also reaches beyond line items. Without it, a user doesn't see in-house internal rates on user records, and can't be given reporting surfaces that present blended in-house and out-of-pocket figures, most notably [Insights](../06-Financial-Visibility/Insights.md), which is built on blended totals. The [Expenses](../06-Financial-Visibility/Expenses.md) report stays available but eye-slashes in-house internals the same way the budget does. --- ## Removing Users To remove a user, open their record in **Settings → Users** and choose **Delete User** from the **⋯** menu. Deletion immediately revokes all access to your organization and any projects they were assigned to. > [!note] > Removing a user archives their record rather than permanently deleting it — nothing is ever fully deleted. An archived user can't log in and loses all access, but their past contributions stay attributed to them, preserving the history of their actions in project records. Because the record is retained, you can find it with **Show Deleted** on the Users list and restore the user to give their access back. --- ## Assigning Access to Projects For users with restricted roles (Project Admin or Guest), you control which projects they can see through one of three assignment methods. ### By Project Assign a user directly to a specific project. Navigate to the project and add them as a contact or collaborator. Changes take effect immediately. Workspace Owners and Admins don't need project assignments — they can see everything. ### By Campaign Add the user as a contact on the campaign's **Contacts** tab. They're shared on the campaign and on every project in it, including projects added later. See [Campaigns](../06-Financial-Visibility/Campaigns.md#contacts-and-sharing). ### By Client Assign a user to a client record and they'll automatically gain access to all existing and future projects associated with that client. 1. Navigate to the client record 2. Open the **Assignments** tab 3. Type the user's name to assign them This is the most efficient method for team members who consistently work with a specific client — account managers, dedicated creative teams, or producers who run all productions for a particular brand. It eliminates the need to manually assign new projects as they're created. --- ## Signing In and Security By default, PAI signs users in with a link sent to their email. Each user can also sign in with a password, a passkey or a linked Google account, and turn on two-step verification with an authenticator app, all under **Settings → Security**. See [Securing Your Account](../00-Understanding-PAI/First-Login-and-Setup.md#securing-your-account). - **Two-step verification** is each user's choice. It needs a password, and turning it on disables sign-in links for that user. - **Sessions** last two weeks per device. Each user sees and revokes their own sessions under **Settings → Security**. - **Someone can't get in?** **Send Sign-In Link** on their user record emails them a link. - **Passwords set before the October 2026 sign-in update** no longer work. Users are asked to reset them, or to use an email link, the first time they try. --- ## Activity Logging PAI maintains an audit log of user actions, including document creation and modification, estimate version updates, and invoice approvals. This provides an accountability trail across the workspace.