Getting Started & Workspace
Understanding Role Permissions (Owner/Admin/Member/Viewer)
A deep-dive reference guide into Flanceflow’s four security authorization levels and how data boundaries protect your studio finances.
Security and privacy are paramount when working with contractors and clients. Flanceflow implements server-authoritative role checks across Firestore rules and Cloud Functions to guarantee that private revenue records, client contact details, and billing tokens cannot be inspected by unauthorized roles.
Managing role permissions
- Navigate to Settings > Manage Workspace from your desktop or browser.
- Review the active members list showing name, email, current role, and join date.
- To change an existing member’s permissions, click the role dropdown next to their name.
- Select their new role (e.g. promote Member to Admin, or switch to Viewer).
- Click "Update Permissions" to apply the change immediately across all client sessions.
- To remove a contractor upon project completion, click the trash icon and confirm "Remove Member".
Complete permission matrix
| Feature area | Owner | Admin | Member | Viewer |
|---|---|---|---|---|
| View Revenue & Dashboard | Full access | Full access | No access (Hidden) | No access (Hidden) |
| Create & Send Invoices | Full access | Full access | No access | No access |
| Kanban Tasks & Board | Create & Edit | Create & Edit | Move & Update Assigned | Read-only |
| Client Portal Files | Upload & Delete | Upload & Delete | Upload & Comment | Download only |
| Time Tracking Logs | All Team Logs | All Team Logs | Own Logged Hours | Own Logged Hours |
| Workspace Plan & Billing | Manage & Pay | View status only | No access | No access |
| Delete Workspace Data | Yes (Protected) | No access | No access | No access |
Security best practices
- Regular audits: When projects end, review your Workspace Members list and remove inactive contractor accounts.
- Viewer role for stakeholders: Use the Viewer role when giving external project reviewers or academic supervisors visibility into deliverable timelines without granting edit capabilities.
- Single sign-on protection: Team members authenticate via their own Google, Microsoft, or email OTP credentials; workspace owners never need to share master account passwords.
Was this guide helpful?
👍 Yes
👎 No