Members and Roles

Plane uses a role-based system to control who can access what in your workspace. Every person who signs into your Plane workspace is a member, and their role determines which features, data, and actions they can access. This keeps your payroll data, employee information, and financial operations visible only to the people who need them.

​

Understanding roles

Plane has several role types for workspace members.

​

Admin

Admins have full access to everything in the workspace. They can manage workers, run payroll, approve payments, configure settings, create API keys, and view all reports. Every workspace has at least one admin—the account owner. Use the admin role for founders, HR leads, and anyone who needs unrestricted access to manage operations.

​

Manager

Managers have access to their direct reports, the workers who report to them. Plane supports several manager subtypes that decide which of those workers’ data a manager can see and what they can do:

• Standard manager—can complete onboarding tasks, manage profiles, view compensation, and approve expenses, time off, and payment requests for their direct reports
• Payments manager—has standard manager access and can view and authorize one-time payments to their direct reports, and see those workers’ contracts and documents
• Full-access manager—has payments manager access and can add and offboard direct reports, edit their compensation, and review and approve their payroll
• Payments request reviewer—can approve payment requests for contractors under a specific manager or department

Each member has one role. A payments manager has everything a standard manager has, and a full-access manager has everything a payments manager has, so choose the one role that covers what the person needs.

​

HR Coordinator

HR Coordinators can view and maintain worker profiles across the organization. They can add and invite workers, edit personal and employment details other than work location and time-tracking settings, and check setup status without access to payroll, compensation, documents, or contracts. Use the HR Coordinator role for people operations teammates who help keep worker records complete but should not see compensation or authorize payroll and payments.

​

Organizational viewer and Accountant

• Organizational viewer—read-only access to workspace records, reports, settings, pay data, and benefits
• Accountant—can manage accounting automation, view expense reports, payments, time off, and time tracking, and access reports, including payroll, leave, and time-tracking data

These roles are useful for external advisors, accountants, or stakeholders who need visibility but should not modify data.

​

Inviting members

Admins invite new members to the workspace from People > Access. When you invite someone, Plane sends an email with a link to create their account and join the workspace. Only the workspace owner can add or remove admins.

​

Worker access

Workers—employees, contractors, and vendors—access Plane through a separate portal where they can view their own information, submit expense reports, view documents shared with them, and track payments. Workers are not invited from the Access page. Instead, they receive access when they are added as a worker and onboarded. Workers can only see their own data. They cannot view other workers’ information, the company’s payroll, or organizational settings.

​

Manager assignment and reporting structure

Managers are linked to workers through the reporting structure. When you assign a manager to a worker during onboarding or from the worker’s employment settings, that manager gains access to the worker’s profile, expense reports, and related data based on their manager role. The reporting relationship determines:

• Which expense reports the manager can approve
• Which workers appear in the manager’s dashboard
• Which data the manager can access in their scoped views

​

What each role can do

Here is a summary of key capabilities by role.

​

Permission scoping

Plane applies permissions at three levels of scope:

• Self—you can only access your own data. Workers operate at this scope by default.
• Group—you can access data for a defined set of people, typically your direct reports. Managers operate at this scope.
• All—you can access data across the entire organization. Admins, organizational viewers, and HR Coordinators operate at this scope, with role-specific limits on what data and actions they can access.

This scoping applies consistently across features. A manager with group-scoped access to expense reports, for example, sees only the reports submitted by their direct reports—not the full organization’s expenses.

​

Revoking access

To remove someone’s access to your workspace:

• For members—navigate to People > Access, find the person, and choose Remove member. They lose the access their role gave them, and workers who reported to them no longer have a reporting manager. If they are also a worker in your workspace, they keep their worker portal access.
• For workers—offboarding ends a worker’s employment, but they keep worker portal access to their own pay records and the documents shared with them.

​

SSO and domain verification

For teams that use single sign-on, Plane supports SSO configuration and domain verification. Admins can configure SSO to enforce authentication through your identity provider, and verify your company domain to streamline the sign-in experience for your team.