Understanding roles
Plane has three primary role types for workspace members.Admin
Admins have full access to everything in the workspace. They can manage workers, run payroll, approve payments, configure settings, create API keys, and view all reports. Every workspace has at least one admin—the account owner. Use the admin role for founders, HR leads, and anyone who needs unrestricted access to manage operations.Manager
Managers have access to their direct reports and the data associated with those workers. Plane supports several manager subtypes that refine what a manager can do:- Manager—can view and manage their assigned direct reports, including approving expense reports and time off requests
- Full access manager—has broader visibility across workers beyond their own direct reports
- Direct reports payer—can initiate and approve payments for their direct reports
- Payment request assistant—can assist with payment requests
Viewer and Accountant
- Viewer—read-only access to workspace data and reports, without the ability to make changes
- Accountant—access to reports and accounting features for bookkeeping and financial oversight
Inviting members
Admins invite new members to the workspace from Settings > Users. When you invite someone, Plane sends an email with a link to create their account and join the workspace.Add a new member
Click Invite and enter the person’s name, email address, and desired role. Select whether they should be an admin or a specific manager type.
Worker access
Workers—employees, contractors, and vendors—access Plane through a separate portal where they can view their own information, submit expense reports, manage documents, and track payments. Workers are not invited through the user settings page. Instead, they receive access when they are added as a worker and onboarded. Workers can only see their own data. They cannot view other workers’ information, payroll details, or organizational settings.Manager assignment and reporting structure
Managers are linked to workers through the reporting structure. When you assign a manager to a worker during onboarding or from the worker’s employment settings, that manager gains access to the worker’s profile, expense reports, and related data based on their manager role. The reporting relationship determines:- Which expense reports the manager can approve
- Which workers appear in the manager’s dashboard
- Which data the manager can access in their scoped views
Changing a worker’s manager immediately updates access. The new manager gains visibility and the previous manager loses access to that worker’s data.
What each role can do
Here is a summary of key capabilities by role.| Capability | Admin | Manager | Viewer | Accountant | Worker |
|---|---|---|---|---|---|
| View all workers | Yes | Direct reports only | Yes | No | No |
| Manage workers | Yes | No | No | No | No |
| Run payroll | Yes | No | No | No | No |
| Approve expense reports | Yes | Direct reports | No | No | No |
| View reports | Yes | No | Yes | Yes | Own payments only |
| Manage workspace settings | Yes | No | No | No | No |
| Create API keys | Yes | No | No | No | No |
| Manage sandboxes | Yes | No | No | No | No |
| Submit expense reports | No | No | No | No | Yes |
| Accounting / GL exports | Yes | No | No | Yes | No |
Permission scoping
Plane applies permissions at three levels of scope:- Self—you can only access your own data. Workers operate at this scope by default.
- Group—you can access data for a defined set of people, typically your direct reports. Managers operate at this scope.
- All—you can access data across the entire organization. Admins operate at this scope.
Revoking access
To remove someone’s access to your workspace:- For admins and managers—navigate to Settings > Users, find the person, and archive their access. Archiving removes their ability to sign in and access workspace data.
- For workers—off-boarding a worker through the standard worker lifecycle handles access removal automatically.
SSO and domain verification
For teams that use single sign-on, Plane supports SSO configuration and domain verification through Settings > Users. Admins can configure SSO to enforce authentication through your identity provider, and verify your company domain to streamline the sign-in experience for your team.Can one person have multiple roles?
Can one person have multiple roles?
Yes. A workspace member can hold multiple manager roles simultaneously. For example, someone can be both a manager and a direct reports payer. Admin access is a separate designation that grants full workspace access regardless of other roles.
What happens when I change a worker's manager?
What happens when I change a worker's manager?
The new manager immediately gains access to the worker’s profile and related data (expense reports, time off, etc.). The previous manager loses access to that worker. No historical data is deleted—the change only affects ongoing access.
Can managers see payroll and compensation data?
Can managers see payroll and compensation data?
By default, managers can view information about their direct reports but do not have access to detailed payroll runs or compensation data. Admins control what data managers can see based on the specific manager roles assigned.
How do I give my accountant access to Plane?
How do I give my accountant access to Plane?
Invite them from Settings > Users and assign the Accountant role. This gives them access to reports and accounting features without the ability to manage workers or run payroll.