Roles and permissions

Separate portal administration, publishing, client decisions and read-only access.

Permissions

Summarised from the authored role permissions. Scope restrictions such as “own records” still apply; these symbols do not indicate completeness or runtime access.

TablePortal ManagerProject ManagerAccount ManagerInternal CollaboratorClient User — ApproverClient User — CollaboratorClient User — Viewer
master
ClientUsers View: View ClientUsers.Email and ApprovalDecisions.SignatureBlobNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
transaction
MagicLinksNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated View: View MagicLinks issued to self via the inbound URL handler onlyNo table-specific permission statedNo table-specific permission stated
line item
ApprovalDecisions View: View ClientUsers.Email and ApprovalDecisions.SignatureBlobNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
  • Portal ManagerTrigger the client-user-invite workflow and issue ad-hoc magic-links
  • Account ManagerReceive the client-activity-digest weekly email and the inactive-user-reminder cc
Manage / maintain View Specific actions— No table-specific permission statedPermissions also apply to agents

How permissions work

5 rules

Evaluate active site, client identity, project visibility and project grant together.

Apply role, row, field and audience restrictions to APIs, downloads, feeds and notifications.

Only the named Client User — Approver can decide an addressed request.

External viewers cannot post comments or decisions.

Keep token hashes, signature evidence and internal activity logs restricted.

The roles

Portal Manager

Owns the ClientUsers list and access grants for one or more PortalSites. The day-to-day operator of the external user lifecycle — invitations, role changes, suspensions, access reviews.

Permissions and screens
  • CRUD on ClientUsers, PortalUserAccess, PortalProjects (add / hide / archive), and MagicLinks (reissue)
  • Read on PortalSites, BrandThemes, EmailTemplates, DocumentShares, ApprovalRequests, StatusUpdates, Comments, ActivityFeed, ClientActivities for owned PortalSites
  • View ClientUsers.Email and ApprovalDecisions.SignatureBlob
  • Trigger the client-user-invite workflow and issue ad-hoc magic-links
  • Cannot modify PortalSites brand config (Admin) or post on behalf of a Project (Project Manager)
Publication ScheduleDraft
Share NumberDocument NamePortal ProjectPublish Start
Recent Document Downloads (Internal)
Document ShareClient UserDownloaded AtAcknowledged
Pending Approvals to Send (Internal)Pending
Request NumberSubjectTypePortal Project
Change Order
Project Manager

Internal Project owner. Publishes DocumentShares, ApprovalRequests, and StatusUpdates for own projects; reads ClientUser engagement on own projects.

Permissions and screens
  • CRUD on DocumentShares, ApprovalRequests, StatusUpdates, and Comments where the PortalProject.Project is one this user owns or is assigned to in Project Management
  • Read on ClientUsers and ClientActivities scoped to own projects
  • Read on DocumentDownloads and ApprovalDecisions for own projects
  • Cannot CRUD PortalSites, BrandThemes, EmailTemplates, or PortalUserAccess (Admin / Portal Manager own those)
  • Cannot view ClientUsers outside own projects
Publication ScheduleDraft
Share NumberDocument NamePortal ProjectPublish Start
Recent Document Downloads (Internal)
Document ShareClient UserDownloaded AtAcknowledged
Pending Approvals to Send (Internal)Pending
Request NumberSubjectTypePortal Project
Change Order
Account Manager

Customer-success operator. Watches client engagement across an account portfolio, follows up on inactive clients, escalates disengagement risk to Project Managers and Portal Manager.

Permissions and screens
  • Read on ClientUsers, ClientActivities, DocumentDownloads, ApprovalRequests, ApprovalDecisions, StatusUpdates, and ActivityFeed for ClientUsers within owned accounts
  • Receive the client-activity-digest weekly email and the inactive-user-reminder cc
  • CRUD on Comments and CommentReplies on own-account threads
  • Cannot modify ClientUsers (Portal Manager owns), cannot publish documents or status updates (Project Manager owns)
Recent Document Downloads (Internal)
Document ShareClient UserDownloaded AtAcknowledged
Open Comment Threads (Internal)Active
Posted AtParent TypePortal ProjectAuthor Client User
Approval Request
Recent Status Updates (Internal)
Update NumberTitlePortal ProjectHealth Flag
At Risk
Internal Collaborator

Limited internal contributor — a designer, engineer, analyst, or specialist who needs to participate in client conversations on own projects but not publish artifacts.

Permissions and screens
  • Read on DocumentShares, ApprovalRequests, StatusUpdates, and ActivityFeed for own projects
  • CRUD on Comments and CommentReplies on own-project threads
  • Cannot publish DocumentShares, StatusUpdates, or ApprovalRequests (Project Manager owns)
  • Cannot view ClientUsers.Email or ClientActivities
Open Comment Threads (Internal)Active
Posted AtParent TypePortal ProjectAuthor Client User
Approval Request
Client User — Approver

External client user with approval authority. Acts on ApprovalRequests routed to self; reads own portal content; participates in comment threads.

Permissions and screens
  • Read on own PortalSite's exposed PortalProjects (via PortalUserAccess), DocumentShares, StatusUpdates, ApprovalRequests where RequestedFromClient = self, and ActivityFeed scoped to accessible projects
  • CRUD on ApprovalDecisions for own pending requests, Comments, CommentReplies, and DocumentDownloads (write on download)
  • View MagicLinks issued to self via the inbound URL handler only
  • Cannot view other ClientUsers' email, cannot view ClientActivities, cannot access projects not granted via PortalUserAccess
Portal Home (Client)
Occurred AtEntry TypeSubjectRelated Table
Status Update Published
My Pending Approvals (Client)Pending
Request NumberSubjectTypePortal Project
Change Order
My Project Documents (Client)Published
Share NumberDocument NameCategoryPortal Project
Invoice
Client User — Collaborator

External client user with comment + read access. Same scope as Viewer but can post Comments and CommentReplies.

Permissions and screens
  • Read on own PortalSite's exposed PortalProjects, DocumentShares, StatusUpdates, ApprovalRequests, and ActivityFeed scoped to accessible projects
  • CRUD on Comments, CommentReplies, and DocumentDownloads (write on download)
  • Cannot decide on ApprovalRequests (Approver only)
  • Cannot view other ClientUsers' email or ClientActivities
Portal Home (Client)
Occurred AtEntry TypeSubjectRelated Table
Status Update Published
My Project Documents (Client)Published
Share NumberDocument NameCategoryPortal Project
Invoice
Client User — Viewer

External client user with read-only access. The default tier for client stakeholders who need visibility but no contribution rights.

Permissions and screens
  • Read on own PortalSite's exposed PortalProjects, DocumentShares, StatusUpdates, ApprovalRequests, and ActivityFeed scoped to accessible projects
  • Write only on DocumentDownloads (system-recorded on download)
  • Cannot post Comments, cannot decide on ApprovalRequests, cannot view other ClientUsers' email or ClientActivities
Portal Home (Client)
Occurred AtEntry TypeSubjectRelated Table
Status Update Published
My Project Documents (Client)Published
Share NumberDocument NameCategoryPortal Project
Invoice
ERP•AI workspace

Start now Client Collaboration Portal

Create your ERP.AI account and get started with Proto.

Start now Download agent

Customize Client Collaboration Portal. With Proto, your desktop AI agent.

Ask Proto to help you customize Client Collaboration Portal.

Customize
Client Collaboration Portal. Ask: “Adapt Portal branding and access.” ProtoYour desktop AI agent
Download nowFree install · ~1 GB · AI usage extra