Roles and permissions

Separate proposal preparation, gate review, funding approval and executive visibility.

Permissions

Summarised from the authored role permissions. Scope restrictions such as “own records” still apply; these symbols do not indicate completeness or runtime access.

TablePortfolio ManagerProgram ManagerInitiative OwnerGate ReviewerProject ManagerExecutiveFinance
transaction
GateReviews Specific actions: create / edit gated to Admin co-sign), GateReviews (as Facilitator), RoadmapSnapshots (trigger manual snapshots), and PortfolioReviewsNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
BudgetsNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated Manage / maintain: Manage Budgets (set TotalAmount, approve, lock, close) and read BudgetAllocations
FundingAllocations Specific actions: Approve or reject FundingAllocations jointly with FinanceNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated Specific actions: Approve / reject FundingAllocations jointly with Portfolio Manager
RoadmapSnapshots Specific actions: create / edit gated to Admin co-sign), GateReviews (as Facilitator), RoadmapSnapshots (trigger manual snapshots), and PortfolioReviewsNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
PortfolioReviews Specific actions: create / edit gated to Admin co-sign), GateReviews (as Facilitator), RoadmapSnapshots (trigger manual snapshots), and PortfolioReviewsNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
line item
BudgetAllocationsNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated Manage / maintain: Manage Budgets (set TotalAmount, approve, lock, close) and read BudgetAllocations
  • Portfolio ManagerTrigger stage-gate-promotion (manually flip Status: ReadyForGate
  • Program Managercannot facilitate a GateReview (Portfolio Manager only)
  • Initiative Ownerread-only once it enters UnderReview
  • ExecutiveNo write anywherecannot trigger workflowsLands on the Portfolio Health home dashboard
  • Financeallocation corrections use the same jointly approved, idempotent reconciliation service and cannot overwrite approved amounts directly
Manage / maintain View Specific actions— No table-specific permission statedPermissions also apply to agents

How permissions work

5 rules

Apply workspace, portfolio and program scope on every query and action.

Preserve field masking for estimated costs, benefits and reviewer scores.

Require distinct Portfolio Manager and Finance funding decisions; preparers cannot approve themselves.

Admin configures the system and cannot rewrite closed decisions.

Use authenticated Users bindings and an append-only platform audit trail.

The roles

Portfolio Manager

The PMO Lead — owns the function. Curates Portfolios, organizes Programs, owns the Backlog ranking, runs the quarterly PortfolioReviews, facilitates GateReviews, and owns the rebalance decisions.

Permissions and screens
  • CRUD on Portfolios they own, Programs, Initiatives, Proposals, Backlog (rank order), StrategicGoals (org-wide read
  • create / edit gated to Admin co-sign), GateReviews (as Facilitator), RoadmapSnapshots (trigger manual snapshots), and PortfolioReviews
  • Read all ProposalScores, GateScorecards (post-Closed), BudgetAllocations, FundingAllocations, KPIs, KPIMeasurements, Risks, Dependencies org-wide
  • Trigger stage-gate-promotion (manually flip Status: ReadyForGate
  • open the related GateReviews at InReview), roadmap-recompute (manual snapshot), and quarterly-portfolio-review (manual packet regen)
  • Approve or reject FundingAllocations jointly with Finance
  • Cannot modify StageGates or Scorecards mid-cycle (Admin gate)
  • cannot bypass Finance on a FundingAllocations approval
Funding Requests Awaiting DecisionSubmitted
Request NumberInitiativeRequesterFiscal Year
Gate PipelineScheduled
Gate Review NumberInitiativeStageFacilitator
Backlog (Ranked)
Backlog RankProposal NumberTitleSponsor
Program Manager

Owns one Program (and any nested sub-Programs) — the Initiatives within it, the cross-Initiative Dependencies, the rolled-up Program KPIs.

Permissions and screens
  • CRUD on Programs where Owner = self
  • CRUD on Initiatives where Initiatives.Program IN (own Programs) including InitiativeProjects and GoalAlignments line items
  • Read on org-wide Portfolios (parent context), StrategicGoals, StageGates, Scorecards
  • Read on own Program's KPIs, KPIMeasurements, Risks, Dependencies, BudgetAllocations (own Initiatives only — Amount masked beyond own Initiatives), FundingAllocations (own scope only)
  • Read on own Program's GateReviews and GateScorecards (post-Closed only — pre-decision Reviewer scores masked)
  • Cannot modify Initiatives outside own Program
  • cannot facilitate a GateReview (Portfolio Manager only)
  • cannot finalize PortfolioReviews
Gate PipelineScheduled
Gate Review NumberInitiativeStageFacilitator
Backlog (Ranked)
Backlog RankProposal NumberTitleSponsor
Open Risks HeatmapOpen
InitiativeTitleCategoryLikelihood
Cost
Initiative Owner

Owns one Initiative end-to-end — authors the Proposal, prepares gate packets, owns the KPIs catalog for the Initiative, requests funding, raises Risks and Dependencies, and reports KPIs (or delegates to the named ProjectManager).

Permissions and screens
  • CRUD on own Proposals (where Submitter = self) while Status is Backlog
  • read-only once it enters UnderReview
  • CRUD on own Initiatives (where Owner = self) including InitiativeProjects and GoalAlignments line items
  • CRUD on KPIs for own Initiatives
  • Read own KPIMeasurements (CRUD on own-reported rows)
  • CRUD on Risks for own Initiatives (self as Owner or named Owner)
  • CRUD on Dependencies for own Initiatives (raise, mark resolved)
  • CRUD on FundingAllocations where Requester = self until Status: Submitted, then read-only
Open Risks HeatmapOpen
InitiativeTitleCategoryLikelihood
Cost
KPIs At RiskAmber
InitiativeNameBaseline ValueTarget Value
My Proposals
Proposal NumberTitleStatusWeighted Score
Under Review
Gate Reviewer

A reviewer-only role layered on the user — when assigned to a GateScorecards row (via the stage-gate-promotion workflow), gains read access to the gate packet and write access to own GateScorecards rows.

Permissions and screens
  • Read own GateScorecards rows (where Reviewer = self)
  • CRUD on own GateScorecards rows until Status: Submitted, then read-only
  • Read on the parent GateReviews header, the linked Initiatives (Name, Description, EstimatedCost, EstimatedBenefit, AlignmentScore, HealthScore, attached deliverables), the linked Initiative's Risks and Dependencies (read-only), and the GateScorecard's Scorecard and ScorecardDimensions
  • Cannot see other Reviewers' GateScorecards.Score until the parent GateReviews.Status: Closed
  • No access to Backlog, PortfolioReviews, FundingAllocations, BudgetAllocations
Gate Reviews I Need To ScoreNotStarted
Gate ReviewGate Review InitiativeGate Review StageGate Review Scheduled At
GS
Proposals Awaiting My Score
ProposalDimensionScored AtProposal Title
Project Manager

Read-only on Portfolio context for own Projects (so a delivering PM can see how their Project fits the Initiative narrative) and write on KPIMeasurements they are named owner of.

Permissions and screens
  • Read on Initiatives where Initiatives.Initiative IN (Initiatives joined via InitiativeProjects WHERE ProjectRef IN own Projects) — but EstimatedCost and EstimatedBenefit are masked
  • Read on KPIs for those Initiatives
  • CRUD on KPIMeasurements where KPI.Owner = self (typically when the PM is named the KPI Owner for delivery-stage KPIs)
  • Read on Risks and Dependencies for those Initiatives (no edit)
  • Read on parent Programs and Portfolios (Name, Charter, Owner only)
  • No access to Proposals, Backlog, GateReviews, GateScorecards, Budgets, BudgetAllocations, FundingAllocations, PortfolioReviews
Roadmap (Latest Snapshot)
InitiativeStart DateTarget End DateCurrent Stage
Executive

Read-only dashboard view — the CEO / COO / business unit GM who consumes the portfolio output without operating the system.

Permissions and screens
  • Read org-wide on Portfolios, Programs, Initiatives (including EstimatedCost, EstimatedBenefit, AlignmentScore, HealthScore, KPIAttainment), StrategicGoals, RoadmapSnapshots, RoadmapTimeline, PortfolioReviews (including DecisionsSummary), KPIs, KPIMeasurements, Risks (rolled-up Score
  • per-Risk narrative gated), and Dependencies (rolled-up at-risk count)
  • Read aggregate Budgets (TotalAmount, AllocatedAmount, RemainingAmount, SpentAmount)
  • per-Initiative BudgetAllocations.Amount masked unless ExecutiveSponsor on the Portfolio
  • No write anywhere
  • cannot trigger workflows
  • Lands on the Portfolio Health home dashboard
KPIs At RiskAmber
InitiativeNameBaseline ValueTarget Value
Roadmap (Latest Snapshot)
InitiativeStart DateTarget End DateCurrent Stage
My Portfolio Dashboard
Portfolio CodeNameStatusAlignment Score
Paused
Finance

Read-only on Portfolio context with write on Budgets and co-approver on FundingAllocations. The reconciliation seat between Portfolio plan and the GL.

Permissions and screens
  • Manage Budgets (set TotalAmount, approve, lock, close) and read BudgetAllocations
  • allocation corrections use the same jointly approved, idempotent reconciliation service and cannot overwrite approved amounts directly
  • Approve / reject FundingAllocations jointly with Portfolio Manager
  • Read org-wide on Portfolios, Programs, Initiatives (including EstimatedCost, EstimatedBenefit), and PortfolioReviews
  • Read on KPIs and KPIMeasurements with financial flavor (Currency / Numeric MeasureType)
  • No access to Proposals, ProposalScores, GateReviews, GateScorecards, Risks (narrative), or Dependencies (narrative)
  • Owns the inbound actuals feed back onto Budgets.SpentAmount
Funding Requests Awaiting DecisionSubmitted
Request NumberInitiativeRequesterFiscal Year
Roadmap (Latest Snapshot)
InitiativeStart DateTarget End DateCurrent Stage
ERP•AI workspace

Start now Portfolio Management

Create your ERP.AI account and get started with Proto.

Start now Download agent

Customize Portfolio Management. With Proto, your desktop AI agent.

Ask Proto to help you customize Portfolio Management.

Customize
Portfolio Management. Ask: “Adapt Strategy and portfolios.” ProtoYour desktop AI agent
Download nowFree install · ~1 GB · AI usage extra