Who sees which settings
Settings has two parts. My account is for everyone, guests included: what concerns only you, you change yourself. Workspace and Administration hold what concerns everyone, and each page shows only to roles with the permission it needs. Someone without any of those permissions sees only My account.
My account (everyone)
Section titled “My account (everyone)”- Profile & appearance: name, picture, language, time zone, theme, notifications, passkeys and devices. People who do not see General can also leave the workspace here.
- My integrations: the apps you connect for yourself, such as your calendar link, your Slack account and AI assistants like Claude or ChatGPT. See My integrations.
- AI usage: your own conversations and credits.
Workspace pages and their permission
Section titled “Workspace pages and their permission”| Page | Permission needed |
|---|---|
| General (name, logo, language, time zone) | Change the workspace’s name, logo and language |
| Labels | Change statuses, types and priorities |
| Work | Any of: statuses and types, workspace settings, integrations |
| Integrations | Connect integrations and rules |
| AI assistant | Change the workspace’s name, logo and language |
| Members & roles | Invite people and manage roles |
| Security and data | Change the workspace’s name, logo and language |
| Plan and billing | See and change the plan and billing details |
| Audit log | See the audit log |
The built-in Admin role has all of these, and owners may always do everything. A custom role can have just some of them, for example only Plan and billing for someone in finance.
What people may connect for themselves
Section titled “What people may connect for themselves”Under Settings → Integrations → Rules, people with the Connect integrations and rules permission decide who may use each personal integration: the calendar link, Google Drive, Slack accounts, AI assistants and personal API keys. For each one choose Off for everyone, Chosen roles or Everyone, guests included. By default everyone but guests may, and owners always may unless it is off. Personal API keys are the exception: they are off until you turn them on.
It applies at once, in the database: a calendar stops getting its link, nobody can attach new Google Drive files, Slack messages and /task stop, and AI assistants are refused. People’s links and connections are kept, so they work again when it is turned back on, and people can still remove their own. On My integrations a turned-off app shows Turned off in this workspace. For AI assistants you also choose which ones: all MCP assistants, or only Claude and ChatGPT.
Below the rules, Connected by people lists who has connected what and when (calendar links, Google Drive, Slack accounts, AI assistants and personal API keys), and when it was last used. It never shows links, keys or what someone did in the other app. Remove stops a connection at once; the person can connect again if the rules allow it. Making and removing calendar links, linking Slack, connecting AI assistants and removing someone’s connection all show in the audit log.
Default roles
Section titled “Default roles”| Owner | Admin | Member | Guest | |
|---|---|---|---|---|
| My account | Yes | Yes | Yes | Yes |
| Workspace and Administration pages | Yes | Yes | No | No |
| Plan and billing | Yes | Yes | No | No |
| Delete the workspace, transfer ownership | Yes | No | No | No |
Outside settings
Section titled “Outside settings”Guests see only the projects they are in, with their items, comments, files, boards and activity. Everyone else sees every project in the workspace. A guest joins a project when they are added to it, become its lead, or get an item in it assigned, and the project then shows among their favourites in the sidebar. See Project chat.
Everyone sees who is in the workspace on People, at the bottom of the sidebar: name, picture and role. E-mail addresses and invitations are only under Settings → Members & roles, for people who may manage members. The same goes for the API and AI assistants: everyone else sees names only. Guests see the team but not other guests.
When someone without the plan permission hits a plan limit, the message tells them to ask an admin.
Checked on the server
Section titled “Checked on the server”Hiding a page in the menu is a convenience, not the protection. Every workspace page and the functions behind it check the permission on the server and in the database, so a direct link or an API call without the permission is refused.
WORK³ · powered by NOD³