Roles and permissions guide

Quick answer

Uku has two independent permission systems. The company role (Company Owner, Company Admin, or Company Member) controls company-wide capabilities. The client permission (Client Admin or Client Member) controls what a member can do on a specific client. A Company Member can hold Client Admin permission on individual clients. A Company Admin does not automatically have Client Admin on every client.

The two permission axes

Axis	What it controls	Where it is set
**Company role**	Company-wide capabilities: settings, member management, billing configuration, BI Analytics	**Members** > member row > **Edit member** > **Administrator** checkbox
**Client permission**	What a user can do on a **specific** client: view, edit, manage contracts and invoices	Client view > **Members** tab > role dropdown

These axes are independent: a Company Member can be Client Admin on some clients but not others. A Company Admin does not automatically hold Client Admin rights on every client — client permissions are granted per client.

Company roles

Uku has exactly three company roles. The member edit dialog exposes them through a single Administrator checkbox (combined with the immutable Owner position). “Manager” is not a Uku company role.

Company Owner

Exactly one per company. Unrestricted access. Ownership cannot be changed through the member edit dialog — it requires a dedicated ownership transfer action, available only to the current Company Owner.

Capabilities exclusive to the Company Owner:

• Delete a client (permanently)
• Lock company settings for all members (Disable company settings edit for all members toggle)
• Restrict billing product management (Only owners can add and update products)
• Delete the company account
• Transfer ownership to another member

Company Admin

Set by checking the Administrator checkbox in the member edit dialog. Company Admins can do everything a Company Member can do, plus:

• Edit company settings (unless the Company Owner has locked settings)
• Add, edit, and deactivate members (not the Company Owner)
• Create, edit, assign, and administer every client in the company
• Edit any task (not just their own)
• Manage workflow templates
• Access BI Analytics
• Full billing access across all clients
• Manage email integrations and templates

Company Member

Default when the Administrator checkbox is unchecked.

• View and work on tasks assigned to them
• Track time on their tasks
• Access clients they are assigned to
• Create and edit clients (unless the company setting disables this)

Additional capabilities are gated by company or billing settings a Company Admin can toggle. See Billing permission settings below.

Permission comparison

Capability	Company Owner	Company Admin	Company Member
View and work on assigned tasks	Yes	Yes	Yes
Track time	Yes	Yes	Yes
Access assigned clients	Yes	Yes	Yes
Create and edit clients	Yes	Yes	Configurable
Edit any task (not just own)	Yes	Yes	On clients where they hold Client Admin
Manage workflow templates	Yes	Yes	Configurable
Add, edit, or deactivate members	Yes	Yes	No
Edit company settings	Yes	Unless locked by Owner	No
Access BI Analytics	Yes	Yes	No
Manage contracts and invoices	Yes	Yes	Configurable + Client Admin
Delete clients	Yes	No	No
Lock settings for all members	Yes	No	No
Delete company	Yes	No	No

“Configurable” means the capability depends on a company or billing setting that a Company Owner or Company Admin can toggle.

Client permissions

Per-client permissions are set in the client view’s Members tab. When a user is assigned to a client, they receive one of two roles (the UI shows just “Admin” and “Member” — help articles use “Client Admin” and “Client Member” to make the scope unambiguous):

• Client Admin — full editing rights on that specific client. Can manage contracts and invoices for the client (when billing settings allow) and has full edit access to the client record and its tasks.
• Client Member — can view and work on the client’s tasks, but has limited management capability on that client.

Company Owners automatically have Client Admin-level access on every client. Company Admins have broad management access but client-level permissions are set per client.

How to change a company role

1. Go to Members in the left navigation.
2. Click a member’s row to open the Edit member dialog.
3. Check or uncheck the Administrator checkbox (checked = Company Admin, unchecked = Company Member).
4. Click Save.

The Company Owner position cannot be changed through this dialog. Ownership transfer is a separate action available only to the current Company Owner.

How to change a client permission

1. Open the client view for the client in question.
2. Go to the Members tab.
3. Find the user and open the role dropdown next to their name.
4. Select Admin (Client Admin) or Member (Client Member).
5. The change saves immediately.

Member statuses

Status	Access	Seat
**Active**	Full access; invitation accepted	Paid
**Invited (Pending)**	Invitation sent, not yet accepted	Paid
**Limited**	In system, no login access	Free until activated
**Inactive**	No access, no charge	None

Client Portal permissions

Client Portal users are external — they are your clients, not your team members. They have a separate permission system. Currently, enabling Access enabled on a contact gives them the standard portal experience. Granular per-permission control (Client Read, Client Edit, Task Edit, Document Read) is in development.

Billing permission settings

Several billing capabilities can be fine-tuned through Settings & Apps > Billing > Settings:

• Client invoices visible to users — lets Company Members see invoices on their assigned clients
• Invoice management enabled for users — lets Company Members create and edit invoices
• Users can manage contracts — lets users with Client Admin permission manage contracts and invoices on those clients
• Only owners can add and update products — restricts product management to the Company Owner
• Allow members to send invoices to clients — lets Company Members send finalized invoices

These settings apply company-wide. Company Admins and Company Owners always retain full billing access regardless of these toggles.