Permission Tier Assignment Before Client Workspace Access (Onboarding)

Permission Tier Assignment Before Client Workspace Access (Onboarding)

1. 01

   Map every client-side participant to a named role before any account is created

   List the client sponsor, day-to-day contact, and any external stakeholders, then decide which of them needs edit rights versus comment-only versus view-only. Roles drive the permission template, not the other way around.

2. 02

   Define the three permission tiers your agency will support and freeze them for the engagement

   A workable default is: internal delivery (full edit plus billing visibility), client core (edit on assigned tasks, no rate cards), client observer (read-only plus comment). Adding a fourth tier mid-project is where access sprawl starts.

3. 03

   Strip financial fields from every client-visible view before the first invite goes out

   Budget columns, hourly rates, and margin rollups live in the internal view only. In platforms like Productive or Teamwork, this is a field-level or view-level setting that must be verified per project, not assumed from the template.

4. 04

   Confirm guest and external-user limits against the plan you are actually paying for

   Several platforms meter guest seats separately from full seats, and a client adding five stakeholders can push an agency onto a higher tier mid-quarter. Check the seat math before promising open client access.

5. 05

   Run a two-person test invite using a non-agency email address

   One person sends the invite, a second person accepts it from outside the agency domain and screenshots what the client actually sees. This catches inherited permissions that look correct in the admin panel but leak in practice.

6. 06

   Log the permission matrix in the client's onboarding record with an owner and a review date

   Record who approved each tier, when access was granted, and the next scheduled review. When a client contact leaves, this record is the only fast way to find and revoke their access.

7. 07

   Set a 30-day access review reminder tied to the retainer renewal cycle

   Access granted at kickoff drifts as staff turn over on both sides. Aligning the review to the retainer renewal date keeps it on a calendar someone already watches.