Feature Matrix by Role

Ticku uses a three-tier access model:

1. Platform admin (isPlatformAdmin) — a tenant-less super-role. Creates, approves, suspends, and lists tenants, and grants/revokes platform-admin. It does not, by itself, grant access inside any tenant's workspace.
2. Tenant membership — per tenant, a user's Membership carries an isAdmin flag (unlocks that tenant's admin panel) and a baseline role. One user can be an admin in their own tenant and a plain member in another.
3. Per-project role — every project member holds one dynamic role whose abilities come from a permission catalog. Roles are scoped to the project type and are editable by tenant admins.

note

A membership's admin flag and a project role are independent — a tenant admin still needs a project role to work inside a project. And nothing works until the user's tenant is ACTIVE and their membership is ACTIVE.

:::tip Following is the exception to project-scoped access A follower can read a single ticket or sub-task without any project role at all. It's the one way to grant access to one item rather than a whole project — see that page for how guest access is provisioned. :::

Per-Project Permissions (default roles)

Default roles are seeded per project type and can be renamed or re-scoped by admins in the Roles module. The defaults are:

Support projects

Action	Creator	Member	Viewer
Create / update Subject folders	✅	❌	❌
Create ticket	✅	❌	❌
Update / assign ticket	❌	✅	❌
Move ticket to working statuses	✅¹	✅	❌
Close / reopen / defer ticket	✅	❌	❌
Archive ticket	✅	❌	❌
Escalate ticket	✅	❌	❌
Create / update sub-tasks	view only	✅	❌
Comment, reply, react	✅	✅	✅
Upload attachments	✅	✅	✅
Manage followers	✅	✅	✅
View tickets, board, dashboard	✅	✅	✅

¹ Support Creator owns opening/closing and Subject folders but does not edit or assign tickets — that is the Member's job.

Consulting / Dev projects

Action	Lead	Member	Viewer
Create / update Subject folders	✅	❌	❌
Create / update / assign ticket (Task)	✅	✅	❌
Move to working statuses	✅	✅	❌
Close / reopen / defer	✅	❌	❌
Archive	✅	❌	❌
Escalate	✅	❌	❌
Create / update sub-tasks	✅	✅	❌
Log time (Consulting only)	✅	✅	❌
Comment / reply / react / attach	✅	✅	✅
Manage followers	✅	✅	❌

Epic projects

Epics have no Subject folders and no sub-tasks. There are only two roles:

Action	Lead	Viewer
Create / update / assign / archive Epic	✅	❌
All status transitions	✅	❌
Comment / attach	✅	❌
View Epics	✅	✅

info

The Epic Viewer is deliberately action-less — it can open the project and read Epics but cannot even comment.

Tenant Admin Panel (membership isAdmin)

• Manage users within the tenant (invite, activate/deactivate, approve sign-ups, grant tenant-admin, handle re-approval requests)
• Create and configure projects (type, prefix, billing, members, epic links)
• Define dynamic roles and their permissions per project type
• Manage tags
• Define custom attribute fields per project
• Customize status display names and colors
• Configure the master calendar (working hours, weekends, holidays)
• Manage incoming HTTP webhooks
• Connect email inboxes, route mail to projects, and monitor connection health

Platform Admin (cross-tenant)

• Create tenants, approve/reject self-serve registrations, suspend/restore tenants
• List all tenants and their status
• Grant or revoke platform-admin

See Roles & Permissions for the full permission catalog, and Project Types for how roles differ per type.