This document is a reference for permissions in Drum. Each permission controls specific access in the app.

Permission Changes and Account Approval
If you need access to a feature or permission you don't currently have, please contact your account administrator or another authorised user within your organisation to review your request. Drum does not change customer permissions without approval from someone with the appropriate authority in the account. If you're unsure who can approve your request, or if you're still experiencing an issue after your access has been updated, please contact Drum Support for further guidance.

Controls: User role and permission management

Under System Administration in Settings → Roles / User Permissions.

Super Finance doesn't give budget access on its own. To allocate or remove time and costs, the role also needs Read Budgets (or project-role Budgets View) plus the matching invoice or progress claim edit permission. See Invoices and Progress Claims below.

Granular control over user management for non-admin users:

Example: an HR role could have all four; a team lead might only have read.

Same structure as projects: Create Opportunities, View Opportunity Insights; All / Team / Assigned Read, Update, Delete.

Without Create Companies, picking an existing company still works. Typing a name that does not match an existing company stops the save with You do not have permission to create companies. Matching an existing trading or legal name (any case) uses that company and does not need Create Companies. On the company form, matching an existing name shows A company with this name already exists. and keeps the existing company.

Merging duplicate companies or suppliers needs both Update Companies and Delete Companies on the same role. See How to merge duplicate companies or suppliers.

Contacts: contacts use the same four permissions. Read Companies lets someone see contacts, Create Companies lets them add a new contact, Update Companies lets them edit or restore a contact, and Delete Companies lets them delete one. Linking a contact to a company, opportunity or project, changing its contact card there (role, description, pin or primary financial contact) or using Un-assign also needs permission to update that company, opportunity or project. Picking an existing contact to link doesn't need Create Companies.

When you add a new contact whose email (any case) or mobile matches an existing contact, Drum links the existing contact instead of making a duplicate, and doesn't change its details. If the match is a deleted contact, Drum asks you to restore that contact instead. Un-assign only removes the contact from that record. The contact stays in Drum, even when it isn't linked to anything else.

Under Resources & Bookings in Settings → Roles / User Permissions. View only.

Under Resources & Bookings on the account role.

Account admins already have these. See also project-role Resourcing below for per-project grants.

Approving and accepting quotes: these are separate permissions, so one person can approve a quote internally and someone else can record the client's acceptance. The Status list only shows Approved to people with Quote Approvals, and Accepted to people with Quote Acceptance. Quote Approvals doesn't include acceptance. Accepting a quote on an opportunity marks the opportunity as won, and if it's a variation opportunity, it also approves the linked variation.

If a quote is already Approved or Accepted, anyone who can edit it still sees that status, so it stays put when they save other changes. They can keep editing the quote without either permission.

Existing roles: when Quote Acceptance was added, every role that could approve quotes got it turned on, so nothing changed for them. Every other role has it off. Before this, anyone who could edit quotes could set Accepted, so tick Quote Acceptance on any role that should still accept quotes without approving them.

Both labels use your account's name for quotes, so they might read Proposal Approvals and Proposal Acceptance.

Converting an accepted quote: someone who can view quotes and has Quote Acceptance can convert an accepted quote's opportunity into a project, even without Create Projects or permission to update opportunities. Otherwise they need both of those. If they have neither, the convert button on the quote is greyed out, and hovering over it names the permissions they're missing. If their role can't open the new project, Drum takes them back to the quote and confirms the project was created.

Time and costs on invoices: invoice permissions alone don't show the time and costs behind an invoice. The role also needs Read Budgets (the View tick on the Budgets row), or View on Budgets in a project role the person holds on that project. Without budget access, Drum hides or blocks:

You can still create invoices that don't carry time or costs, such as Blank, Fixed Amount, Percentage of Budget and Proposal Amount. A project-role grant only covers its own project, so it can't be used to bill time recorded on another project you don't have budget access to. Super Finance on its own doesn't give budget access. Client-facing documents and uploads aren't affected.

Separate account-role checkboxes from invoices. Invoice create/approve does not grant progress claim create/approve (and the reverse).

Time and costs on progress claims: the same budget access applies. Without Read Budgets or project-role Budgets View, Drum hides or blocks:

You can still set the amounts claimed and convert the claim with Consolidate claim items to a single invoice line or Create one line item per claim item, using the lines on the claim. If your account default is a structure that shows costs, Drum uses one line per claim item instead. After conversion, people who can view the claim and have budget access can still open its saved summary report, even without invoice permissions. The report shows what was saved with the claim. The client-facing claim document and uploads aren't affected.

Under Financial Management in Settings → Roles. Separate from Invoices and Invoice Approval.

Create or update alone cannot pick Approved. When write-off approval routing is on, editors use Submit for Approval to send a pending or rejected write-off to the routed approver. Standalone write-off invoices use write-off routing (not Invoice routing). See How to configure write-off approval flows.

Under Financial Management in Settings → Roles (Project Costs row).

Under Expense Management in Settings → Roles.

Who can see which claims: your own claims; claims where you are the assigned approver or named on an approval request; and all claims only if you have View All Expense Claims (or you are an account admin). The same scope applies when opening a claim and its items, allowances, attachments and line items.

Receipts after approval: the claim owner (with Create Expense Claims) or anyone with Update Expense Claims can still attach or remove item receipts at any status.

Claim file upload zone: you need permission to update that claim, and the claim must not be a credit card claim and must not already have an approved bill.

Allocations: allocating an expense claim item to a project or task only works for projects you can open.

Project variations, variation rows, project phases and budget deliverables use the same budget permissions as the project budget screen. They do not use invoice or progress claim permissions. Without the matching permission, Drum redirects with You are not authorized to perform this action.

Approving a variation still only needs Update Budgets (or Update Budgets on your project role for that project). There is no separate variation-approval permission, and Approval Settings does not route variation approval.

Opportunity-linked variations: creating a variation with a linked opportunity checks budget create permission only. It does not also require Create Opportunities. You still need the usual proposal permissions to edit or share the linked proposal afterwards.

For a role that can raise variations but must not create invoices or approve claims, turn on the budget permissions you need and leave invoice and progress claim create/approve off.

Under Time Management in Settings → Roles / User Permissions. Opens Time → Staff and other people's timesheets (and matching staff list access for API and AI tools). It only works when the same role also has a timesheet cohort permission: View & Edit Anyone's Timesheets, Approve Anyone's Timesheets, View Team Timesheets, Approve Team Timesheets, View Direct Reports' Timesheets, or Approve Direct Reports' Timesheets. Alone it does nothing.

Turn it off on a role that should edit time on project Time tabs (for example with View & Edit Anyone's Timesheets or project-role Edit All Time Entries) without opening everyone's timesheets under Time → Staff. Approver roles need it ticked, because approving in the app happens on the Staff page. Account admins still see all staff timesheets.

Under Time Management. Create and edit time entries for other users account-wide. Does not by itself open Time → Staff; the same role also needs View Staff Timesheet Page.

Keep View Staff Timesheet Page on if they should also use Time → Staff; turn that page flag off if they should edit on project Time tabs only. For correcting time only on specific projects, see Edit All Time Entries under Project role permissions.

You do not need System Administration permissions or account admin. Timesheet edit access lives under Time Management on the permission role.

Account roles apply across the account. Project roles (Settings → Project Roles) apply only on projects where that person is assigned that role. Project role permissions add access for that project; they do not replace account-role permissions.

Turn this on for a project role, then assign that role on the projects they need. It is not an account-role checkbox.

When to use which

People can already edit their own unbilled entries on a draft timesheet without View & Edit Anyone's Timesheets. Finalised or approved weeks may still be locked. Invoiced time cannot move to another project. See How to edit a time entry.

On Settings → Project Roles, for a project role such as Project Director. Applies only on projects where that person holds the role.

Either account-role Project Resourcing View/Edit or this project-role grant is enough for the project tab. Global Resourcing still needs account-role Global Resourcing View.

More on where milestones appear: Staff resourcing views and capacity reference.

On Settings → Project Roles, for a project role such as Project Director. Applies only on projects where that person holds the role. These grants are an alternative to the matching account-role budget permissions for that project.

Account-role Create/Read/Update/Delete Budgets still apply account-wide. Either the account-role permission or the matching project-role grant is enough for that project’s variation and budget screens.

Under Email & Communication in Settings → Roles. These rights control who can open Project Emails (nav menu, Email), open the Emails tab on a project or opportunity, allocate a thread to projects, and delete a thread.

You need one of these rights, and the thread must be in your scope. If you cannot open a thread, Drum shows that it was not found (not a generic unauthorised message).

Allocate to projects / Project Allocation: on a thread you can open, you can add or remove only projects and opportunities you can already open and that your Emails right covers. Links you leave unchanged stay as they are, even if you cannot open that project yourself.

Delete Email: deleting a thread removes it from every project it is linked to. You can delete only when you could unlink every kept (not deleted) project on that thread. Deleted projects do not block delete. Account admins can delete any thread.

Turn on under Settings → Roles for any non-admin role that should create or edit templates. Account admins already have Customisation.

Role permissions decide whether someone can create or approve a record type. Approval Settings (Settings → Approval Settings) decide who receives an approval request when that flow is configured.

Approval Settings can be set separately for: Invoice, Progress claim, Expense claim, Cost, Purchase order, Timesheet, and Write-off.

For write-offs, role permission Write-Off Approval decides who can pick Approved (together with admins, Can also be approved by roles, and the routed approver). Approval Settings → Write offs decides who receives the approval request. Notifications for that flow are named Write Off.

Project variations are not in that list. Who can create, change or delete a variation (and its rows), add phases or budget deliverables, or approve a variation by changing its status, is controlled by budget permissions (account-role Create/Update/Delete Budgets, or the matching project-role budgets grants). Invoice or progress claim approval routing does not apply.