Projects
The engagement after a proposal is accepted — milestones, blockers, change control, and the money
that rides on them. See
Reading the tables for the conventions, and
/admin/settings/scope in the platform for the live per-tenant answer.
Capabilities — delivery
| Capability | Gate | Admin | CSM | SDM | Expert | Vendor | Customer |
|---|---|---|---|---|---|---|---|
| View milestones | milestone.view | ✔️ | ✔️ | ✔️ | ✔️ (own) | ✔️ | ✔️ (own) |
| Start a milestone | milestone.start | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❌ |
| Complete a milestone (owner / manager) | milestone.complete | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❌ |
| Block a milestone | milestone.block | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❌ |
| Unblock a milestone | milestone.unblock | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❌ |
| Acknowledge a completed milestone | milestone.acknowledge | ✔️ | ✔️ | ✔️ | ❌ | ❌ | ✔️ (own) |
| Raise a blocker (own work only) | blocker.raise | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❌ |
| Clear a blocker | blocker.clear | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❌ |
| Record change control (own work only) | changeControl.record | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❌ |
| Add an action item | actionItem.add | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❌ |
| Complete an action item (own work only) | actionItem.complete | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ |
| Escalate | escalation.raise | ✔️ | ✔️ | ✔️ | ❌ | ❌ | ❌ |
| Raise a concern | concern.raise | ✔️ | ❌ | ❌ | ❌ | ❌ | ✔️ |
| Message the delivery team | message.team | ✔️ | ❌ | ❌ | ❌ | ❌ | ✔️ |
| View the engagement activity timeline | activity.view | ✔️ | ✔️ | ✔️ | ✔️ (own) | ✔️ | ✔️ (own) |
| View the people on the engagement | people.view | ✔️ | ✔️ | ✔️ | ❌ | ❌ | ✔️ (own) |
Completing a milestone is held by the delivering expert and by managers — the owner / manager qualifier is a hint the platform renders next to the lever, not a second gate. Raising a concern and messaging the delivery team are the customer’s channels; escalation is the managers’ equivalent, and the two are separate capabilities.
Completing and acknowledging are different acts by different parties. Completing is the
expert’s statement that the work is finished; acknowledging is the customer’s agreement that it
is. The expert is deliberately not granted milestone.acknowledge — the party that did the
work is not the party that accepts it. Managers hold it so they can record a customer’s
acknowledgement on their behalf, attributed and marked as such, which keeps the measure moving for
customers who never sign in.
Capabilities — money on the engagement
| Capability | Gate | Admin | CSM | SDM | Expert | Vendor | Customer |
|---|---|---|---|---|---|---|---|
| View quotes | quote.view | ✔️ | ✔️ | ✔️ | ❌ | ❌ | ✔️ |
| Approve a quote for issue | quote.approve | ✔️ | ✔️ | ✔️ | ❌ | ❌ | ❌ |
| Respond to a quote (owner only) | quote.respond | ✔️ | ❌ | ❌ | ❌ | ❌ | ✔️ |
| View invoices | invoice.view | ✔️ | ✔️ | ✔️ | ✔️ (own) | ✔️ | ✔️ (own) |
| Submit an invoice | invoice.submit | ✔️ | ❌ | ❌ | ✔️ | ❌ | ❌ |
| Approve an invoice | invoice.approve | ✔️ | ✔️ | ✔️ | ❌ | ❌ | ❌ |
| Pay an invoice | invoice.pay | ✔️ | ❌ | ❌ | ❌ | ❌ | ✔️ |
| Resolve an invoice dispute | invoice.resolveDispute | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❌ |
Invoices are raised by the expert per milestone and approved by a manager — there is no automatic issue on milestone completion. The quote is the other direction: managers approve it for issue, the customer responds to it.
Surfaces
| Page | Gate | Admin | CSM | SDM | Expert | Vendor | Customer |
|---|---|---|---|---|---|---|---|
/projects | explicit — persona surface | ✔️ | ❌ | ✔️ | ✔️ | ❌ | ✔️ |
/projects/create | explicit — the customer’s request form | ❌ | ❌ | ❌ | ❌ | ❌ | ✔️ |
/finances | derived from invoice.view | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
/finances/approvals | redirects — derived from invoice.view | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
/activity | explicit — full-tenant log, staff only | ✔️ | ✔️ | ✔️ | ❌ | ❌ | ❌ |
/customer/workspace | explicit — persona surface | ❌ | ❌ | ❌ | ❌ | ❌ | ✔️ |
/customer/messages | explicit — persona surface | ❌ | ❌ | ❌ | ❌ | ❌ | ✔️ |
/customer/invoices | explicit — redirects to the payments figure | ❌ | ❌ | ❌ | ❌ | ❌ | ✔️ |
/customer/figures/* | explicit — persona surface | ❌ | ❌ | ❌ | ❌ | ❌ | ✔️ |
/customer/figures/* is one route-policy entry covering all six drill-down pages behind the
customer’s overview cards. Each resolves the project from the signed-in customer rather than from
anything in the address bar, so a register can only ever hold that customer’s own records, and no
other role, an administrator included, opens them.
/activity is the whole-tenant log with no per-persona scoping, so it stays staff-only even
though activity.view is held more widely — own-scoped personas read their own timeline inside
the Customer Service Journey instead. /projects is an explicit persona list rather than a derived one,
which is why CSM is absent from it: the CSM’s route into an engagement is the Customer Service Journey.