This page explains what each Task permission unlocks and which role to assign to grant it. Permissions are never handed to a person one at a time — you assign a role that bundles them. Two things need no permission at all: working the tasks assigned to you, and creating a task for yourself.
Which role to assign
The roles layer on create-for-others → team management → org-wide orchestration. Each tier includes everything below it — and the base tier (everyone) already covers seeing your own work and raising your own tasks.
- (No role) — everyone. See and work the tasks assigned to you, view your own KPI, and create tasks for yourself. Self-service; no permission needed.
- Task - User — grants Create tasks (
TaskCreate). Lets you create tasks for other people (your department + the teams you manage) and delegate. Creating a task for yourself never needs this. No org-wide visibility and no assign-to-anyone. - Task - Manager — grants Manage tasks (
TaskManage). Team-scoped management: create, assign within your org chart, rate/override grades, request changes, view your team's tasks & KPI, and open the Orchestrator console for your teams. - Task - Orchestrator — the top coordination role:
TaskManage+ Assign to anyone (TaskAssignAny) + View all tasks (TaskViewAll) + Orchestrate (TaskOrchestrate) + the Review-Compliance report (TaskReport). Assign to anyone in the organisation, see every task, and run the coordination sweep org-wide.
Administrators (the System Admin role) have all of the above implicitly.
What each permission grants
- (none) — self-service. Every employee can see, start, finish and record output on the tasks assigned to them, claim a team task they belong to, view their own KPI, and create a task for themselves. No grant needed.
- Create tasks (
TaskCreate) — create tasks for other people and delegate. Without it you can still work your own tasks and raise tasks for yourself, but you can't assign work to others. - Assign to anyone (
TaskAssignAny) — assign/delegate to anyone in the organisation. Without it, you can only assign to your own department and the teams you manage (the org chart). - Manage tasks (
TaskManage) — assign, rate, override grades, request changes, and view your team's tasks and KPI. Implies Create and Assign-to-anyone within your scope. - View all tasks (
TaskViewAll) — read-only visibility of every task across the organisation, without being an administrator. (Manage on its own is only team-scoped, so org-wide visibility needs this.) - Orchestrate (
TaskOrchestrate) — open the Orchestrator console and run the coordination sweep (Manage/admin also get it). - Review-Compliance report (
TaskReport) — read-only report of how much of each manager's review workload was actively rated versus left to auto-approve. - Configure KPI targets (
KpiTargetManage) — set the expected durations that turn on automatic work-time grading.
Administrators have all of the above implicitly.
Note on personal tasks & KPI. A task you create and assign to yourself is a personal to-do. Because you can't grade your own work (self-review is blocked), such a task simply auto-closes after its review window — and it is deliberately left out of the KPI ledger, so personal chores never inflate or dilute your KPI. KPI samples come from work a manager rates or from targeted, measured steps.
Who can sub-task or delegate a specific task
Beyond holding Create tasks, restructuring a particular task follows current responsibility, not who filed it: only the task's assignee or manager (or a manager/admin) can add sub-tasks to it or delegate it — a bystander who merely created it can't. The full matrix is in Sub-tasks & delegation: how work rolls up the tree.
Visibility (what people see in lists)
Task lists are scoped consistently: mine (assigned to me), managed (I'm the named manager), team (everyone in the departments I manage, recursively), and all (org-wide — only with View all tasks or admin). The same scoping applies to the web app and the REST API, so they never diverge.
Related: Creating & assigning tasks · KPI & grading.