Roles and what each one can do

Access is recorded per person per project and checked on the server for every read and every write. The browser never decides what you may do; it only shows you what your recorded role already allows.

• Viewer and advisory: read everyday work, comment, and join eligible votes. No editing and no finance access.
• Editor and first hire: edit everyday work and join eligible votes. No finance and no salary access.
• Admin and founder: manage people, settings, content and finances, including salaries.
• Owner: everything an admin can do, plus ownership transfer.

Reading is not a spectator role in Growth-OS. A viewer can upvote a roadmap request, comment on a decision, and cast, change or withdraw their own vote on a poll until it closes. Those are deliberately open to read access, because the case for a request should be built by the people who want it.

What a viewer cannot do is change the record itself: the title, the alternatives, the poll options, the rationale, the status. A control that is unavailable says why rather than failing when you press it.

The Finance group is read and updated by project administrators. An editor who runs campaigns every day does not see budgets, expenses, payments or salaries, and that separation is enforced by the same server checks as everything else.

A role Growth-OS does not recognise gets nothing. The same rule runs through the product: an account whose campaign suppression nobody recorded stays out of every audience, a stage neither vocabulary recognises is counted as unknown, and a source with no selected site or property refuses the read instead of falling back to a default.

When a control you expect is missing, check your role for this project first. An archived project refuses every save whatever your role.