> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trubuild.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Roles and permissions
> Map procurement, owner, commercial, and technical teams to TruBuild's three access layers: organization, project, and package roles.
TruBuild uses three access layers:
1. **Organization roles** control account-level administration: members, settings, and project creation.
2. **Project roles** control access across a whole tender program.
3. **Package roles** control access to a single tender package.
This layering lets you keep commercial and technical evaluation strictly separated (a common probity requirement on owner-led tenders) while still giving procurement managers and owner-side reviewers the visibility they need.
## How access is resolved
When a user opens a package, TruBuild checks membership in this order:
1. **Package membership first.** If the user has a package role, that role decides what they see.
2. **Project membership as fallback.** If they have no package role, their project role applies.
3. **Organization owners and admins always have full access**, regardless of project or package membership.
If none of these apply, the user has no access. They cannot open the project or package, and following a direct link shows **We couldn't find that** with the message "This item doesn't exist, has been removed, or you may not have access to it."
Because package roles win over project roles, you can give someone broad viewer access at project level and tighten them to Commercial Team or Technical Team on a sensitive package. For example, a QS with Project Viewer plus Commercial Team on one package reads everything across the project, but on that package they work in the commercial area and lose sight of the technical area entirely, because the package role fully replaces the project role there.
## Organization roles
Organization roles are intentionally small and stable.
| Role | Typical user | Create projects | Manage members | Change organization settings |
| ---------- | --------------------------------------- | --------------- | -------------- | ---------------------------- |
| **Owner** | Account owner, procurement director | Yes | Yes | Yes |
| **Admin** | System admin, procurement administrator | Yes | Yes | Yes |
| **Member** | Evaluators, reviewers, everyday users | No | No | No |
Members only see the projects and packages where they hold a project or package role. If a Member tries to create a project, TruBuild shows "You do not have permission to create projects."
Feature access is also set at organization level. Modules that can be enabled per organization are Commercial Evaluation, Technical Evaluation, Tender Queries (the **Queries** area and the Knowledge Hub), Vendor Database, and AI Chat. If a module is not enabled for your organization, its area does not appear.
## Project roles
Use project roles for people who work across every package in a tender program.
| Role | Access level | Typical user | Best for |
| ------------------- | ------------ | ----------------------------------------------- | ----------------------------------------------------------------- |
| **Project Lead** | Full | Procurement manager, project procurement lead | Creating packages, coordinating teams, reviewing all package data |
| **Commercial Lead** | Commercial | Commercial manager, senior QS | Commercial evaluation across all packages in the project |
| **Technical Lead** | Technical | Technical director, engineering manager | Technical evaluation across all packages in the project |
| **Project Viewer** | Viewer | Owner representative, steering committee member | Read-only visibility across the project |
Only a Project Lead (or an organization owner or admin) can create packages and change project settings. Commercial and Technical Leads work within their evaluation area but cannot create packages; if they open the create page, TruBuild shows **Package creation unavailable** with the message "You need full access to this project to create a package here."
Project roles never grant project creation. Creating projects always requires the organization **Owner** or **Admin** role, even for a Project Lead.
## Package roles
Package roles are the safest default for large tenders because they scope access to one package.
| Role | Access level | Typical user | Best for |
| ------------------- | ------------ | ----------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| **Package Lead** | Full | Package manager, package buyer | Running one package end to end, from setup through award |
| **Commercial Team** | Commercial | QS, cost consultant, commercial evaluator | BOQ and priced submission uploads, commercial rounds, pricing review, commercial clarifications |
| **Technical Team** | Technical | Discipline evaluator, owner engineer | Technical proposal review, criteria scoring, technical clarifications |
| **Package Viewer** | Viewer | Owner reviewer, advisor, award committee member | Read-only review of both evaluation areas |
## Access levels
You assign roles; TruBuild derives an access level from the highest relevant role automatically.
| Access level | What it means |
| -------------- | ---------------------------------------------------------------------------------- |
| **Full** | Manage the project or package and work across both commercial and technical areas |
| **Commercial** | View and work in the commercial evaluation area only; the technical area is hidden |
| **Technical** | View and work in the technical evaluation area only; the commercial area is hidden |
| **Viewer** | Read-only view of both commercial and technical areas, with no evaluation changes |
| **No access** | Cannot see the project or package at all |
The separation is strict in both directions: Commercial access cannot open technical evaluation screens, and Technical access cannot open commercial ones. This matters during live evaluation, where pricing visibility can bias technical scoring and vice versa.
## Assign roles
### Invite people to the organization
Click **Settings** in the sidebar, then open the **Members** section.
Enter the person's email, choose an organization role (Owner, Admin, or Member), and click **Send Invite**. Most evaluators and reviewers should be Members.
Pending invitations show the email, inviter, and role. You can resend or cancel them. Once accepted, the person appears in the members list, where owners and admins can change their role or remove them.
### Grant project and package access
After someone accepts their invitation, give them a role on the projects or packages they support.
Navigate to the project or package from **All Projects** or the sidebar.
Click **Members** in the page header to view and manage who has access. The button appears only when you have sufficient access on that project or package. You can also review project and package members from **Settings**.
A cost consultant reviewing one package needs Commercial Team on that package, not Commercial Lead on the whole project. You can widen access later; walking back over-broad access after prices circulate is much harder.
## Recommended assignments
| Person or team | Organization role | Project role | Package role |
| --------------------------- | ----------------- | -------------------------------- | ------------------------------------------- |
| Procurement director | Owner or Admin | Not needed (full access already) | Not needed |
| Project procurement manager | Member | Project Lead | Optional Package Lead on high-risk packages |
| Package manager or buyer | Member | None | Package Lead |
| Commercial manager | Member | Commercial Lead if cross-package | Commercial Team |
| Commercial evaluator / QS | Member | None | Commercial Team |
| Technical director | Member | Technical Lead if cross-package | Technical Team |
| Discipline evaluator | Member | None | Technical Team |
| Owner reviewer | Member | Project Viewer | Package Viewer |
| External advisor | Member | Avoid | Package-scoped role only |
## Separation of duties
For owner-led or highly regulated procurement:
* Keep commercial evaluators on Commercial Team and technical evaluators on Technical Team, so neither side sees the other's data during evaluation.
* Give the procurement manager Package Lead or Project Lead; they need both views to run bid leveling and coordinate clarifications.
* Give owner representatives viewer access until a review meeting requires more.
* Scope external consultants to the specific package they support and remove them when their engagement ends.
* Avoid broad project roles for people who only need one package.
## Practical examples
| User | Role setup |
| ------------------------ | -------------------------------------------------------------------------- |
| Owner procurement lead | Project Lead |
| Owner technical reviewer | Technical Lead, or Technical Team on assigned packages |
| Cost consultant | Commercial Team on assigned packages |
| Legal advisor | Package Viewer for tender instructions, qualifications, and award evidence |
| Steering committee | Project Viewer or Package Viewer |
| User | Role setup |
| --------------------------- | --------------------------------- |
| Procurement manager | Project Lead |
| Package buyer | Package Lead |
| QS team | Commercial Team |
| Engineering discipline lead | Technical Team |
| Commercial director | Commercial Lead or Project Viewer |
| User | Role setup |
| ------------------------------- | ------------------------------------------------ |
| Claims or commercial consultant | Package Viewer or Commercial Team on one package |
| Technical consultant | Technical Team on one package |
| Cost consultant | Commercial Team on one package |
## Permissions by workflow
| Workflow | Full | Commercial | Technical | Viewer |
| ------------------------------------------------------------------------- | --------------- | --------------- | --------------- | --------- |
| Create packages and edit settings | Yes | No | No | No |
| Commercial evaluation (BOQ, pricing rounds, commercial clarifications) | Work and review | Work and review | No access | View only |
| Technical evaluation (criteria, scoring rounds, technical clarifications) | Work and review | No access | Work and review | View only |
The **Queries**, chat, and **Vendor Database** areas appear only when the module is enabled for your organization, on top of the role checks above. If a module your team expects is missing, your organization admin can confirm what is enabled; to change it, contact TruBuild support.
## Access review checklist
* Confirm every package has a Package Lead.
* Add commercial and technical users only to the packages they support.
* Grant owner reviewers viewer access where they need oversight.
* Confirm the organization has the modules the team expects (Commercial Evaluation, Technical Evaluation, Tender Queries, Vendor Database, AI Chat).
* Remove users who helped with bid preparation but should not score.
* Confirm the commercial and technical evaluator lists match the approved evaluation plan.
* Confirm external advisors hold package-scoped roles, not project roles.
* Confirm committee reviewers hold viewer access on the package so they can review the evaluation evidence.
* Confirm only authorized procurement leads hold Full access on the package.
* Remove temporary external users after their review is complete.
## Related
Invite members, manage roles, and review the activity log.
Design the rollout and team model.