Permissions

Wayd answers "may this user do this?" with two independent checks. Most of the application uses only the first; Project Portfolio Management and the sprint lifecycle use both.

1. Permission claims — granted through roles. These decide whether a user can reach a feature at all.
2. Membership of the record — whether the user belongs to the record being changed. In PPM that is delivery leadership: a permission claim alone is not enough to change a project, program, or portfolio. For a sprint it is team membership.

Both must pass. Holding Permissions.Projects.Update lets you reach the project edit endpoints; being a project Owner decides which projects you may change.

Permission claims

Permissions are named Permissions.{Resource}.{Action} and follow a consistent pattern:

Action	Meaning
View	Read entities
Create	Create new entities
Update	Modify existing entities
Delete	Remove entities
Import	Bulk-load entities from a file
Run	Trigger an operation — for example running or requeuing a background job
Manage	Create, update and delete in one permission — used for planning interval objectives
Search / Export	Search or export users
Administer	Domain-wide administrative standing (see PPM Administrator)

Some resources add specific actions — Permissions.Projects.ManageProjectWorkItems and Permissions.Teams.ManageTeamMemberships.

The server checks a user's permissions against their current roles on every request, so a role or permission change applies to what they can do straight away. The menus and buttons the app shows are decided by the permissions carried in the user's sign-in token, so they catch up on the user's next token refresh.

Permission catalogue

Every permission Wayd defines, as Settings → Access → Roles groups them. The seeded Admin role holds all of them.

Category	Resource	Permissions
Application	ScoringModels	View, Create, Update, Delete
Application	StatusWorkflows	View, Create, Update, Delete
Application	FeatureFlags	View, Create, Update, Delete
Application	SystemSettings	View, Update
Background Jobs	Hangfire	View — the Hangfire Dashboard
Background Jobs	BackgroundJobs	View, Create, Run, Delete
Messaging	Messaging	View, Run (replay dead letters), Delete (discard dead letters)
Imports	Imports	View — every import, read-only (see Imports)
Identity	Users	View, Search, Create, Update, Delete, Export
Identity	UserRoles	View, Update
Identity	Roles	View, Create, Update, Delete
Identity	RoleClaims	View, Update
Identity	Permissions	View
Identity	OidcProviders	View, Create, Update, Delete
Integrations	Connections	View, Create, Update, Delete
Integrations	Connectors	View
Health	HealthChecks	View, Create, Update
Links	Links	View, Create, Update, Delete
Organization	Employees	View, Create, Update, Delete, Import
Organization	EmployeeTimeAway	Administer (see Time away)
Organization	Teams	View, Create, Update, Administer, ManageTeamMemberships, Delete, Import
Organization	TeamMemberRoles	View, Create, Update, Delete
Organization	HolidayCalendars	View, Create, Update, Delete
Planning	PlanningIntervals	View, Create, Update, Delete, Import
Planning	PlanningIntervalObjectives	View, Manage, Import
Planning	Risks	View, Create, Update, Delete, Import
Planning	Roadmaps	View, Create, Update, Delete
Planning	PokerSessions	View, Create, Update, Delete
Planning	StoryMaps	View, Create, Update, Delete
Planning	EstimationScales	View, Create, Update, Delete
Project Portfolio Management	ProjectPortfolioManagement	Administer (see PPM Administrator)
Project Portfolio Management	ExpenditureCategories	View, Create, Update, Delete
Project Portfolio Management	PpmStrategicThemes	View
Project Portfolio Management	ProjectPortfolios	View, Create, Update, Delete, Import
Project Portfolio Management	Programs	View, Create, Update, Delete, Import
Project Portfolio Management	Projects	View, Create, Update, Delete, Import, ManageProjectWorkItems
Project Portfolio Management	StrategicInitiatives	View, Create, Update, Delete, Import
Project Portfolio Management	ProjectLifecycles	View, Create, Update, Delete
Strategic Management	StrategicThemes	View, Create, Update, Delete, Import
Strategic Management	Strategies	View, Create, Update, Delete
Strategic Management	Visions	View, Create, Update, Delete
Work Management	WorkTypeTiers	View
Work Management	WorkTypeLevels	View, Create, Update, Delete
Work Management	Workspaces	View, Create, Update, Delete
Work Management	Iterations	View, Update, Administer (see Sprint lifecycle)
Work Management	WorkItems	View, Create, Update, Delete
Work Management	WorkProcesses	View, Create, Update, Delete
Work Management	WorkStatusCategories	View
Work Management	WorkStatuses	View, Create, Update, Delete
Work Management	WorkTypes	View, Create, Update, Delete
Product Management	Products	View, Create, Update, Delete, Import
Product Management	ProductTypes	View, Create, Update, Delete
Product Management	ProductTagCategories	View, Create, Update, Delete
Delivery	Delivery	View, Create, Update, Delete, Import — versions, release packages and deployments
Delivery	Releases	View, Create, Update, Delete, Import
Delivery	DeploymentEnvironments	View, Create, Update, Delete, Import
Delivery	DeliveryMetrics	View

Each permission is the resource and action joined — the Update action on Projects is Permissions.Projects.Update. Changing a product needs only its permission; there is no membership rule in Product Management.

Delivery leadership in PPM

Viewing PPM records needs only the View permission. Changing one additionally requires that you lead it.

You lead a record if you hold the Owner or Manager role on it, or on anything above it:

Record	You may manage it if you are Owner or Manager of…
Project	the project, or its program, or its portfolio
Program	the program, or its portfolio
Portfolio	the portfolio

Leadership inherits downward: a portfolio Owner leads every program and project inside it, without needing a role on each one.

Sponsors are deliberately excluded

Sponsors fund and oversee work; they don't run delivery. A Sponsor — at any level — cannot change status, edit details, or assign roles. Neither can a project Member, who contributes to the work without leading it.

What the rule covers

Every operation that changes a project, program, or portfolio:

• Status transitions — Approve, Activate, Pause, Resume, Complete, Cancel, Close, Archive
• Editing details — name, description, business case, expected benefits, expenditure category
• Editing the timeline — start and end dates
• Assigning roles — adding, removing, or replacing role assignments
• Project structure — changing a project's key, program, or lifecycle
• Strategic themes — changing the themes a project or program supports
• Delivery signals — recording health checks and scores
• Scoring — assigning or clearing a portfolio's scoring model
• Ranking — reordering a portfolio's projects

Role assignment is included for a reason: it is the path by which leadership itself is granted. If it were not gated, anyone holding the Update permission could make themselves an Owner and then do everything else.

What it does not cover

• Viewing anything — the View permission alone is sufficient.
• Creating portfolios, programs, and projects — governed by the Create permission. A newly created record has no leadership yet.
• Deleting — governed by the Delete permission.
• Bulk imports — governed by the relevant Import permission. Import is an administrative bulk operation, and the records it creates have no leadership at the moment it runs.

PPM Administrator

Permissions.ProjectPortfolioManagement.Administer grants domain-wide delivery-leadership standing across PPM. A holder is treated as leading every project, program, and portfolio.

It substitutes for membership only. It does not substitute for the permission claim — a PPM administrator still needs Permissions.Projects.Update to change a project. The two checks stay independent.

Grant it to people who administer delivery without sitting in the hierarchy: PMO staff, platform administrators, and anyone who needs to set up or repair portfolios they don't personally lead.

It is required to seed a new portfolio

A portfolio has nothing above it to inherit leadership from, so a brand-new portfolio has no one who can assign its first Owner. A PPM administrator is the only one who can — after which normal leadership takes over.

The seeded Admin role includes this permission.

Sprint lifecycle: team membership

Starting, completing and reopening a sprint, correcting its actual dates, and changing its team days off or sprint type, needs Permissions.Iterations.Update and membership of the sprint's team, in any role. Members of the team of teams the team belongs to on the day also qualify — only its direct team of teams, not the ones above it.

Permissions.Iterations.Administer waives the membership for every team's sprints, the way the PPM Administrator permission waives leadership. Like it, it never substitutes for the Update permission. The seeded Admin role includes both.

Viewing sprints needs only Permissions.Iterations.View.

Allocations: team membership

Changing how much of a person's time a team has needs Permissions.Teams.Update and membership of that team, in any role. Members of the team of teams the team belongs to on the day also qualify — only its direct team of teams, not the ones above it. A change that touches several teams, such as moving a person's time from one team to another, needs this for each of them.

Permissions.Teams.Administer waives the membership for every team's allocations. It never substitutes for the Update permission. The seeded Admin role includes both.

Viewing a person's allocations needs only Permissions.Employees.View.

Time away: the person and their managers

Recording, changing and removing a person's time away needs no permission. It is allowed for:

• The person, for their own time away
• Anyone the person reports up to: their manager, their manager's manager, and so on to the top
• Anyone holding Permissions.EmployeeTimeAway.Administer

The first two come from who you are, so your user account must be linked to an employee. The Administer permission covers everyone else: people with no manager in Wayd, and time away recorded on someone's behalf. The seeded Admin role includes it.

The same people are the only ones shown the reason for a stretch of time away. Everyone who can view the employee (Permissions.Employees.View) sees the days and how much of each, and so does everyone who can see a team's capacity.

Setting the holiday calendar a person takes, or their working day, is not time away: each needs Permissions.Employees.Update. The person and their managers cannot set either without it.

Why an action might be unavailable

When a PPM or sprint action is missing from a menu or rejected on submit, it is one of:

Cause	What to do
Missing the permission claim	Ask an administrator to grant it via Settings → Access → Roles
Not leading the record	Ask an Owner or Manager of the record — or of its program or portfolio — to assign you a role, or to perform the action
Not on the sprint's team	Ask to be added to the team or its team of teams, or ask a member to perform the action
Not the person or one of their managers	A person's time away is recorded by them or by someone they report up to. Ask one of them, or a time away administrator
No linked employee record	PPM and sprint changes are attributed to an employee. Ask an administrator to link your user account to one.
A domain rule blocks it	The action may be invalid for the record's current state — for example, a portfolio cannot close while it still contains open projects

Upgrading to this version

PPM changes are membership-gated after upgrading. Before this version, any user holding a PPM Update permission could change any project, program, or portfolio — including assigning roles on it.

After upgrading, users who hold the permission but lead nothing will find PPM edit and status actions unavailable. This is deliberate.

To restore access for someone who needs it, either:

• Assign them an Owner or Manager role on the relevant records — or on a portfolio or program above them, which covers everything beneath; or
• Grant them Permissions.ProjectPortfolioManagement.Administer if they legitimately administer delivery across the domain.

Members of the seeded Admin role are unaffected — it includes the administrator permission.