Who can see what

The four access classes, the levels each one offers, and the sentence each level grants.

Access in PadFlow is not a list of roles with a fixed set of powers. It is four classes of sensitive thing, and a level per class per person. A superintendent can hold edit on the schedule and none on money. A lender can hold view on money and nothing else.

Two consequences are worth knowing before you read the table.

Money has a level the other three do not. view_redacted shows the rows without the amounts: a budget line still lists its cost code, its stage and whether it is committed, and the figures read as dashes. It exists so somebody can track progress without being shown price.

A level is enforced by the database, not by the menu. Hiding a tab is a courtesy. Typing the address of a page you do not hold the level for gets you the same refusal.

What edit does with money, and what approve does

The line between the two levels on money is the line between recording a figure and saying yes to one.

edit works the ledger. It opens a draw and enters what each cost code is asking for, submits it and brings it back for correction, raises a pay application and enters progress against the schedule of values, proposes a move between two cost codes, and records that a bill was paid.

approve is the yes. Funding a draw, and taking a funded draw back out by voiding it. Certifying a pay application, and moving one to approved or to paid. Approving a budget move, and deleting an approved one, which puts the money back. Each of those commits the business to a figure, so each of them also asks the approval limit below.

An approval limit is a ceiling on the figure

An approver can be given a limit on the People page. Above it, the same person who may approve is told to hand the item to somebody with a higher limit. The limit is checked against the figure on the item itself: for a draw, the sum of what its lines are asking for; for a pay application, the amount certified; for a budget move, the amount being moved.

A limit can be set for the whole workspace, and a tighter one can be set on a single project. Where both apply, the project one wins. A generous workspace limit does not rescue an amount the project limit refuses.