User Roles in Construction: A Permissions Matrix That Works

A practical guide to defining user roles and building a permissions matrix for UK construction projects, ensuring the right people see the right data.

By James Shorter ·

User Roles in Construction: A Permissions Matrix That Works

Site manager and homeowner discuss project access

Give every person on a job a role, not a one-off set of permissions. Build roles from the tasks people do, give each role the minimum access it needs, and attach people to projects one at a time. That is what a permissions matrix is, and on a UK residential or small commercial job it fits on one page.

This guide covers the roles most jobs need, a matrix you can copy, how to handle subcontractors and clients, and how to keep access tidy as people come and go.

BRCKS
Keep project updates in one place
BRCKS brings site teams, subcontractors and clients into the same job record, with project chat, files and actions organised by job.

TL;DR

  • A role is a bundle of permissions tied to a job function: project manager, site manager, operative, subcontractor, client. Assign people to roles, not permissions to people.
  • Start every role from view-only and add only what the work needs. Do not start with full access and take things away.
  • Keep commercial information (pricing, margins, the variations log) behind a separate boundary from site information (drawings, snag lists, access details).
  • Grant access per project, give outsiders an end date, and remove them at close-out.
  • Review who has access on a fixed schedule and whenever someone changes role or leaves.

Table of Contents

What user roles and a permissions matrix mean on a job

A user role is a named set of things a person can see, edit, approve or export. A permissions matrix is the grid that shows it: roles down the side, areas of the job across the top, and in each cell what that role can do.

The point is simple. The site manager needs the drawing set, the snag list and the key-safe code. The subbie fitting out the bathrooms needs their own package. The client needs to see progress and approve variations. None of them needs the margin breakdown.

Construction roles matched to project information access

Without roles, access gets handed out one person at a time, usually in a hurry, usually by adding someone to a WhatsApp group. Six months later nobody can say who can see what. Roles fix that because you decide once, then apply it.

The roles most UK jobs need

Job titles vary from firm to firm. Roles should not. Look at what people actually do on site and group them. As an example of how formal this can get, one UK infrastructure programme’s site works tracker guide assigns defined roles to everyone attending site, from a planning manager for a shift to an on-call manager who is the authorised emergency contact. It also has a general role for someone who attends site without any of those duties. The same guide makes the project manager responsible for making sure roles go to people who are competent and certified for them.

You do not need that many on a house extension or a fit-out. Five to seven roles cover most residential and small commercial work:

  1. Owner or director. Sees everything across all jobs, including costs and margins. Manages users and billing.
  2. Project or contracts manager. Runs the job. Edits programme, approves variations, issues files, assigns people to the project.
  3. Site manager or foreman. Works the job daily. Logs diary entries, raises and closes snags, orders materials, books site visits. Sees drawings and RAMS. Does not see costs unless the firm wants it.
  4. Operative or trade lead. Sees their own tasks, checklists and the drawings they build from. Adds photos and messages.
  5. Subcontractor. Sees their own package only: scope, drawings, programme dates, their snags.
  6. Client. Sees progress, photos, the calendar, and items waiting for their approval.
  7. Office admin. Handles files, orders, compliance paperwork and user set-up, without edit rights over commercial decisions.

A named person can hold the role of administrator for the whole system. One UK government highways contract, for example, requires the contractor to nominate a superuser to manage user access to the client’s contract management system and liaise with the client’s users. The principle is worth copying at any size: one named person owns access.

A starter permissions matrix

This is a sensible starting point for a small builder, not a standard. Change the cells to suit how you work. V is view, A is add, E is edit, X is approve, and a dash is no access.

Area of the job Owner Project manager Site manager Operative Subcontractor Client
Site chat and photos V A E V A E V A E V A Own package Shared updates only
Snag list V A E X V A E X V A E V A Own snags V, sign off
Site diary V V E V A E V A - -
Programme and calendar V E V E V A V Own dates V
Drawings, RAMS, specs V E V E V V Own package Issued only
Quotes and pricing V E X V E - - - Own quote
Variations and RFIs V E X V A E X A (raise) - A (raise) V, approve
Gate, Wi-Fi and key-safe details V E V E V E V When needed -
Users and billing V E X - - - - -

Three things to notice. Raising is separated from approving: a site manager or subbie can raise a variation, but only the project manager or owner approves it. Commercial rows are empty for most site roles. And the client sees issued information, not drafts.

How to build your own matrix

Do it in an afternoon, on paper, before you touch any software settings.

  1. List the jobs, not the people. Write down every task touched on a typical project: logging diary entries, raising snags, ordering materials, issuing drawings, pricing variations, signing off completion.
  2. Group the tasks into roles. Aim for five to seven. If you need fifteen, you are describing individuals.
  3. Mark the sensitive items. Rates, margins, tender build-ups, client contact details, unissued drafts and site access codes.
  4. Give each role the minimum. Begin from view-only and add what the tasks demand. Starting from full access and subtracting always leaves something open.
  5. Assign people per project. Add someone to a job with a role, not to the whole company.
  6. Name one approver per project. One person signs off variations and issues drawings. Two people approving the same thing means nobody does.
  7. Lock issued versions. Once a drawing, quote or RAMS is issued, changes should create a new version rather than overwrite it.
  8. Put a review in the diary. Check who has access on a fixed schedule, and again at close-out.

The least-privilege idea behind steps 4 and 5 is the same one that sits under the information management standard used on UK projects. RICS explains that BS EN ISO 19650-1:2018 recommends information container-based collaborative working, so information is available to those who need it to meet their contractual obligations, avoiding unauthorised access and information loss.

Subcontractors and clients: the outsiders

Most permission mistakes involve people outside your payroll. They come and go, they work for other firms, and their involvement ends when their package ends.

The working rules are straightforward:

  • Per project, not per person. A subbie on your Reading job has no reason to see your Windsor job.
  • Scope to the package. A subcontractor can open the drawing set for their package. They should not see tender pricing, the margin breakdown, the variations log or your correspondence with the client. LOOKUP’s guidance on external collaboration puts it this way, and recommends keeping commercial information behind a boundary that subcontractors and consultants never cross.
  • An end date on every outside user. Access should expire unless someone renews it.
  • A list someone owns. One person can say who is on the job and why.
  • Removal at close-out. Treat it as a step in handover, next to snagging and the O&M pack.

Leavers matter just as much. One UK IT consultancy notes that in an industry with high workforce mobility, removing leavers’ access promptly is one of the essentials, alongside giving people only what their role needs.

If you want a closer look at the document side, see our guide to subcontractor document sharing and our piece on document control in construction.

Why the person who controls access matters

Who holds the keys is not a small decision. In the Trant v Mott MacDonald dispute over a shared project data environment, the court granted a mandatory injunction requiring access to the public folders to be restored, and ordered a payment into court of £475,000 plus VAT while the underlying dispute was resolved. The commentary drew a lesson for employers: take care over who takes on the co-ordinator role, because if the same party maintains the data environment, they may be able to restrict access.

You are unlikely to run a BIM project on a kitchen extension. The lesson still scales down. Your records, files and job history should belong to your firm, and access should be agreed up front. RICS makes the same point about agreement: the key to collaborative working is agreeing the arrangements for the shared environment at the start. On a small job, that means one owner account held by the firm, not by an individual, a freelancer or a subcontractor.

Keeping access right as people change role

A matrix goes stale the day someone is promoted, swapped to another site, or finishes their package. The fix is to treat access as a thing you maintain.

  • Change the role, not the permissions. If a foreman becomes a site manager, move them to the new role. Do not edit settings by hand and end up with a one-off exception.
  • Review on a schedule. Every six months is a sensible rhythm for a small firm. Look at every user and ask whether they still need what they have.
  • Review at events. Someone leaves, a subbie finishes, a job completes, a client signs off. Each is a trigger.
  • Log exceptions. If you give someone more than their role allows, write down who approved it and for how long.

For new starters, build role assignment into the first day. Our team onboarding checklist includes the access steps.

Common mistakes

One shared login. It makes an audit trail meaningless. When a variation changes, you cannot say who changed it.

Everyone in the group chat. A WhatsApp group gives every member the full history, including the messages about price. Separate the chatter from the record.

Giving the client the whole job. Clients want to see progress and decide on variations. Daily snags, subbie rows and cost notes only confuse them.

Letting the site manager see margins by default. Not out of distrust, but because they do not need it to do the work.

Forgetting site access details. Gate codes, key-safe numbers and Wi-Fi passwords are access control too. Hold them per job and show them only to those attending.

Common mistakes

No end date for subbies. The commonest gap, and the easiest to close.

Our view: roles should be invisible

Most small firms do not skip permissions because they do not care. They skip them because the usual tools make it a project in itself. Add a role system that needs a day of setup and a trained admin, and the team goes back to the group chat.

We built BRCKS the other way round. It works like a simple chat that site teams already understand, and the project updates itself underneath. One tap turns a message into a snag, a materials order, a site visit or a checklist item, and it lands in one list per job. Team permissions sit behind that, so the core team can be set up per job without learning a new system.

The people who cause the most access headaches are subcontractors and clients, so we keep them out of your seat count. They stay in WhatsApp, install nothing and pay nothing. Their updates come into the same job record as everyone else’s, so you do not have to hand them logins to your whole system to get information back from them.

Variations and RFIs keep an audit trail, and project files are versioned, so you can see what was issued and when. That is what roles are really for: knowing who did what, on which job, and being able to show it.

James

Setting this up in BRCKS

BRCKS is built for UK builders, electricians, plumbers and other site trades. The core team works in the iPhone and Android app, the office uses the web view, and subcontractors and clients join through WhatsApp for free. Same job, same record, whichever way the update arrives.

Pricing is published on the pricing page: Teams is £40 per seat per month billed annually, or £50 monthly, and Solo is £20 per month. Subcontractors and clients are free. There is a 14-day free trial.

BRCKS

If you want to see how roles, variations and files fit together on one job, book a BRCKS demo. If you mainly run residential work, our page on construction software for builders shows how a job is set up. For the commercial side of your matrix, see variation management software.

Where roles meet compliance

A permissions matrix also supports your paperwork. Under CDM, the right people need the right documents at the right time: the construction phase plan, RAMS and the health and safety file. Our guide to CDM paperwork covers the three core documents. The matrix tells you who can edit them, who must see them, and who only needs the issued version.

For day-to-day communication, who hears what is part of the same decision. Our site communication workflow guide sets out how a project manager can keep updates flowing without exposing everything to everyone.

FAQ

How many user roles does a small builder need?

Five to seven is enough for most residential and small commercial work. Owner, project manager, site manager, operative, subcontractor, client and an office admin cover nearly every case. If you find yourself creating a role for one person, change that person’s project assignment instead.

What is the difference between a role and a permission?

A permission is a single action, such as viewing drawings or approving a variation. A role is a bundle of permissions matched to a job function. You assign people to roles, so when responsibilities change you move the person, not each permission.

Should subcontractors see the variations log?

Generally no. They should be able to raise a variation or RFI for their own package, and see the outcome on it. The full log shows pricing and correspondence with the client, which sits on the commercial side of the boundary.

How often should I review who has access?

A six-monthly review is a sensible habit for a small firm, plus a check whenever someone leaves, changes role or finishes their package. At job close-out, remove every outside user as a deliberate step.

Can clients have access without paying for a seat?

In BRCKS, yes. Clients and subcontractors are invited free and can use WhatsApp, so only your core team takes up paid seats.

Sources

Recommended


How BRCKS Can Help

Establishing a clear permissions matrix is essential for maintaining site security and operational efficiency, but manual oversight can often lead to costly oversights. BRCKS simplifies this process by providing customisable user roles that align perfectly with your team's unique workflow, ensuring the right people always have access to the right data. By automating these controls, our platform removes the guesswork from project management and lets your staff focus on delivery rather than administrative hurdles. We invite you to explore how BRCKS can streamline your project governance and safeguard your digital workspace today. Learn more at BRCKS and explore our full feature set.


Sources