# Permission matrix

| Capability | Owner | Manager | Designer | Client |
|---|---:|---:|---:|---:|
| All clients/projects/files | Yes | Assigned/managed | Assigned only | Own client only |
| Create/manage clients and invitations | Yes | Yes | No | No |
| Create/assign/manage projects | Yes | Yes | Limited assigned updates | Submit own requests |
| Upload versions/source files | Yes | Yes | Assigned only | Assets/references only |
| Internal review/notes/annotations | Yes | Yes | Own submissions/notes | No |
| Client-visible feedback/approval | Yes | Yes | Reply where assigned | Own client only |
| Delivery | Yes | Yes | Assigned upload | Download permitted files |
| Financial information | Yes | Permitted by policy | No | Own invoices only |
| Team/settings/roles | Yes | Limited | No | Account settings only |

Policies must enforce workspace, client ownership, role, assignment, visibility, and disabled-user status. A client can never choose a `client_id` from the request body; it comes from the authenticated contact.