Member and access controls

What each built-in role can do, where custom roles live, and what the All Photos vs Own only scopes mean.

When you’d do this

You want to understand or audit the team’s permission model before changing it. This is the conceptual reference for Settings → Members & Access. To actually edit a role or change a member’s role, follow the linked how-tos.

What you need

Role: Team Owner, Team Admin (to change); any member (to view)
Surface: App and Web
Plan: Free · Business

The three permission categories

Every role in Teamspace is built from toggles in three categories:

Category	Permissions	Scope values
PHOTOS	Delete photos / Move photos / View photos / Download Photos	All Photos / Own only / Deny
PROJECTS	Create Project / Edit Project / Delete Project / Manage project access	On / Off
TEAM	Invite people to team / Remove people from team	On / Off

Built-in roles

Role	Description (in the UI)	Editable?
Team Owner	Complete control over Teamspace	No. Permissions are locked, and there is exactly one Owner per team.
Admin	Manage projects and settings	Yes. Can be customized per team.
Member	Take and view photos	Yes. Can be customized per team. By default, Members have “Own only” for Delete and Move, and “All Photos” for View and Download.

Roles are not a fixed list. You can add custom roles in Members & Access → Custom Roles → + Add Role with any combination of toggles.

The All Photos vs Own only scope

For each PHOTOS permission, you choose what set of photos it applies to:

All Photos is every photo in the team, no matter who captured it.
Own only is just the photos this member personally captured.

The intent of “Own only” for Delete and Move on the default Member role is to prevent crew members from accidentally changing each other’s captures, while still letting them View and Download the full team library for context.

How to change something

Want to	Read this
Change which role someone has	Manage permissions
Change what a role can do	Customize a member role
Add a brand-new role	Customize a member role, “Create a custom role” section
Restrict a single project	Manage project access
Remove someone from the team	Remove a team member

What’s not in this product yet

Some features that “access control” can imply on other tools are not in Timemark Teamspace today:

IP allow-lists: no IP-based restriction.
Device pinning: no per-device approval.
SAML / SSO: listed as an Enterprise feature, coming soon.
Mandatory 2FA: not a team-level toggle. Members manage 2FA on their own login.

If you need any of these, contact support to discuss the Enterprise track.