Buff Development
Members and permissions

What a member sees

How the interface changes with permissions: what is hidden, what is shown read-only, and which hints appear.

The rule is simple: within the scope you can read everything; actions follow permissions. The interface does not show buttons the member cannot use, and where it matters to understand why a task is waiting, it adds a note saying who can act.

Outside the scope

Projects and repositories outside the member’s scopes are absent from the project switcher and from lists. A direct link to such a project opens “Project not found”. An organisation the member was removed from shows as “Organisation not found”.

Project home and the task list

  • “New task” and “Add task” — only with the Create tasks permission.
  • “Prepare development tools” — only with the Run audits and tools preparation permission.
  • The task row menu (“Stop run”, “Resume”, “Close”) — only with the Stop, resume and close permission for that task (own or someone else’s).
  • The “Add repository…”, “New development project…” and “Create space…” buttons in the project switcher — only with the Add repositories and sync the project permission in a grant on the whole organisation.

In a space

  • A space’s sidebar has only four sections — “Ask”, “Deep research”, “Connectors”, “Knowledge base”; nobody has the development sections there, whatever their permissions.
  • “New question” and “New research” — with the Ask questions and Create research permissions, as in a project; colleagues’ conversations and research in a space are visible to all members with a grant on it.
  • “Knowledge base” — the space’s and the organisation’s entries are readable by all members of the space; creating and changing them requires the Create, change, archive and restore knowledge permission (Maintainer by default).
  • “Connectors” — the section shows the space’s connections, their status, tools and the last error; connections are configured on the connector itself, and pairing and revoking are up to the owner.
  • Another department’s space without a grant on it is absent from the switcher; a direct link opens “Project not found”.

The task card

  • Draft. The author edits it freely. Someone else’s draft without the Edit and cancel drafts — other people’s tasks permission opens read-only: the fields are locked, and instead of the buttons there is a note: “The draft is edited by its author or a member allowed to change others’ drafts.”
  • Clarifications. Without the permission to answer, the member sees the analyst’s questions and the note “The task’s author or a member with the permission to answer others’ clarifications can answer.”
  • Formulation. Without the permission to decide — the text of the formulation and the note “The decision is made by the task’s author or a member with the permission to approve others’ formulations.”
  • Broken tests. Without the permission — the note “The decision belongs to the task’s author or a member allowed to decide on others’ tests.”
  • Stop / resume / close — the buttons appear only with the permission for this task.
  • Exporting the task document (PDF, MD), the execution scheme and the history are available to everyone in the scope.

Review

A Contributor looks at the review of someone else’s task: the diffs, build, tests and findings are visible, and instead of “Approve” / “Changes requested” there is a note saying who makes the decision.
  • Diffs, the build and test summary, findings — visible to everyone in the scope.
  • “Add your own finding” — with the Add findings permission.
  • “To fix”, “Dismiss finding”, “Edit” on a finding card — with the Resolve and dismiss findings permission for this task.
  • “Approve” and “Changes requested” — each by its own permission. Without both, instead of the buttons there is the note “The review decision is made by the task’s author or a member with the permission to approve others’ tasks and send them for rework.”
  • “Discuss with the assistant” — available to everyone in the scope; the review discussion is shared.

Ask and deep research

  • The lists of conversations and research show all colleagues’ threads in the scope; the “All / Mine” switch narrows it to your own.
  • “New question” / “New research” — with the Ask questions / Create research permission. Without it, the creation page explains who it is available to.
  • The row’s “⋮” menu (rename, delete) and the field for continuing a conversation — always for the thread’s author; for others — with the Change and delete other people’s conversations / research permission. Without it there is a note instead of the field.

Audits and repositories

  • Audit reports are readable by everyone in the scope.
  • “Run the project audit”, “Re-run the audit”, “Update outdated” — with the Run audits and tools preparation permission.
  • In “Repositories”, statuses and “Check” are visible to everyone; “Sync” and “Sync all” — with the Add repositories and sync the project permission.

Settings

  • “Members” — the list and the permissions are visible to all members of the organisation; the invitation form and the management buttons only to the owner.
  • “Billing”, changing the plan, choosing models, renting capacity, connectors — managed only by the owner.

If the button was there but the permission is gone

The app re-reads permissions once a minute and on organisation events. If the owner narrowed the permissions while the page was open, the button may still show — but the server checks permissions on every action and replies: “Not enough rights: this action is not part of your role in the organisation”. Reload the page to refresh the interface.

On this page