Roles & Permissions

Audience: This article is for church administrators.

Roles in TimelyChurch control what each team member can see and do within your church's admin panel. Every team member is assigned exactly one role, and that role determines which modules they can access, which actions they can perform, and whose records they can view.

Accessing Roles & Permissions

1. In the left sidebar, open Administration and click Team Members.
2. Click the Manage Roles button on the Team page.

(You can also go straight there with Administration → Roles & Permissions.)

The Roles page opens at Dashboard / Settings / Team / Roles (you can see this trail in the breadcrumb at the top of the page).

Understanding the Role System

Each role in TimelyChurch is defined by three components:

1. Modules

Modules are the features a role can access. Each module has its own set of actions that can be individually granted. The table below lists the available modules and their actions:

Source of truth: If you see a discrepancy between this table and the Roles page, the in-app Roles page is correct. Some modules only appear if your subscription plan includes that feature.

2. Scope

The scope determines whose records a team member can see:

Heads up -- Events and Calendar: Events and Calendar have no "own records" concept, so anyone whose role uses Own Records Only sees an empty list in those areas. The role editor shows this warning when you pick that scope. Choose Team Members or All Records for a role that needs to work with events.

Note: These are the scope names used inside the role editor. Other screens use shorter names for the same three choices:

Role editor	Role card on the Roles page ("Reach")	Invite dropdown
Own Records Only	Own records only	Themselves
Team Members	Their teams	Their team
All Records	Whole church	Org-wide

What "Their teams" covers is explained in Team reach: "Their teams" and "Whole church" below.

3. Color

Each role has a color label for quick visual identification in the team list. Available colors include Gray, Red, Orange, Amber, Green, Emerald, Blue, Indigo, Purple, and Pink.

Built-In System Roles

TimelyChurch comes with a set of system roles that cover the most common use cases. These roles are automatically created for every church and serve as templates. A role that came from a system template shows a small Default badge on its card, and can be reset back to its original settings.

Administrator (Purple)

• Scope: All Records
• Permissions: Full access to every module and every action. The one exception is Finance: when your church's Donation Privacy setting ("Restrict donation access to finance roles") is on, the Administrator role does not see Giving, Funds, Pledges, Budgets, Accounting or Giving Statements. See Who Can See Giving and Donations.
• Best for: Senior pastors, executive staff, office administrators

Finance Admin (Green)

• Scope: All Records
• Permissions: Full access to the finance modules -- Giving & Donations, Funds, Pledges, Budgets, Accounting, and Giving Statements -- plus Reports (view/export) and People (view/create/edit) so they can add and correct donor records. No events administration. In Giving this role is at the Administrator level.
• Best for: Treasurers, finance team members who handle money but not general church admin

Team Leader (Emerald)

• Scope: Team Members (shown as Their teams on the role card -- see Team reach)
• Permissions: People (view/edit), Follow-Ups (view/create/edit/assign), Groups (view/create/edit/delete/lead), Families (view/create/edit/delete), Schedules (view/create/edit), Drive (view), Classes (view), Attendance (view/record), Events (view/create/edit), Calendar (view), Tasks (view/create/edit/assign), Serving Teams (view/edit/lead), Volunteers (view/edit), Check-In (view/use), Messaging (view/send), Announcements (view), Forms (view/create/edit/delete), Reports (view)
• Best for: Ministry directors, department heads, team captains

When someone with a basic role (such as Member or Team Member) is made the Leader or Co-Leader of a group, team or class, TimelyChurch moves them up to Team Leader automatically so they can manage it. If they later stop leading every group, their role goes back to what it was before -- unless an administrator changed their role in the meantime. (This applies to people moved up from late September 2026 onward; earlier automatic upgrades stay as they are.)

Team Member (Blue)

• Scope: Own Records Only
• Permissions: Schedules (view), Drive (view), Attendance (view), Events (view), Calendar (view), Tasks (view/create/edit), Serving Teams (view), Volunteers (view), Check-In (view/use), Messaging (view), Announcements (view)
• Best for: Teachers, regular volunteers, worship team members

Member (Gray)

• Scope: Own Records Only
• Permissions: Events (view), Calendar (view), Announcements (view). Members do not get Check-In: running a check-in station is a job for staff and volunteers (Team Member, Team Leader or Safety Officer).
• Best for: General congregation members who need basic portal access

Accountant (Read-Only) (Blue)

• Scope: All Records
• Permissions: Read-only access to all finance modules (Accounting, Giving & Donations, Funds, Pledges, Budgets, Giving Statements) plus Reports (view/export). No access to people, events, or communications. In Giving this role is at the Reviewer level: it sees totals and reports, but not who gave.
• Best for: An external CPA or bookkeeper you bring in at tax time

Safety Officer (Red)

• Scope: All Records
• Permissions: Check-In (view/use/manage) and Attendance (view) -- activate or clear an emergency lockdown and receive check-in safety alerts, without being a full administrator.
• Best for: Children's ministry safety leads and security team members

Note: The two finance roles -- Finance Admin and Accountant (Read-Only) -- are only created when your plan includes the Finance modules.

Tip: System roles serve as starting points. You can customize most system roles' permissions to match your church's needs, and you can always reset them back to defaults. The Administrator role is the exception -- it always keeps full access and its permissions cannot be edited.

Creating a Custom Role

If the built-in roles do not match your needs, create a custom role:

1. On the Roles page, click the New Role button in the top-right corner.
2. (Optional) Start from a template. The top of the Create dialog offers quick-start templates -- Worship Director, Counter, Reviewer, Executive Administrator, and Bookkeeper -- that pre-fill the name, color, scope, and permissions. You can edit everything afterward. (Some templates may show an upgrade badge if your plan does not yet include their features.) Counter, Reviewer and Bookkeeper match the Giving levels of the same names -- see Giving levels below.
3. Fill in the role details:
   • Role Name -- A descriptive name (e.g., "Children's Ministry Volunteer," "Finance Team," "Worship Leader"). This field is required.
   • Color -- Select a color for the role badge.
   • Description -- A brief explanation of what this role is for (optional, up to 500 characters).
4. Choose the Permission Scope card -- Own Records Only, Team Members, or All Records. (In the invite dropdown these appear as Themselves, Their team, and Org-wide.) If you pick Own Records Only, the editor warns that Events and Calendar will show an empty list for this role.
5. Set the permissions for each module. For every module you turn on, use the None / View / Edit / Full Access level pills to set how much access the role gets:
   • None -- the module is turned off for this role.
   • View -- read-only access.
   • Edit -- view, create, and edit.
   • Full Access -- every action the module supports.
   • If you fine-tune individual action checkboxes to a combination the pills don't cover, the role shows a Custom badge for that module. The per-action checkboxes appear beneath the pills so you can adjust exactly which actions are allowed.
6. Click Create Role.

The new role will immediately be available for assignment when inviting or managing team members.

Editing a Role

1. On the Roles page, find the role you want to edit.
2. Click the pencil (Edit) icon on the role's card.
3. Update the role name, color, description, scope, or module permissions using the same controls as the Create dialog (including the None/View/Edit/Full Access level pills).
4. Click Save Changes.

Changes take effect immediately for all team members assigned to that role.

Note: System roles can be customized for your church -- each church gets its own copy that can be modified independently. The Administrator role is the exception: its permissions are locked to full access and cannot be changed.

Resetting a Role to Defaults

If you have modified a system role and want to restore it to its original configuration:

1. Find the role on the Roles page. Roles that came from a system template show a Default badge.
2. Click the reset (circular arrows) icon on the role's card.
3. Confirm the reset.

This will restore the role's name, description, color, scope, and all permissions to the original system template values.

Deleting a Custom Role

Custom roles can be deleted if they are no longer needed:

1. Find the role on the Roles page.
2. Click the trash (Delete) icon on the role's card.
3. Confirm the deletion.

You cannot delete a role that has team members assigned to it. If the role is in use, TimelyChurch tells you how many team members are assigned ("This role has 3 team member(s) assigned. You must reassign them before deleting.") and does not delete it. Reassign those team members to a different role first.

Team reach: "Their teams" and "Whole church"

Every role card on the Roles page shows the role's Reach:

• Whole church -- the role works with records across the entire church.
• Their teams -- the role works only with the teams the person leads. The built-in Team Leader role is set to Their teams.
• Own records only -- the role works only with the person's own records.

What a "Their teams" role sees

A team here is any group, serving team or class the person leads as Leader or Co-Leader. Once the change takes effect (see the next section), someone whose role is set to Their teams sees:

• People -- only the active members of the teams they lead.
• Families -- only families with at least one of those people in them.
• Groups, serving teams and classes -- only the ones they lead or teach, with their rosters, attendance and lessons. Lessons that belong to other classes are hidden; shared library lessons are read-only.
• Follow-ups -- only the follow-ups connected to those people.
• Events -- church-wide events (read-only) and the events their own teams host. They can create and edit only events hosted by a team they lead.
• Dashboard, reports and exports -- narrowed to the same people.

Rooms & Facilities, Resources & Equipment, Q&A Sessions, and reviewing or merging duplicate people records are not available to a Their teams role.

To bring in someone who is not yet in one of their teams, a leader invites them by email from the group -- see Managing Group Members. If you would rather let leaders search everyone, turn on Leaders can search the church directory in Church Settings → Profile → Group leaders.

When it starts

Before this change, a Their teams role could still see the whole church. The narrowing starts on the date shown in the notice that church administrators see at the top of every admin page while the date is still ahead:

"From [date], roles set to 'Their teams' (e.g. Team Leader) will only see people, groups, classes, follow-ups and families connected to the teams they lead. To keep whole-church access for a role, open Roles and set it to Whole church."

The notice has a Manage Roles link and a Dismiss button (dismissing hides it for you). Administrators also receive the same message by email and in their notifications, titled "Team Leaders will soon see only their own teams". The notice appears only if someone in your church holds a Their teams role.

Keeping whole-church access for a role

If a role should keep seeing the whole church -- for example a children's ministry director who oversees every class, not just the ones they lead:

1. Open Administration → Roles & Permissions.
2. On the role's card, next to Reach: Their teams, click Change to Whole church.
3. Confirm with Change to Whole church in the dialog.

The change takes effect immediately, before or after the start date. You can also edit the role and set its Permission Scope to All Records, which is the same thing. People who hold the role get a short "Your access in [church] changed" notice.

Giving levels

Giving works in four levels: Reviewer (totals only), Counter (enters gifts into their own batches), Bookkeeper (donors, giving history, statements, closes batches) and Administrator (everything, including refunds and exports). Only Bookkeepers and Administrators see who gave; everyone else sees "Donor". How to set each level on the Giving & Donations row is explained in Who Can See Giving and Donations.

The "Review your roles" email

In September 2026 permissions became more precise: some things a role could do as a side effect of another permission -- publishing, deleting, refunds, and similar -- became separate choices. So that nobody lost anything, TimelyChurch added the new permissions to every role that needed them to keep working as before, and sent your administrators one "Review your roles" email listing which roles received what.

Nothing was taken away, and you do not have to do anything. If a role should not have one of the listed permissions, open it on the Roles page and change it.

Practical Examples

Example 1: Sunday School Coordinator

Create a role for someone who manages Sunday School classes but should not access finances:

• Scope: All Records (Whole church) if they coordinate every class; Team Members (Their teams) if they should only work with the classes they lead themselves
• Modules: People (View), Classes (Edit), Schedules (Edit), Drive (Edit), Attendance (set the level so they can view and record), Check-In (set to View)

Example 2: Finance Administrator

Your church treasurer can use the built-in Finance Admin role, or you can create a custom role:

• Scope: Org-wide (All Records)
• Modules: Giving & Donations (Full Access), Funds (Full Access), Pledges (Full Access), Budgets (Full Access), Accounting (Full Access), Giving Statements (Full Access), Reports (View)

Example 3: Worship Team Member

Create a role for musicians and vocalists -- or start from the Worship Director template:

• Scope: All Records (Whole church) -- with view-only permissions this lets them read the church calendar and service plans. (Own Records Only would leave the Calendar empty; see the note under Scope.)
• Modules: Songs & Music (View), Service Plans (View), Schedules (View), Calendar (View)

Frequently Asked Questions

Q: What happens if I change a role's permissions while people are using the system? A: Permission changes take effect immediately. The next time a team member loads a page, they will see the updated access level.

Q: Can a team member have more than one role? A: No. Each team member is assigned exactly one role per church. If someone needs a unique combination of permissions, create a custom role for them.

Q: How many custom roles can I create? A: There is no hard limit on the number of custom roles. Create as many as you need to match your church's organizational structure.

Q: The number of team members shown on a role card -- what does that mean? A: This count tells you how many people are currently assigned to that role. It helps you understand the impact before making changes.

Q: What does the "Custom" badge on a module mean? A: It means the actions you've selected for that module don't match any of the simple None/View/Edit/Full Access presets. That's perfectly fine -- it just signals you've fine-tuned the individual actions for that module.