Workspace access is the primary control on this report — roughly a dozen named people. The roles below shape what each of them sees once inside. Editing a cell records what the business wants; the semantic model still has to be rebuilt before it is true.
Function head
Organisation scopeYouOwns the portfolio question. Reads the whole organisation and is the audience the overview is written for.
Can
- Read every page at organisation scope
- Drill through to project financial detail
- See cost, budget and margin across all iHubs
- Read restricted projects in aggregate
Cannot
- See per-person cost or charge rates — they are not in the model
- See invoice amounts, balances or ageing
- Read restricted project detail without a valid clearance
Filter: No filter
All nine pagesProject financial detailPerson effort detailAnalyse in Excel
Finance
Organisation scopeReconciles the report against the ledger. Works mostly in Excel against the published model.
Can
- Read every page at organisation scope
- Connect to the model from Excel
- Read the cost basis and its agreement status
- Drill through to project financial detail
Cannot
- See per-person rates in this model — rate detail lives in Platform 2
- See invoice amounts — invoicing is owned by M3
Filter: No filter
All nine pagesProject financial detailAnalyse in Excel
Business development
Organisation scopeAnswers for what was promised to the customer: predicted value, committed savings and stage-payment status.
Can
- Read every page at organisation scope
- Read predicted against actual value
- Read savings committed against delivered
- Read stage-payment status
Cannot
- See customer-level savings roll-up — it is not built here
- See invoice amounts or ageing
- Read restricted project detail without a valid clearance
Filter: No filter
Portfolio overviewPredicted against actualValue, savings and commitmentsStage payments
Regional management
Region scopeScoped to one region. The filter is set on Region and flows down through iHub to project.
Can
- Read every page filtered to their own region
- Drill through to projects within their region
- Compare their iHubs against each other
Cannot
- See other regions — they are absent from every visual, not just the default view
- See per-person cost or charge rates
- Read restricted project detail without a valid clearance
Filter: iHub[Region] = USERREGION()
All nine pages, region-filteredProject financial detailPerson effort detail
Project engineering manager
iHub scopeScoped to one iHub. Sees the cost and effort picture for the projects they run.
Can
- Read every page filtered to their own iHub
- Drill through to their own projects
- Read person-level hours for their own iHub
Cannot
- See other iHubs
- See per-person cost or charge rates
- Read restricted project detail without a valid clearance
Filter: iHub[iHub] IN USERIHUBS()
All nine pages, iHub-filteredProject financial detailPerson effort detail
Administrator
Organisation scopePlatform administration. Deliberately a very small population — this role is a maintenance route, not a reading audience.
Can
- Read every page at organisation scope
- Maintain roles, clearances and the Person dimension
- Publish and refresh the semantic model
Cannot
- Grant themselves data that is not in the model — rates and invoices are absent by design
- Bypass restriction clearance without being granted one
Filter: No filter. Kept small
All nine pagesModel administrationRole and clearance maintenance
A tick is permission within the role's own scope: a regional manager reading “every page” reads them filtered to one region. Rows with no ticks are absent from the model entirely — there is nothing to grant.