Team & Access
Admin access that can't be delegated away
No matter how a custom role's permission matrix is configured, employee management — creating, editing, or deleting accounts — stays locked to the real Admin role.
This closes a common privilege-escalation path: a role with broad 'edit' permissions elsewhere in the app still can't be used to create a new admin account or grant itself more access, because that one action isn't exposed to custom roles at all.
Every other section — Finance, Directories, Projects, Deals, and the rest — is delegable and configurable per role; account management is the one deliberate exception.
Delegate access, not the keys to the whole account.
WTM is free and open source under AGPL-3.0. Self-host it and manage your team with confidence.
Get started