Unless explicitly configured to do so, Capacity Tracker (CT) does not check for permissions so any logged-in user will be able to use every exposed feature.
This is meant to provide a good experience for first-time users.
In case you would like to restrict access to some clients, CT offers two levels of permissions:
Global Permissions
Multi-project reports
Template management
Project Permissions
Capacity Report