Roles and permissions

A role decides what someone sees when they log in. Get this right before you invite anyone, because it's much easier to widen access later than to explain why a subcontractor saw your margins.

1. Roles

The Roles button on Settings > Team. The panel says "manage the roles and permissions for your team".

The default roles

Two ship with every account:

Admin is "full system access and team management". Everything: revenue, payroll, settings, other people's logins. Keep this to owners and whoever runs the office. Handing Admin to a technician because they needed one screen is the most common permissions mistake in this app.

Sales Rep is "view all jobs and manage own territory". Sees the work, manages their own patch, doesn't run the company.

2. Custom roles

Below the defaults it reads "no custom roles yet. Create a custom role to tailor permissions for your team", with a + New role button.

Custom roles are how you fit the two defaults to a real business. The gap they usually fill is a technician: someone who needs today's jobs, the customer's address and gate code, and a way to mark work complete, but has no business seeing company revenue or other people's pay.

How to think about it

Start from the narrowest role that lets someone do their job, then widen when they hit a wall. Widening takes one click. The other direction involves a conversation about what they already saw.

Three questions worth answering per role:

1. Should they see money they didn't earn? Company revenue, other people's commission, the payroll report.
2. Should they see customers they aren't working with? Your whole customer list is a competitive asset.
3. Should they change settings? Pricing, automations, tax rates and templates affect everyone.

For most technicians the honest answer to all three is no.

Tips and gotchas

• Admin is not a seniority badge. It's full access to money and settings.
• Build the technician role you actually need. Neither default fits well.
• Roles before invites. The invite makes you choose.
• Check the role column periodically. Access granted "just for today" tends to stay.

Next up: Access and navigation