Roles and permissions

Every teammate you invite gets an access role that controls what they can see and do. Roles apply everywhere — the backoffice web app and the mobile app read the same rules, and the server enforces them on every request (not just by hiding buttons).

Owners and admins

Members whose role is Owner or Admin always have full access — they bypass permission checks entirely, so they can reach Billing, invite people, and manage roles. Everyone else is governed by the access role you assign them.

A member with no access role assigned is treated as unrestricted. Assign a role the moment you want to limit someone.

Where to manage roles

Go to Settings → Users & Roles.

• The Users tab lists everyone in your workspace. Each person has a role you can change inline.
• The Roles area is where you build the roles themselves. Use Duplicate on an existing role as a shortcut when the new role is "almost like that one."

What a permission looks like

A role is a grid of modules (Work Orders, Accounts, Contacts, Invoices, Quotes, Projects, Warehouses, Vehicles, Parts, Tools, Scheduler, Teams, and more) crossed with actions:

• View — can open the module and see records.
• Create — can add new records.
• Edit — can change existing records.
• Delete — can remove records.
• Link — can attach existing records to each other (e.g. link a contact to a work order) without being able to create or edit them.

Turn each on or off per module. A tech might get View + Link on Accounts (so they can attach a customer to a job) but nothing on Billing.

How it shows up for the user

• In the sidebar/menu, modules the role can't view are hidden.
• Create / edit / delete buttons disappear when the action isn't allowed.
• If someone crafts a request anyway, the API answers 403 — the permission is real, not cosmetic.

Mobile behaves the same way

The mobile app honours the identical role. A field tech only sees the modules and actions their role grants — for example, on mobile the work-order picker is scoped to jobs they're assigned to, and create/edit/delete follow the same toggles.

Common pitfalls

• "I removed a permission but the person still sees it" — Owners/Admins are never restricted. Check their base role first.
• A whole module vanished for someone — you turned off View; every other action requires View to be on.