Permissions and access rights

How to read and change what each role can do on the Permissions screen, make a one-person exception, and use the Access rights grid with role templates, per-user views, history and recovery contacts.

Where: web · Who can use it: Permissions: shown to people with the Manage Users permission. Access rights: shown only when the server says the grid is on and the person holds the Users and permissions View right. Changing access rights needs the Grant right.

Screens may differ slightly from what you see.

What it is for

There are two screens that control who can do what.

Permissions (Admin > Permissions, titled "Role Permissions") is a matrix: one row per permission, one column per role. You click a cell to allow or deny it for that role. Below it, "Exceptions for one person" lets you override the role for a single person.
Access rights (Admin > Access rights) is a newer grid of areas and actions. Its subtitle reads "What each role and each person can view, add, edit, delete, approve and export". It has four tabs.

Who can use it

Permissions: the menu entry needs the Manage Users permission. Without it the page shows "You don't have permission to manage role settings. This page is visible to admins and managers only." The cells do not respond.
Per-person exceptions: the card says "Only a manager can see or change per-person exceptions."
Access rights: the menu entry is hidden unless the server answers that the grid is switched on and you hold Users and permissions > View. Otherwise the page says "Access rights are not available for your account." With View but not Grant you see "You can view access rights. Changing them needs the Grant permission."

How to use it

Read the Permissions matrix

Open Permissions.
The columns are the company's roles (the page does not show the admin role). Each row is a permission, grouped under headings such as Quotes, Payments, Jobs, Customers, Settings, Reports, Ordering, Email and Schedule.
Use the legend. A green tick is "Default — allowed", a blue tick "Override — allowed", a grey cross "Default — denied" and a red cross "Override — denied".

Change a permission for a whole role

Find the permission row and the role column.
Click the cell. The tooltip says "Click to allow" or "Click to deny".
Wait for the spinner to finish. If saving fails, a red message shows with a Dismiss link.

A change affects everyone on that role, apart from anyone with their own exception.

Make an exception for one person

Scroll to Exceptions for one person.
Choose the Person, the Permission and the Setting (Allow or Deny).
Select Save exception.

The card says the per-person setting wins over the role. To undo it, select Remove next to the entry. With no exceptions it says "No one has an exception - everybody follows their role."

Use the Access rights grid

Open Access rights. Pick a tab:

Role templates. The built-in roles and your company's own copies. A built-in role is duplicated, and the copy is edited. A template the server marks as not editable is shown read-only with the server's reason.
Users. Shows what a person can actually do, cell by cell, and where each answer came from. A person can be restricted below their role. They cannot be given more than the role allows. A person can also be assigned a template.
History. The record of access changes.
Recovery contacts. Owners or directors the platform may check with if the company asks for an owner to be restored. A newly added contact is not usable for 72 hours.

Every change asks for a reason of at least 3 characters. It is stored with who changed what, for whom, and from what to what.

If the server refuses a change with the message "Refused - at least one owner must keep full access.", you have tried to remove the last owner's access. This protection cannot be turned off.

Tips

Prefer a role change over many one-person exceptions. Exceptions are harder to audit.
Write the reason on Access rights as if someone will read it later. It is stored.
After a change, check the cell colour. Blue and red mark overrides, not defaults.

Things to know

The Permissions page lists every named permission. For example, refunds follow "Process refunds", payment lists follow "See payment lists", and sales figures follow "See sales figures". These also depend on company switches covered in Quote wording, defaults and company switches.
Some permission descriptions on screen name a default (for example "owner and director by default"). These come from the page text, not from a live check.
The Role Permissions switches on the User Management screen are a separate, shorter list. See Manage users and roles.

Common questions

How do I change a role's permission?

Open Permissions. Each row is a permission and each column is a role. You click a cell to allow or deny it for that role. Below it, Exceptions for one person lets you override the role for a single person.

Who can see the Permissions page?

People with the Manage Users permission. Without it the page says you do not have permission to manage role settings. The Access rights grid is only shown when the server says it is on and you hold the View right.