The three base roles
- Super admin — sees and manages every company, for whoever owns the account.
- Admin — full rights, scoped to their own company only.
- Staff — scoped to their own company, and further limited to whatever an access role grants them.
An admin or staff member can never see or act on another company’s employees, documents or financial records — that scoping is enforced everywhere, not just hidden in the interface.
Building a custom access role for staff
For staff members, access is set per module and per action — view, create, edit, delete, approve, export — across areas like workforce, projects, demand, payroll and finance. A role only needs the actions a person’s job actually requires: someone in operations might get view and edit on workforce and projects, without touching payroll or finance at all.
One rule worth knowing: granting any other action on a module (create, edit, approve) always requires View on that same module too — you can’t edit what you’re not allowed to see.
Who can approve what
The Approvals inbox only ever shows a person the kinds of request their own permissions allow — expenses, bills, payroll, worker or supplier changes, demand requests, timesheets and attendance corrections are each tied to a specific module and action, so “who can approve this” is answered by the same role setup, not a separate configuration.
A role, saved once, reused for the next hire
An access role is created once with a name (“Site Supervisor”, “Finance Clerk”) and can be assigned to any number of people afterward — the next person hired into the same job gets the same access in one step, rather than rebuilding the permission set from scratch.