Jump to a page, find a record or run a command
Manage your profile, company branding and subscription.
Exactly what each role can do. Read this before assigning one.
Seven identities: five inside the company, two outside it
Full control, including billing, branding and account closure.
Works inside the operationManages people, settings and every operational module.
Works inside the operationPlans jobs, assigns operators and handles day-to-day quotes.
Works inside the operationManages operator records, documents, certifications and payroll input.
Works inside the operationHandles invoicing, expenses and financial reporting.
Works inside the operationSees only their own jobs, documents and machine.
External portal accessExternal portal access to their own quotes and invoices.
External portal accessA tick means the role holds that grant outright
The same matrix, one role at a time
Every permission in this table has a matching row-level security policy in the database. The interface and the database read the same definition, which is what makes a permission check trustworthy rather than decorative — a screen someone cannot open is also a table the database will refuse to return. A custom role invented in the browser would have no policy behind it, so every list would come back empty with nothing to explain why.
Changing what a role can do is a deployment: edit config/permissions.ts and the migration that seeds it, together.