Team and access
How scope and permission combine to decide what each person sees and can do.
1. Scope before permission
Two things decide what someone sees: which buildings they are assigned, and which actions their role allows. Set the scope first.
| Role | Scope | Typical permissions |
|---|---|---|
| Building manager | Their buildings | Read and edit rooms, tenants, leases, invoices; collect payments |
| Accountant | All buildings | Read everything; approve invoices and receipts; no lease edits |
| Maintenance | Their buildings | Tasks and assets only |
| Owner or investor | Their buildings | Reports only, read-only |
2. Permissions that touch money
These are separate permissions on purpose:
- Recording a receipt, and approving it.
- Creating an invoice, and approving it.
- Applying a credit balance, and reversing one.
Someone who can both record and approve their own receipts can hide a shortfall. Splitting the two is the cheapest control you have.
3. Where to configure
Define the permission sets in Roles, then assign people, buildings and role in Users.
Permission changes take effect at the person's next sign-in or session refresh. If someone still sees something after you removed it, have them sign out and back in before assuming the change failed.
Last updated