Team and access

How scope and permission combine to decide what each person sees and can do.

1. Scope before permission

Two things decide what someone sees: which buildings they are assigned, and which actions their role allows. Set the scope first.

RoleScopeTypical permissions
Building managerTheir buildingsRead and edit rooms, tenants, leases, invoices; collect payments
AccountantAll buildingsRead everything; approve invoices and receipts; no lease edits
MaintenanceTheir buildingsTasks and assets only
Owner or investorTheir buildingsReports only, read-only

2. Permissions that touch money

These are separate permissions on purpose:

  • Recording a receipt, and approving it.
  • Creating an invoice, and approving it.
  • Applying a credit balance, and reversing one.

Someone who can both record and approve their own receipts can hide a shortfall. Splitting the two is the cheapest control you have.

3. Where to configure

Define the permission sets in Roles, then assign people, buildings and role in Users.

Permission changes take effect at the person's next sign-in or session refresh. If someone still sees something after you removed it, have them sign out and back in before assuming the change failed.

Last updated