Permissions and building your own role

Most shops never touch this screen and that is fine. It matters when the built-in roles are either too generous or too tight for somebody real — a bookkeeper who should see money and nothing else, a lead operator who should dispatch but not price.

What a permission is

A named capability, not a screen. They come in groups and they read like their effect:

Group	Examples
Customers and properties	View, create and edit; archive
Items	View; create and edit items, points and notes; retire and restore
Jobs	View; create; mark individual items done or skipped; close a job out; reopen one
Timers	Start and stop on-site timers; edit timer timestamps after the fact
Dispatch and the map	See the dispatch board; deploy crews; see the map
Billing	View payments and the completed-work report; send completion emails; configure payments
Reports	View reports; export them
People and roles	Invite; assign roles; remove access; build custom roles
The account	Edit the account's own settings; export everything; restore something archived

Note how finely a couple of them are cut. “Mark individual items done” and “close a job out” are separate, because closing a job prices the work and emails the customer — that is a different decision from saying a lift is out of the water, and plenty of shops want it in different hands.

Likewise “view reports” and “export reports”: reading a number on screen and walking out with the file are not the same act.

Building a role

Under Settings → Roles. Name it for the person it describes — “Bookkeeper”, “Lead operator”, “Shore crew” — and tick the permissions. Assign it in Settings → People like any other role.

The fastest way to get one right is to start from the built-in role that is closest, list what is wrong with it, and build the version that fixes exactly that. Most custom roles end up being an office role minus money, or a crew role plus dispatch.

Some permissions only an owner can hand out

A handful — removing somebody’s access, configuring payments, exporting the account’s full data, deleting jobs, restoring deleted records — are marked as owner-level. They can go in a custom role, but only an admin can put them there. These are the ones where a mistake is expensive and quiet.

Where permissions are actually enforced

Not just on buttons. Everything is checked against the person’s roles when it lands, and — importantly — that includes every tap a phone held onto and sent in later. Somebody whose role cannot run timers cannot get a timer in by being out of signal when they tap it.

That matters because a phone out of range is, as far as your account is concerned, just a stack of taps that shows up later. It gets checked like anything else. See working with no signal.

Why the built-in roles are locked

Owner, admin, office, boat operator and crew are fixed. If they could be edited, the first bad afternoon would end with an account that has no working admin role and no way to fix itself. Custom roles give you everything editing them would have, without that failure mode.