Permissions and building your own role
A role in LakeOps is a bundle of named permissions, and while the four built-in roles are fixed so nobody can accidentally lock the account out, you can create as many custom roles as you like from the same permission list.
Most shops never touch this screen and that is fine. It matters when the built-in roles are either too generous or too tight for somebody real — a bookkeeper who should see money and nothing else, a lead hand who should dispatch but not price.
What a permission is
A named capability, not a screen. They come in groups and they read like their effect:
| Group | Examples |
|---|---|
| Customers and properties | View, create and edit; archive |
| Items | View; create and edit items, points and notes; retire and restore |
| Jobs | View; create; mark individual items done or skipped; close a job out; reopen one |
| Timers | Start and stop on-site timers; edit timer timestamps after the fact |
| Dispatch and the map | See the dispatch board; deploy crews; see the map |
| Billing | View payments and the completed-work report; send completion emails; configure payments |
| Reports | View reports; export them |
| People and roles | Invite; assign roles; remove access; build custom roles |
Note how finely a couple of them are cut. “Mark individual items done” and “close a job out” are separate, because closing a job prices the work and emails the customer — that is a different decision from saying a lift is out of the water, and plenty of shops want it in different hands.
Likewise “view reports” and “export reports”: reading a number on screen and walking out with the file are not the same act.
Building a role
Under Settings → Roles. Name it for the person it describes — “Bookkeeper”, “Lead hand”, “Yard” — and tick the permissions. Assign it in Settings → People like any other role.
The fastest way to get one right is to start from the built-in role that is closest, list what is wrong with it, and build the version that fixes exactly that. Most custom roles end up being an office role minus money, or a crew role plus dispatch.
Roles stack. Somebody with two roles gets the union of their permissions. That is usually simpler than building a third role — an operator who also needs the reports is operator plus a small “Reports” role.
Some permissions only an owner can hand out
A handful — removing somebody’s access, configuring payments, exporting the account’s full data, deleting jobs, restoring deleted records — are marked as owner-level. They can go in a custom role, but only an admin can put them there. These are the ones where a mistake is expensive and quiet.
Where permissions are actually enforced
Not just on buttons. Every request is checked server-side against the person’s roles, and — importantly — so is every action replayed from an offline queue. Somebody whose role cannot run timers cannot get a timer in by being out of signal when they tap it.
That matters because a phone out of range is, from the server’s point of view, just a text field that shows up later. It gets checked like anything else. See working with no signal.
Why the built-in roles are locked
Admin, office, operator and crew are fixed. If they could be edited, the first bad afternoon would end with an account that has no working admin role and no way to fix itself. Custom roles give you everything editing them would have, without that failure mode.
Still stuck? Ask us — or go back to the help center.