Permissions Reference Guide

Quick reference guide showing what each role can do in Assignar Pay - compare permissions across all roles.

Permissions Reference Guide

This guide provides a comprehensive overview of what each role can do in Assignar Pay. Use this reference to understand the capabilities and limitations of each role when setting up your team.

Quick Comparison Table

Feature Area	Owner	Admin	Manager	Member	Field	Customer	Supplier	Visitor
Team & Account Management
Manage billing and subscriptions	✅	❌	❌	❌	❌	❌	❌	❌
Add and remove team members	✅	❌	❌	❌	❌	❌	❌	❌
Manage team roles	✅	✅	❌	❌	❌	❌	❌	❌
Invite new team members	✅	✅	❌	❌	❌	❌	❌	❌
Manage account settings	✅	✅	❌	❌	❌	❌	❌	❌
Manage integrations	✅	✅	❌	❌	❌	❌	❌	❌
Manage API keys	✅	✅	❌	❌	❌	❌	❌	❌
Manage tags	✅	✅	✅	❌	❌	❌	❌	❌
Invoice Management
Create invoices	✅	✅	✅	❌	❌	❌	❌	❌
View invoices	✅	✅	✅	✅	❌	✅*	❌	❌
Edit invoices	✅	✅	✅	❌	❌	❌	❌	❌
Delete invoices	✅	✅	✅	❌	❌	❌	❌	❌
Send invoices	✅	✅	✅	❌	❌	❌	❌	❌
Approve invoices	✅	✅	✅	❌	❌	❌	❌	❌
Change invoice status	✅	✅	✅	❌	❌	❌	❌	❌
Quote Management
Create quotes	✅	✅	✅	✅	❌	❌	❌	❌
View quotes	✅	✅	✅	✅	❌	❌	❌	❌
Edit quotes	✅	✅	✅	✅	❌	❌	❌	❌
Delete quotes	✅	✅	❌	❌	❌	❌	❌	❌
Send quotes	✅	✅	❌	❌	❌	❌	❌	❌
Approve quotes	✅	✅	❌	❌	❌	❌	❌	❌
Change quote status	✅	✅	❌	❌	❌	❌	❌	❌
Create quote templates	✅	✅	✅	❌	❌	❌	❌	❌
Edit quote templates	✅	✅	✅	❌	❌	❌	❌	❌
Delete quote templates	✅	✅	❌	❌	❌	❌	❌	❌
View quote templates	✅	✅	✅	✅	❌	❌	❌	❌
Create quote assemblies	✅	✅	✅	❌	❌	❌	❌	❌
Edit quote assemblies	✅	✅	✅	❌	❌	❌	❌	❌
Delete quote assemblies	✅	✅	❌	❌	❌	❌	❌	❌
View quote assemblies	✅	✅	✅	✅	❌	❌	❌	❌
Order Management
Create orders	✅	✅	✅	❌	❌	❌	❌	❌
View orders	✅	✅	✅	✅	❌	❌	❌	❌
Edit orders	✅	✅	✅	❌	❌	❌	❌	❌
Delete orders	✅	✅	✅	❌	❌	❌	❌	❌
Procurement Management
Create purchase orders	✅	✅	✅	❌	❌	❌	❌	❌
View purchase orders	✅	✅	✅	✅	❌	❌	✅*	❌
Edit purchase orders	✅	✅	✅	❌	❌	❌	❌	❌
Delete purchase orders	✅	✅	✅	❌	❌	❌	❌	❌
Approve purchase orders	✅	✅	✅	❌	❌	❌	❌	❌
Manage suppliers	✅	✅	✅	❌	❌	❌	❌	❌
Invite suppliers	✅	✅	✅	❌	❌	❌	❌	❌
Submit supplier invoices	✅	✅	✅	✅	❌	❌	❌	❌
Review supplier invoices	✅	✅	✅	✅	❌	❌	❌	❌
Approve supplier invoices	✅	✅	✅	❌	❌	❌	❌	❌
Client & Project Management
Create clients	✅	✅	✅	❌	❌	❌	❌	❌
View clients	✅	✅	✅	✅	❌	❌	❌	❌
Edit clients	✅	✅	✅	❌	❌	❌	❌	❌
Delete clients	✅	✅	✅	❌	❌	❌	❌	❌
Create projects	✅	✅	✅	❌	❌	❌	❌	❌
View projects	✅	✅	✅	✅	❌	❌	❌	❌
Edit projects	✅	✅	✅	❌	❌	❌	❌	❌
Delete projects	✅	✅	✅	❌	❌	❌	❌	❌
Invite customers	✅	✅	✅	❌	❌	❌	❌	❌
Time & Payroll Management
Create timesheets	✅	✅	✅	❌	❌	❌	❌	❌
View timesheets	✅	✅	✅	✅	❌	✅	❌	❌
Edit timesheets	✅	✅	✅	❌	❌	❌	❌	❌
Delete timesheets	✅	✅	✅	❌	❌	❌	❌	❌
Manage payroll	✅	✅	✅	❌	❌	❌	❌	❌
View payroll information	✅	✅	✅	✅	❌	❌	❌	❌
Rates & Scheduling
Create Schedule of Rates	✅	✅	✅	❌	❌	❌	❌	❌
View Schedule of Rates	✅	✅	✅	✅	❌	❌	❌	❌
Edit Schedule of Rates	✅	✅	✅	❌	❌	❌	❌	❌
Delete Schedule of Rates	✅	✅	❌	❌	❌	❌	❌	❌
View Schedule of Values	✅	✅	✅	✅	❌	❌	❌	❌
Create/Edit Schedule of Values	✅	✅	✅	❌	❌	❌	❌	❌
Delete Schedule of Values	✅	✅	❌	❌	❌	❌	❌	❌
View master items	✅	✅	✅	✅	❌	❌	❌	❌
Create/Edit master items	✅	✅	✅	❌	❌	❌	❌	❌
Delete master items	✅	❌	❌	❌	❌	❌	❌	❌
Financial Operations
View payment history	✅	✅	✅	❌	❌	❌	❌	❌
Process payments	✅	✅	❌	❌	❌	❌	❌	❌
View financial reports	✅	✅	❌	❌	❌	❌	❌	❌
Document Management
Create documents	✅	✅	✅	✅	❌	❌	✅	❌
View documents	✅	✅	✅	✅	❌	✅	✅	❌
Edit documents	✅	✅	✅	✅	❌	❌	❌	❌
Delete documents	✅	✅	❌	❌	❌	❌	❌	❌
Forms
Build and manage forms	✅	✅	✅	❌	❌	❌	❌	❌
View and respond to forms	✅	✅	✅	✅	✅	✅	✅	✅
Workpacks
View workpacks	✅	✅	✅	✅	✅	✅	❌	❌
Manage workpacks	✅	✅	✅	❌	❌	❌	❌	❌
Approve workpacks	✅	✅	✅	❌	❌	❌	❌	❌
Sign off workpacks	✅	✅	✅	✅	✅	❌	❌	❌
Override workpack status	✅	✅	❌	❌	❌	❌	❌	❌
SMS
View SMS module	✅	✅	✅	✅	❌	❌	❌	❌
Send SMS broadcasts and replies	✅	✅	✅	✅	❌	❌	❌	❌
Manage SMS configuration	✅	✅	❌	❌	❌	❌	❌	❌
Advanced Features
Access AI features	✅	✅	✅	✅	❌	❌	❌	❌

*Customer access is limited to specifically shared information only. *Supplier access is limited to purchase orders issued to them and related invoice submission. *Field access is limited to the worker's own work. A Field user sees only their own shifts and timesheets and the workpacks assigned to them. The ❌ on "View clients/projects" refers to the clients and projects management pages; when filling a timesheet a Field user can still pick from the account's clients, projects, roles, and equipment. They file their own timesheets from My Shifts, rather than creating timesheets for others.

Note: Sender numbers for SMS are provisioned by your Account Manager. Sending SMS also requires recipients to have opted in — see the SMS guide for details.

Detailed Permissions by Category

🏢 Account & Team Management

Owner Only:

Complete billing and subscription control
Add and remove team members
Assign and change user roles
Delete entire account or major data
Manage integrations with other systems

Admin Capabilities:

Invite new team members
Manage most account settings
Configure workflows and processes
Handle day-to-day team coordination
Manage API keys for integrations and automation

Limited Access (Manager/Member):

View team information
Access relevant account data
Use account features within their scope

🔑 API Key Management

Owner & Admin:

Create API keys for integrations and automation
View and list all API keys for the account
Revoke (delete) API keys when needed
Manage API key scopes and permissions
Monitor API key usage and access logs

Manager & Member:

No access to API key management
Cannot create, view, or delete API keys

💰 Financial Operations

Owner Exclusive:

Process payments and billing
Send invoices to customers
Change invoice statuses
Delete financial records
Access complete financial oversight

Admin & Manager Shared:

Create and edit invoices
View financial reports and payment history
Handle customer billing inquiries

Manager Only:

View comprehensive financial data for projects
Access payment history for areas of responsibility

Member Access:

Create invoices for their work
View invoice status and basic information

⏰ Time & Payroll Management

Recent Update: Manager role now includes timesheet management capabilities.

Owner & Admin:

Complete payroll management
Full timesheet control (create, edit, delete)
Process payroll payments
Set compensation structures

Manager (Enhanced):

Create timesheets for team members
Edit and update timesheet entries
View comprehensive timesheet data
Monitor team time allocation

Member:

View timesheet information for reference
Access time-related data for planning

📊 Project & Rate Management

Owner Control:

Create and manage Schedule of Values (SOV)
Complete control over client relationships
Delete major project data

Admin Capabilities:

Create and manage Schedule of Rates (SOR)
Create and edit master items
Manage client relationships
Create, edit, delete, and view projects

Manager Access:

View rates and scheduling information
Access project data for coordination
Use master items for planning
View project information
Create and edit projects for their teams

Member Access:

View basic client and project information
Access data relevant to their work
View project details for assigned work

🛒 Procurement Management

Recent Addition: Comprehensive procurement system for managing suppliers and purchase orders.

Owner & Admin:

Complete purchase order management (create, approve, delete)
Supplier directory management
Supplier portal access control
Supplier invoice approval
Procurement analytics and reporting

Manager (Enhanced):

Create and edit purchase orders
Review supplier invoices
Coordinate procurement activities
Track order fulfillment

Supplier (External Portal):

View purchase orders issued to their company
Submit invoices against approved purchase orders
Upload supporting documents and receipts
Track invoice status and communication history

📁 Document & Information Management

All Internal Roles (Owner through Member):

Create and edit documents
Access document libraries
Collaborate on shared documents

Supplier Access:

Create documents (receipts, certificates)
View documents related to their purchase orders
Upload supporting documentation

Admin & Owner Only:

Delete documents
Manage document access permissions
Control sharing with external parties

Customer Access:

View only specifically shared documents
Read-only access to relevant information

📝 Forms

Owner, Admin & Manager:

Build and manage forms (create, edit, configure workflows)
View and respond to forms

All Other Roles (Member, Customer, Supplier, Visitor):

View and respond to forms they have access to
The Visitor role is designed primarily around forms access — it's the most restricted role and is intended for limited or external participants who only need to fill in forms

📦 Workpacks

Owner & Admin:

View, manage, approve, and sign off workpacks
Override workpack status

Manager:

View, manage, approve, and sign off workpacks
Cannot override workpack status

Member:

View workpacks
Sign off workpacks assigned to them

Field:

See the full workpack (for context) when it's assigned to them or on an order they're rostered to
Sign off only the checkpoints assigned to them — by name or tag
Cannot see unrelated workpacks, or act on checkpoints assigned to someone else

Customer:

View workpacks that have been shared with them

💬 SMS

Recent Addition: Two-way SMS messaging for coordinating with your crew.

Owner & Admin:

View the SMS module (inbox, outbox, templates, groups, usage)
Send broadcasts and replies
Manage SMS configuration-level operations

Manager & Member:

View the SMS module
Send broadcasts and replies

Note: Sending SMS requires recipients to have opted in to receive messages, and a sender number must be provisioned for your account by your Account Manager. See the SMS guide for full details on consent and setup.

Understanding Permission Hierarchy

🔺 Role Hierarchy

Owner (Highest authority) - Complete control
Admin - Broad operational access
Manager - Focused management capabilities
Member - Essential work access
Field - On-site workers; own shifts, timesheets, and assigned work only
Customer - View-only shared access (external client portal)
Supplier - External procurement portal access
Visitor (Most restricted) - Forms access only

🛡️ Security Principles

Principle of Least Privilege:

Each role has only the access needed for their responsibilities
Higher roles can perform actions on lower roles but not on peers
Sensitive operations require higher-level authorization

Data Protection:

Customer data is isolated and controlled
Internal business data is protected from external access
Financial operations have additional security layers

Best Practices for Role Assignment

🎯 Choosing the Right Role

Assign Owner to:

Business owners and key decision-makers
Those who need complete financial oversight
Users responsible for billing and subscriptions

Assign Admin to:

Operations managers and senior staff
Those who handle daily business management
Users who coordinate teams and processes

Assign Manager to:

Project managers and team leaders
Department heads and supervisors
Those who coordinate specific business areas

Assign Member to:

Individual contributors and employees
Contractors and staff who need basic access
Those focused on specific tasks and deliverables

Assign Field to:

On-site crews, operators, and workers (typically on mobile)
Anyone who should only see their own shifts, timesheets, and assigned work
Workers who log their own time and complete assigned workpack checkpoints

Assign Customer to:

External clients and customers
Third-party partners with limited access needs
Anyone outside your organization requiring controlled access

Assign Supplier to:

External suppliers and vendors
Contractors providing goods or services
Service providers who fulfill purchase orders
Material suppliers and equipment vendors

Assign Visitor to:

Limited or external participants who only need to complete forms
Anyone who should have the most restricted access possible

🔄 Regular Review

Monthly Reviews:

Assess if team members have appropriate access
Review role assignments as responsibilities change
Remove access for departing team members

Quarterly Planning:

Evaluate role structure effectiveness
Plan for team growth and changing needs
Update permissions based on business evolution

⚠️ Common Mistakes to Avoid

Over-privileging: Giving higher access than needed
Under-privileging: Restricting access too much for job requirements
Inconsistent assignment: Not following clear role criteria
Neglecting reviews: Failing to update roles as needs change
Poor documentation: Not explaining role assignments to team members

Getting Help with Permissions

If you need assistance with role assignments or permissions:

Review this guide to understand available options
Assess your team needs and responsibilities
Start conservatively with lower access levels
Adjust as needed based on actual usage
Contact support for complex permission scenarios

Remember that roles can be adjusted as your team and business needs evolve. Start with appropriate baseline access and refine based on actual usage and business requirements.