Permissions reference

These tables list the permissions by the name it has in a member's access panel, grouped the same way, and show which roles hold it by default. A ✓ means the role includes it; – means it doesn't, and nobody with that role can be given it.

Someone can have less than their role's column shows: open their access panel to see exactly what they hold. See Adjust someone's access.

For Customers and Suppliers, a ✓ covers their own records only: a customer's own client or project, and a supplier's own purchase orders. Field users see their own shifts, forms and assigned workpacks, whatever the table says about the permission in general. See the page for each role.

Workspace Admin

Sales & Revenue

Client financial controls start switched off. Viewing or updating an assessment is separate from approving exceptions. Financial figures also require See sell figures. Updating assessments or managing policies requires assessment view access.

Operations

Procurement

Payroll & Rates

Maintenance

A Manager holds Approve maintenance spend only from an access preset that includes it. Without one, the row is greyed out in their access panel. For what each one lets someone do, see Who can do what in Maintenance.

Sensitive Data

See sensitive worker data covers four kinds of worker information:

• A worker's address and date of birth. Without the permission, they don't appear anywhere. See Record a worker's address and date of birth.
• Worker custom fields marked Sensitive, such as Indigenous status. Without the permission, those fields don't appear anywhere. See Keep sensitive worker details private.
• The confidential notes on a worker's competencies, such as the detail behind a medical status. Reading them also needs View payroll, and adding or deleting one needs Update payroll. See Notes on a credential.
• The documents on competencies marked Sensitive, such as a medical certificate. Opening them also needs View payroll. See Keep medicals and other documents private.

A worker never sees their own address and date of birth, sensitive custom field values or sensitive competency notes, but can still open their own documents on a sensitive competency. Changing a sensitive value also needs permission to edit workers.

What some permissions cover

• View assets opens Resources → Assets and the asset classes list. Create assets gives the Create Asset and Create Asset Class buttons there, and Update assets lets someone edit an asset, its photos and its meters. Creating an asset together with a new asset class also needs Create cost codes, because it creates the class's cost code too. So does importing assets from Assignar Ops.
• Allocate assets starts out with everyone who has Update cost codes. While Access by location is off, nothing checks it. Once it is on, putting an asset on a shift needs Allocate assets, and the asset must be inside that permission's locations, Business Units and asset classes, or shared with your location to see and allocate.
• The five asset permissions are the only ones you can limit to certain locations and asset classes on their own, with Limit on an access preset. See Limit one asset permission.
• Delete cost codes is also what Assignar Pay checks when someone deletes cost-code categories, materials, activities, worker roles and their requirements, and allowances. Owners and Managers hold it; Admins don't. Delete assets is checked the same way for assets and asset classes.
• View payroll opens Payroll → Pay Rates. Without it, that entry isn't in the sidebar.
• Deleting or restoring a timesheet on Pay Rates needs both Delete timesheets and Update timesheets.
• View invoices puts Invoices in the sidebar, and Create invoices puts Billable Units there.
• Manage invitations gives the Invite Members button on the Members list. Invite workers to Pay gives a worker a login from their worker profile, with the Field role.
• Manage roles & permissions lets someone change roles and adjust access for people below them. Manage members lets them remove people.
• Invite customer portal users is needed to give a client contact portal access.
• Set required forms decides which forms are required, optional or left out for each client, project, order, role or machine. It needs View forms. See Set up required forms.
• Let workers check in without required forms lets someone let one worker check in to one shift while a required before-start form is still missing. They give a reason, which is recorded against the shift, and the forms still count as missing. Nobody can do it for their own shift. It needs View orders. See Chase outstanding forms.
• Check in and out from their shifts only matters while your organization uses check-in. With check-in on, Field and Visitor members always check in and out, and Owners, Admins and Managers who have a worker profile do too while they hold this permission. Leave it out of someone's access preset, or remove it from them, and they file a timesheet instead. If your organization already used check-in, its Owners, Admins and Managers with a worker profile stay on timesheets until you adjust their access to give them this permission.
• Manage secrets covers the secrets form workflows use for webhooks. See Automate with workflows.
• The Connect permissions decide who builds workflows and who decides approvals in Assignar Connect. The Subcontractors permissions only matter where your organization has the Subcontractor Hub.
• Correct hire records needs Record on-hire and off-hire. A Field member holds Record on-hire and off-hire only.
• Approve maintenance spend and Close work orders need View maintenance. Report maintenance requests and Manage work orders don't, so a Field member holds those two without it.

The access panel also lists a few permissions no role includes, such as the contacts and contracts permissions. They are left out of the tables above.