Configuring roles and permissions

Roles decide what each person can do; scope decides which records they can do it to. This guide shows how to read, copy and adjust roles, and how to check one person’s access.

Before you begin

• The Administrator role (only Administrators manage roles), or a role with settings.roles.manage.
• Users already invited. See Creating and managing user accounts.

See what a role can do

1. Go to Settings → Users and roles and open the Roles and permissions tab.
2. Select a role from the row of role chips. The number on each chip is how many people hold it.
3. Read the permissions list. Permissions are grouped by module; ticked boxes are what the role can do. Badges such as Restricted mark sensitive permissions.
4. Check the Role settings card: Record scope, Users, Two-step (Required or Optional) and the number of Permissions.

Make your own role

1. Select the role closest to what you need.
2. Select Duplicate role. A copy named “(copy)” is created and selected.
3. Type a new name in the name box at the top of the permissions card.
4. Tick or untick permissions.
5. Select Save role and confirm it’s you if asked. The people holding the role get the new permissions on their next request.
6. Select Discard instead to throw away unsaved changes.

Roles managed by CompanionAxis can’t be edited: the card says “This role is managed by CompanionAxis. Duplicate it to make your own.”

Understand record scope

1. Open the Record-level scoping tab.
2. Read the scope list: Organisation (everything), Region, Branch, House, Caseload (the participants they coordinate) and Own shifts (only participants on shifts they are rostered to).
3. Note where scope applies: lists, search and the ⌘K command bar, reports and exports, the support worker app and notifications, and the REST API.
4. Remember that health, behaviour support and restricted records need their own permission, so a team leader can see a resident’s roster without seeing their behaviour support plan.

Check one person’s access

1. On the Record-level scoping tab, find Preview someone’s access.
2. Choose a staff member in Choose a person….
3. Read What they can reach: record counts their roles reach today, with an example list of participants.
4. In Why can they…?, search for a permission (for example incidents or timesheets.lines.approve) to see which role and scope grants it.

Require two-step verification for a role

1. From the Role settings card, select Two-step requirements by role. This opens Settings → Security and privacy.
2. Tick the role under Two-step verification and save. See Session timeout and password policies.

Tips

• Keep the Administrator role to a few people. It holds every permission.
• Separate duties: the person who creates a record shouldn’t be the only one who can approve it. The built-in roles already follow this.
• After changing a role, use Preview someone’s access on one of its holders to check the effect before telling the team.

If something goes wrong

The permission boxes are greyed out

You are looking at a role managed by CompanionAxis, or you lack settings.roles.manage. Use Duplicate role and edit the copy.

Save role stays disabled

Nothing has changed since the last save. Change the name or a permission first.

Someone has the permission but still can’t see a record

Their scope doesn’t reach it. Check the sites on their role assignment in Settings → Users and roles, or whether the record is restricted.

“Someone has to be Administrator”

You tried to remove the last active Administrator. Give the role to someone else first.