Roles and access

What each role lets somebody do: the built-in roles every organization has, and the roles your organization makes for itself.

See what a role can do

Press a role's name.
Read its permissions, grouped by area, in plain words.

Then: Owners and admins also see how many seats hold each role, and who.

Grace wonders whether a Project manager approves hours. Opening the role shows it runs projects and tasks at its unit and the hours logged on them, and nothing under Time and leave, so it does not.

Make a role of your own

Press New role.
Choose a built-in role under Start from: its permissions are copied.
Give it a Name, and say under What this person does what it is for.
Check or uncheck what it can do.
Press Save role. If you are asked to confirm it's you, enter your password again.

Then: It is offered in every role list from then on: Invite, Enroll and Add a seat, like any role.

Daniel's campus leads approve their volunteers' hours but should not change anybody's leave. Daniel starts from Unit lead, keeps the approvals, takes leave away, and names it Campus volunteer lead.

Change one of your roles

Press Edit beside it.
Change what it can do.
Press the save button: it names how many people the change reaches. If you are asked to confirm it's you, enter your password again.

Then: It applies to everybody who holds it from their next page, and is recorded in the audit log.

Rather not? Somebody who only needs a different name for the same job needs no new role: give their seat a Title, such as Treasurer.

Give somebody a role

Press Add person beside the role.
Choose the Person and the Unit.
Choose under Reach whether it covers the units below, or This unit only.
Add a Title if they are called something else, then press Add. If you are asked to confirm it's you, enter your password again.

Then: They hold the role at that unit from their next page.

Stop offering a role

Press Archive at the end of one of your roles, then Archive it. Press Restore on it under Archived to offer it again.
Press Delete, then Delete it, instead only when nobody has ever held it.
If you are asked to confirm it's you, enter your password again.

Then: An archived role is no longer offered; people who hold it keep it, so nobody loses access by surprise.

Everybody who opens the page sees what each role does. Only the Owner or an organization admin creates, changes or gives roles here, and sees who holds them; each change asks them to confirm it's them, at most every 15 minutes, because it changes what people may do. Your own roles are part of Custom roles & seat grants, in your plan.