Roles and permissions

A role has four parts:

• Areas — None, View, Edit or Manage for each part of the work: estimates, budgets, change orders, time cards, daily reports, equipment, HR files and the rest. View reads it; Edit adds and changes; Manage also sets it up and deletes.
• Approvals — each its own right: approving bids, time cards, daily reports, vendor bills and expenses, deciding change orders, finalizing payroll, publishing the two-week plan, closing the WIP month.
• Money they see — job costs, individual pay rates, equipment rates, bid margins, and billing. A figure switched off is refused or left out wherever it would show. Bid margins covers overhead, profit, adds and cuts and the margin; cost and the bid price stay on the worksheet for anyone who reads estimates, so keep Estimates off a role whose people shouldn't know the gap between them. Paperwork with prices on it (bills, expenses, site and fuel tickets) shows its dollars to whoever entered it and to anyone who sees job costs. A T&M ticket shows its prices to whoever sees the ticket, because it's priced on site for the inspector to sign; what's owed on T&M is billing. Approving bills or expenses takes job costs as well as the approval.
• Whose records — every job, the jobs they're named on, their crew's, or only their own.

Someone holding two roles gets the most generous of each part, each at its own role's reach: a project manager who is also the HR manager reads every employee's file and still only their own jobs' budgets.

Every company starts with fifteen: Office admin, Accounting & payroll, HR manager, Safety manager, Viewer, Chief estimator, Estimator, Project manager, Superintendent, Resource manager, Foreman, Operator / laborer, Equipment manager, Shop manager and Mechanic. Owners aren't a role: an owner has everything and can't be limited, and a company keeps at least one.

People who were in the company before roles hold the starting role that matches what they had: a project manager the Project manager role, a foreman the Foreman role, someone with HR access the HR manager role.

1. Choose the role.
   Open Company › Users and roles, then Roles, and choose it. What differs from its starting point is marked changed.
2. Change it.
   Its reach, the money it sees, its approvals and the level on each area.
3. Save.
   It changes at once for everyone who holds it. Reset to the starting role puts a starting role back the way Aggrado made it.

Copy as a new role starts a role of your own from one that's close (“Senior project manager”, “Fuel truck driver”). Archive takes a role out of use once nobody holds it; Show archived roles lists them, and Restore brings one back.

1. Open the person.
   On Users and roles, select Edit beside their name.
2. Check their roles.
   What that adds up to shows below as you go.
3. Add custom access, if one person needs it.
   Under Custom access for this person: a level on one area, one approval, one kind of money. Each replaces what their roles give for that one thing.
4. Save.

An invitation carries roles too: choose them when you invite someone, and they hold them from the moment they join.

A role limited to their jobs reaches the jobs a person is named on in the job's Team: as project manager, as superintendent, or on the team. A job a project manager adds names them its project manager.

A role limited to their crew reaches the people on the crews they lead and the jobs those crews are dispatched to or have worked lately. Their own records means what they entered, what's about them, and the jobs they work.

• Nobody changes their own roles.
• Only an owner makes someone an owner, or changes or removes one.
• Nobody gives a role, an exception or an invitation more than they have themselves, and nobody changes someone who has more than they do. Editing your own hours, tickets, expenses and incident reports is everyone's, so anyone who manages users gives that. The one exception: an HR manager (HR at Manage, for everyone) can invite someone with any of the company's roles but owner.
• Nobody but an owner approves their own bill or expense.

The Role changes tab lists every role made, changed or archived, everyone's roles, custom access and ownership as they were set, and every invitation: who did it, and when. The Activity tab goes wider: what everyone did with the company's data, from every product.