Permissions reference
Every permission, and which built-in roles have it. Generated from PERMISSION_CATALOGUE and ROLE_DEFAULTS in packages/shared/src/permissions.ts. The Client role has none. Platform permissions belong to superadmins and can't be granted to tenant roles.
How to assign permissions: Roles and permissions.
| Group | Code | Label | Tenant admin | Staff | Viewer |
|---|---|---|---|---|---|
| Platform | platform.tenants.read |
View tenants | – | ||
| Platform | platform.tenants.write |
Manage tenants | – | ||
| Platform | platform.users.manage |
Manage platform users | – | ||
| Platform | platform.roles.manage |
Manage platform roles | – | ||
| Tenant access | tenant.users.read |
View tenant users | ✓ | ✓ | ✓ |
| Tenant access | tenant.users.invite |
Invite tenant users | ✓ | ||
| Tenant access | tenant.users.write |
Manage tenant users | ✓ | ||
| Tenant access | tenant.roles.read |
View roles and permissions | ✓ | ✓ | ✓ |
| Tenant access | tenant.roles.write |
Manage roles and permissions | ✓ | ||
| Tenant access | tenant.sites.read |
View sites | ✓ | ✓ | ✓ |
| Tenant access | tenant.sites.write |
Manage sites | ✓ | ✓ | |
| Dashboard | dashboard.read |
View dashboard | ✓ | ✓ | ✓ |
| Operations | clients.read |
View clients | ✓ | ✓ | ✓ |
| Operations | clients.write |
Manage clients | ✓ | ✓ | |
| Operations | cases.read |
View cases | ✓ | ✓ | ✓ |
| Operations | cases.write |
Manage cases | ✓ | ✓ | |
| Operations | appointments.read |
View appointments | ✓ | ✓ | ✓ |
| Operations | appointments.write |
Manage appointments | ✓ | ✓ | |
| Operations | events.read |
View events | ✓ | ✓ | ✓ |
| Operations | events.write |
Manage events | ✓ | ✓ | |
| Operations | public-submissions.read |
View public submissions | ✓ | ✓ | ✓ |
| Operations | public-submissions.write |
Review public submissions | ✓ | ✓ | |
| Reports | reports.read |
View reports | ✓ | ||
| Reports | reports.write |
Manage reports | ✓ | ||
| Reports | reports.create |
Create reports | ✓ | ||
| Reports | reports.edit.own |
Edit own reports | ✓ | ||
| Reports | reports.edit.all |
Edit all reports | ✓ | ||
| Reports | reports.delete |
Delete reports | ✓ | ||
| Reports | reports.export |
Export reports | ✓ | ||
| Reports | reports.email |
Email reports | ✓ | ||
| Reports | reports.schedule |
Schedule reports | ✓ | ||
| Reports | reports.sensitive.read |
View sensitive report fields | ✓ | ||
| Reports | reports.financial.read |
View financial report fields | ✓ | ||
| Workforce & jobs | staff.read |
View staff | ✓ | ✓ | ✓ |
| Workforce & jobs | staff.write |
Manage staff | ✓ | ||
| Workforce & jobs | employers.read |
View employers | ✓ | ✓ | ✓ |
| Workforce & jobs | employers.write |
Manage employers | ✓ | ✓ | |
| Workforce & jobs | jobs.read |
View jobs | ✓ | ✓ | ✓ |
| Workforce & jobs | jobs.write |
Manage jobs | ✓ | ✓ | |
| Data | files.read |
View files | ✓ | ✓ | ✓ |
| Data | files.write |
Upload files | ✓ | ✓ | |
| Data | imports.read |
View imports | ✓ | ✓ | ✓ |
| Data | imports.write |
Run imports | ✓ | ✓ | |
| Configuration | settings.read |
View settings | ✓ | ✓ | ✓ |
| Configuration | settings.write |
Manage settings | ✓ | ||
| Configuration | notifications.read |
View notifications | ✓ | ✓ | ✓ |
| Configuration | notifications.write |
Manage notifications | ✓ | ✓ | |
| Administration | admin.accounts.read |
View accounts | ✓ | ||
| Administration | admin.accounts.write |
Manage accounts | ✓ | ||
| Administration | audit.view |
View audit logs | ✓ | ||
| Administration | feedback.write |
Submit feedback | ✓ | ✓ |
What each permission unlocks
| Permission | Unlocks |
|---|---|
dashboard.read |
Dashboard |
clients.read / .write |
Client list and records; add/edit clients, notes, interactions, follow-ups on clients, client forms |
cases.read / .write |
Cases; case notes, documents, case forms, follow-ups on cases |
appointments.read / .write |
Scheduler, appointment pages; create, move, edit, cancel |
events.read / .write |
Events; attendees, check-in |
public-submissions.read / .write |
Portal submissions; convert and reject |
staff.read / .write |
Staff list and profiles; edit profiles, availability, reassign workload |
employers.read / .write |
Employers, contacts, interactions |
jobs.read / .write |
Job Portal, postings, applications |
files.read / .write |
Download / upload and delete documents |
imports.read / .write |
File Uploads page and history / run imports, manage templates |
reports.* |
See Custom reports for the breakdown |
settings.read / .write |
Settings sections (general, definitions, scheduling, forms, classification, documents, integrations, notifications) |
notifications.read / .write |
Bell and notifications page |
tenant.users.read / .write, admin.accounts.read / .write |
Admin → Users |
tenant.users.invite |
Send invitations |
tenant.roles.read / .write |
Settings → Roles & permissions |
tenant.sites.read / .write |
Settings → Sites |
audit.view |
Admin → Audit Logs; activity timelines on records |
feedback.write |
Sidebar feedback box |