Roles and permissions
Roles are bundles of permissions you name yourself. Every switch grants — none of them takes anything away — and owners sit outside the whole system.
Once a firm has more than a couple of people, "can everyone see the invoices" stops being hypothetical. Roles are the answer: a named bundle of permissions you hand to people.
Making one
- Open Roles and create one. Give it a Role name and a Colour.
- On Permissions, switch on what this role should be able to do. Search permissions is faster than scrolling once the list is long.
- Add people to put your colleagues in it.
Permissions are grouped the way a firm thinks: Clients, Money, Work and Firm — things like Add clients, See invoices and payments and Invite teammates.
Every switch adds — none of them subtracts
This is the part to get right, and the app states it plainly: Turning something on here gives it to everyone with this role, on top of what they already have. Turning it off never takes away something they get another way.
So a role cannot be used to restrict somebody. If a person holds two roles and one of them grants access to money, switching it off in the other changes nothing at all. To take something away, remove it everywhere they get it.
Owners are outside all of this
An owner can do everything, and that comes from being the owner rather than from any role: Owners can do everything, and that comes from being the owner — not from this role. There's nothing to switch here, because switching it off wouldn't take anything away.
Which is why the permission switches are absent on an owner rather than present and ignored. A switch that did nothing would be worse than no switch.
What new people get
One role is marked Default and is what somebody arrives with. Set it with Use this one.
Choose it deliberately. A default role that grants nothing means every new colleague arrives unable to add a client or see an invoice, and their first hour is spent asking you why — the app warns about exactly this: This role grants nothing, so anyone who joins arrives unable to add clients or see invoices. Set what they should get on the Permissions tab.
Roles decide what someone can DO. Who they can see is a separate question — see owners and members.