Appearance
Users and roles
Everyone who signs in is a staff member with one role. A role is a list of permissions. Permissions decide which pages and buttons a person gets, and the server checks them on every request, so hiding a menu item is never the only protection.
Invite a person
Open Admin > Staff and choose "Invite". Enter their email, choose a role and an optional depot. They get an email, branded with your business, with a link to choose a password and join. The link works for 7 days.
Invitations that haven't been accepted are listed above the staff list with who sent them and when they expire. Two icons on each: "Send again" gives a fresh link and the old one stops working, and "Cancel invitation" ends it. Inviting the same email twice doesn't make a second invitation; it updates the role and sends a new link. If the email can't be sent you're told, and "Send again" retries.
Inviting, changing roles, and switching people off need the users.manage permission. Without it the Invite button, the role field and "Can sign in" are not available.
Rules that protect you:
- You can only give someone a role whose permissions you hold yourself, and you can only change or switch off someone whose role you could give. An owner can do everything.
- The business always keeps one active owner. Changing the last owner's role or switching them off is refused.
- You can't switch yourself off.
Add a person without an invitation
"Add person" still creates a login straight away with a temporary password, shown once. Pass it on privately and ask them to change it with "Forgot password". It needs staff.manage, and it holds you to the same rule about roles.
| Field | Notes |
|---|---|
| Name, Email, Mobile | Email is their login |
| Role | One role. Roles are set under Admin > Roles |
| Depot | Optional. Used for the technician's start point on Runs |
| Employment | Employee, Contractor or Casual |
| Licence | Type, number and expiry. A licence close to expiry is flagged on the board |
| Cost per hour ($) | What an hour of their time costs you. Used for job profit and never shown to customers. Only people with the costing manage permission can see or change it |
A technician also needs a work phone enrolled; see business settings. The staff list shows each person's role, licence, and when they last signed in. Filter it by Active, Deactivated or Everyone.
Stop someone signing in
Edit the person and untick "Can sign in". Their history stays. They can't sign in, and if this was the only business they belong to, every sign-in they had (the console and the field app) is ended straight away. Tick it again to bring them back. Everything here is recorded in the audit log.
Roles
Admin > Roles lists roles with how many people hold each and how many permissions they have. Choose a role to see its permission checklist, or "New role" to make one.
- The Owner role is locked and always holds every permission. You can read it but not change it.
- Other roles can be edited or deleted. A role with people assigned can't be deleted.
- You can't give a role a permission you don't hold yourself.
- The checklist lists every permission the server enforces, grouped, each with a plain description. It comes from the server, so a new permission appears there as soon as it exists. Permissions added by plugins appear under Plugins. They're given to the Owner role and the plugin's suggested roles when the plugin is switched on.
- "Reset to default" on Dispatcher, Service Agent and Accounts puts the role back to what the product ships. Your changes to it are lost, so it asks first.
Starter roles in a new business:
| Role | Intended for |
|---|---|
| Owner | Everything |
| Dispatcher | Scheduling, runs, customers, quotes, reports to council, time approval, calls |
| Service Agent | The field: jobs, forms, photos, reports, own time, quotes, AI notes |
| Accounts | Invoices, payments, customers, time and costing read |
A business made with rangefront:tenant:create gets all four from the same list the demo uses, so newer permissions are never missing from it. Businesses created before that was added had newer permissions granted by migrations.
Permission reference
There are 56 core permissions, defined in PermissionCatalog in the code. The tables below use the same groups as the catalogue. Each row says what the server refuses without that permission.
The role editor shows all of them. Developers can read the same list, with descriptions, from GET /api/v1/permissions.
Administration
| Key | Gives |
|---|---|
organizations.manage | Company profile, document branding and logo, quote settings, theme and Branding |
billing.manage | Subscription plan, Stripe Checkout and the customer portal for the product's own subscription. Only relevant to hosted installations |
users.manage | Invite people, resend or cancel invitations, change roles, switch people on or off, and see pending invitations |
staff.read | See the staff list (also used by pickers across the console) |
staff.manage | Add and edit staff records, licences and work details. Changing a role or switching someone off also needs users.manage |
roles.manage | Create and edit roles and their permissions |
branches.manage | Depots, business calendars and vehicles |
integrations.manage | Integrations, outgoing webhooks, and the Email and SMS service settings |
notifications.manage | Message templates and rules, alert rules, reputation campaigns, and the customer message delivery log (the log can also be read with the jobs, reports or invoices read permissions) |
audit.read | Read the audit log |
records.recover | See and restore deleted items |
analytics.read | The monitoring figures behind Today's System checks, and acknowledging or resolving alerts |
mobile.manage_devices | The Work phones register: edit, revoke |
ai.use | Use AI helpers (tidy notes, draft messages, report summaries, quote drafts) and read AI settings |
ai.manage | Change AI settings, set up the phone agent, and read calls |
calls.read | Read the phone agent's calls and transcripts |
booking.manage | The online booking form settings and its requests |
plugins.manage | Switch plugins on or off and edit their settings; read the hook catalogue |
document_templates.manage | Create and edit document and email templates, set the default for each type and the rules that pick one. Owners only by default |
Customers and assets
| Key | Gives |
|---|---|
customers.read | See customers and customer contacts; read data exports |
customers.write | Add, edit and delete customers; issue portal links; send customer messages; run data imports |
messages.read | The Messages inbox |
messages.write | Reply to texts in the inbox |
properties.read | See sites |
properties.write | Add, edit and delete sites |
systems.read | See systems |
systems.write | Add, edit and delete systems; bind a QR tag |
Operations
| Key | Gives |
|---|---|
jobs.read | See jobs, the schedule, the activity feed and staff positions |
jobs.write | Create, edit and delete jobs, change status, schedule |
jobs.dispatch | Schedule and move bookings, dispatch, set office notes, set time aside. Same screens as jobs.write for these actions |
jobs.complete | Complete a job and move its status from the field |
recurring.read | See recurring plans and preview them |
recurring.manage | Create, edit, pause and generate from recurring plans |
routes.plan | Route plans, optimisation and stop order; read disposal sites and vehicles |
routes.publish | Publish a route plan |
team.read | Read team chat |
team.write | Post team messages |
Field compliance
| Key | Gives |
|---|---|
inspections.perform | Complete field forms, log defects, and push field work from the app |
inspections.approve | Review inspections and edit or delete defects |
templates.manage | Service forms (the checklists) |
reports.generate | Generate, issue and send reports; write owner summaries; render PDFs |
reports.submit_to_council | Submit reports to council; councils, council profiles and compliance packs |
reports.supersede | Replace or delete reports |
photos.read | View photos and files |
photos.write | Upload photos and files |
mobile.enroll_devices | Enrol a phone for the field app |
Accounts
| Key | Gives |
|---|---|
invoices.read | See invoices, customer statements and adjustments |
invoices.write | Create and edit draft invoices, send and PDF them, price books, customer prices, billing batches, send pay links, resend messages |
payments.record | Record a payment by hand, and send a pay link |
quotes.read | See quotes |
quotes.write | Draft and edit quotes |
quotes.send | Send, accept, reopen and convert quotes |
payments.manage | Connect Stripe, and set card surcharge, reminders and statements |
Time and costs
| Key | Gives |
|---|---|
time.own | Your own time entries, shift clock and timesheet |
time.manage | Everyone's time, approvals and the time settings |
costing.read | Job costs, the Profit page and cost settings, read only |
costing.manage | Change cost rates, add costs and materials, manage disposal sites |
Several screens accept any one of a set of permissions. For example, the Schedule's drag-and-drop works with jobs.dispatch or jobs.write. The Timesheets and Profit menu items appear only if you hold one of their permissions.
Adding your own permissions
Plugins can add permissions. Keys begin with the plugin's name, such as fuel_levy.manage. They show in the role editor under Plugins once the plugin is on for your business. See plugins and developer/extending.