Granular permissions

Underneath every role sits the same 11-module permission matrix, at one of four levels each — most “why can’t I see this” tickets trace back to this table, not a bug.

What it is

Eleven modules — Dashboard & reports, Evidence, Properties, Work orders & notes, Scheduling, Repair rates, Contractors, Members & credentials, Settings & integrations, Billing & invoices, Audit & integrity — each at 0 None, 1 View, 2 Edit, or 3 Module admin. Every role has a fixed default level for every module; a per-person override changes one specific module for one specific person without changing their role. For a surveyor or operative, record-bearing modules (Evidence, Properties, Work orders, Scheduling) stay scoped to their own assigned jobs even where an override grants a higher level — an override can widen what they can do, never whose records it applies to, for those four modules specifically.

Before you start

Changing someone else’s permissions needs Module-admin (level 3) access to Members yourself, and you can never grant a level higher than your own effective one. Owner’s permissions are fixed and can never be overridden. Only the owner can change an org-admin’s permissions.

How to do it

1. Open Settings → Members & seats, find the person, and open Granular permissions.
2. Each module shows its role baseline and a per-user override dropdown — leave it on Inherit role to do nothing, or pick an explicit level to override just that module.
3. An override that grants access outside the role’s normal baseline is flagged Outside role baseline before you save, so the change is never accidental.
4. Click Save permissions — it takes effect on their very next check, with no re-invite or sign-out needed.

How it integrates

Every module-gated action on the server re-derives the caller’s effective permission from their role plus their stored overrides at the moment of the call — never from a cached client value — so a change here is immediately live, and a revoked override can never be preserved by a stale session. Overrides are stored sparsely: only genuine deviations from the role’s defaults are written, so a role change automatically re-evaluates what’s left against the new baseline rather than carrying old grants across. This is also the layer the “Who can do this” strip on every other help article describes — a permission string like “workOrders ≥ 2” means Edit-level or above on that one module.

Common problems

• I can’t open Granular permissions for someone at all. You need Module-admin (level 3) access to Members yourself — Edit-level Members access lets you reset credentials, not adjust permissions.
• I gave someone Edit on Evidence but they still can’t see other people’s jobs. That’s by design for a surveyor or operative — Evidence, Properties, Work orders and Scheduling stay scoped to their own assigned records regardless of level; only a genuinely organisation-scoped role sees everything.
• I can’t change my own permissions. Correct — no one can edit their own grant, even an org-admin; ask another authorised administrator.