Roles and permissions

A role is a named bundle of permissions you assign to a team member on a property. The system ships eight built-in roles that cover most teams, and you can edit them or create your own. This page explains how access works, what every built-in role can do out of the box, and what each permission in the role editor actually controls — so you can set up your team with confidence.

How access works

There are two layers:

1. Workspace admin — when you invite a member you choose whether they're a workspace Admin or a regular Member. Workspace admins see and can do everything in the workspace, on every property, regardless of roles. This is the unconditional level — use it sparingly.
2. Property roles — regular members are assigned to specific properties, and each assignment carries one or more roles. A member only sees the properties they're assigned to, with the access their roles grant there.

A role is simply a set of permissions. When a member holds several roles on a property, they get the union of all of them. The special permission full_access (held by the built-in Admin role) is an override that passes every check.

Two more rules worth knowing:

• Manage implies view. Anyone who can record payments can also see the Payments page — you never need to tick both. Likewise view_financials and verify_payments grant visibility across all the money pages.
• Same rules on mobile. The mobile app enforces these roles and permissions identically — it hides tabs, menus, and buttons a member can't use (checking per property), and shows an "Access denied" message for anything they reach but aren't allowed to open. A role change on the web applies to their mobile app too.
• Approvals follow workflows, not permissions. Verification and approval steps (payments, expenses, deposits, maintenance review, lease sign-off) are configured in workflows, and each step is assigned to a role. To act on a step, a member must hold that step's role on that property. So if your custom "Finance Lead" role should approve expenses, assign it to the expense workflow's gate step — ticking extra permission boxes won't do it.

The built-in roles

The default workflows are built around these roles — for example the maintenance default runs Operator (does the work) → Property Manager (reviews) → Accountant (confirms the cost). If you rename roles or build custom ones, the workflow editor lets you point each step at whichever role should act.

What each permission does

These are the groups you see in Settings → Configuration → Roles, in the same order.

Administration

• full_access — the admin override: passes every permission check in the system. This is what defines the Admin role; granting it to another role makes that role equivalent to Admin on assigned properties.
• manage_settings, manage_members, manage_workflows — reserved for delegated administration. Today, workspace settings, member management, and the workflow editor are available to workspace admins; these toggles exist so that delegation can be granted per-role in a future release.
• manage_workflow_attachments — manage the files + captured values on any workflow step after the fact: delete or replace an attachment, delete a previous version, and edit captured field values (e.g. fix a payment receipt or amount on the payment's Workflow documents card). Held by Admin only by default. See Workflows and approvals.
• manage_accounting_integration — connect the workspace to the accounting system (Odoo) and maintain the mappings: expense category → account, payment method → journal, VAT rate → tax code. Accountants hold this by default, since they're the ones who know the chart of accounts.

Properties

• manage_properties — create and edit properties. Workspace admins can always do this.
• manage_units — add and edit units on assigned properties.

Leases

• manage_leases — create, edit, and submit lease offers, and manage the documents on a contract (the Workflow documents slots). This is the working permission of the Lease Manager.
• approve_leases — act on lease-offer approval steps (the manager reviews in the offer workflow).

Contracts

• view_contracts — read-only access to the Contracts pages. Anyone holding manage_leases, approve_leases, or create_contracts gets contract visibility automatically.
• create_contracts — grants read visibility of contracts (kept for compatibility). Adding a direct contract is now controlled by its own permission, add_direct_contract (below).
• add_direct_contract — add a direct contract: record a pre-existing contract directly, bypassing the lease-offer approval chain (the Contracts-page Add direct contract button, the manual entry screen, and Ejar PDF import — web and mobile). Held by no role by default — Admin acts through full_access; grant it deliberately in the role editor to anyone who needs to add existing contracts. Members without it don't see the button and can't open the entry screens.

Maintenance

• complete_maintenance — mark assigned maintenance work as done (the Operator's permission).
• review_maintenance — review completed work and close or reject it (manager roles).
• manage_maintenance — reserved. Today, assigning and managing maintenance requests follows the built-in manager roles and the maintenance workflow's step assignments; this toggle does not yet grant maintenance management to custom roles.

Recurring tasks

• manage_recurring_tasks — create, edit, archive, and reassign recurring task templates (scheduled cleaning, inspections, filter changes). Held by General Manager, Property Manager, and Accountant by default.

Payments, Receivables, Expenses, Deposits

Each money module has a view / manage pair, so you can give someone visibility without the ability to touch the numbers:

• view_payments, view_receivables, view_expenses, view_deposits — read-only access to that page.
• manage_payments, manage_expenses, manage_deposits — record and edit entries in that module. Verification of what's recorded is handled by the matching workflow, not by another permission.
• manage_receivables — create and adjust receivables (amounts owed), including rent schedule adjustments and write-offs.
• manage_payment_discounts — apply or remove negotiated discounts on a contract's scheduled payments (single or bulk, from the contract page). Held by no role by default — Admin acts through full_access; grant it deliberately to whoever negotiates tenant relief. See Leases and contracts.
• verify_payments — verify recorded rent payments (the Treasurer's sign-off). Also grants read access across the money pages, since verifying requires context.

Financial reporting

• view_financials — financial oversight: unlocks financial reporting and grants read access to every money page in one tick. The natural permission for a GM, treasurer, or external auditor.

Contacts

• manage_contacts — add and edit contacts (tenants, owners, vendors) and see leads.

View access

• view_dashboard — the dashboard with portfolio KPIs. The Shareholder role is exactly this and nothing else.
• view_reports — the Reports section.

Billing

Billing (your subscription, plan, payment methods, invoices) is account-level, not property-level: the account owner always has it, workspace admins have it by default, and the owner can grant or revoke billing access per user from the billing settings. Property roles don't control billing — the checkboxes in this group are reserved.

Rank (seniority)

Each role carries a rank from 0–100. It expresses seniority: Admin 100, General Manager 80, the working manager roles 60, Operator 30, Shareholder 10. A few built-in behaviors compare seniority (for example, maintenance management requires Property Manager seniority or above), so when you create a custom role, give it a rank near the built-in role it most resembles — a custom "Senior Property Manager" should sit at 60–79, not 10.

Custom roles

Open Settings → Configuration → Roles. You can edit any built-in role except Admin, or create a new one: just give it a name (English and/or Arabic — you don't have to fill both), set a rank and color, tick its permissions, and save. There's no "key" to invent — the system generates a unique internal identifier for you, and role names never clash between workspaces. Custom roles appear everywhere built-in roles do — member assignment and workflow step assignment included.

[!tip] Before creating a custom role, check whether a built-in role is just one or two permissions away — editing the built-in is usually simpler than maintaining a parallel role. Reserve custom roles for genuinely different jobs, e.g. an "Auditor" with only view_financials + view_contracts + view_dashboard.

Permission changes can take a few minutes to reach members who are already signed in.

[!warning] If a workflow step is assigned to a role that no member holds on the property, items will stall at that step. After restructuring roles, double-check your workflow step assignments and make sure every gate role has at least one member.

Setting up a new account — three common shapes

• Solo manager — do nothing. As workspace admin you already have full access; roles only matter once you invite people.
• Small team (2–4 people) — invite your bookkeeper as Accountant and your field tech as Operator, assigning each only to the properties they work on. Keep approvals with yourself (admin passes every workflow gate).
• Full team — add Property Manager per property, a General Manager across all properties, and a Treasurer for payment sign-off. The default workflows already route through these roles, so approvals start flowing with no workflow editing.

And the most useful rule of thumb: when someone needs access to one specific property, don't make them a workspace admin — assign them a role on that property only. They'll see that property and nothing else.

Related

• Workspaces
• Workflows and approvals
• Money
• Odoo accounting integration
• Getting started