How access is decided
- 1
Check the company role
Admin, Manager, Supervisor, or Employee defines the user’s broad capability.
- 2
Check project assignment
For non-Admins, the user must normally be actively assigned to the project.
- 3
Check module access
Optional workflows require the related module entitlement and an access state that permits the action. Paid and free optional modules still enforce permissions.
- 4
Check the record
Ownership, status, approval state, project condition, and other record rules can still block the action.
Core role comparison
| Role | Typical access |
|---|---|
| Admin | Company-wide administration, all projects, settings, users, reports, collections, subscriptions/modules, and Admin approvals. |
| Manager | Assigned-project management and permitted operations; Settings → Workspaces for authorized selection and Security for their own account. No company-wide configuration, billing, payroll, or module administration. |
| Supervisor | Assigned-project operational and field review with limited financial visibility; generally no central approval authority. |
| Employee | Own attendance, assigned work, and supported submissions; no company-wide administration. |
Important approval boundaries
- Managers can approve eligible labor only within current project and role rules.
- Managers cannot approve project or company expenses.
- Supervisors and Employees generally submit records rather than approve them.
- Admin approval is still subject to module rules, record state, and other workflow safeguards.
Assignment does not upgrade a role
Optional modules add another gate
Materials & Requisition, Salaries & Payroll, Quotation Builder, Kiosk Attendance, Budget Releases & Liquidation, Office Budget Requests, Custom Branding, and other optional modules require both the appropriate company entitlement and user permission. Selecting Transport or another included workspace does not activate its paid add-ons.
- Read-only access, where supported, preserves history but does not permit new mutations.
- Company Performance & Analytics is Admin-only, reports Projects-based financial activity, and locks on expiry rather than offering a read-only analytics workspace.
- A planned-feature overview is not permission to activate or use an unreleased product.
Important notes
- Use the lowest company role that provides the access the person needs.
- Navigation visibility is not the only protection; server-side checks enforce access independently.
- Project assignment narrows access but does not replace the company role.