Prospeno — Project Profit Tracker
Sign In
Administration
Included

Users & Access

Create and manage company users, assign the correct role, control account access, and connect employees to rates and project assignments without deleting their historical records.

Workspace access

  • Users & Access controls who can sign in to the company workspace and which company role they receive.

Preserved history

  • Disabling a user blocks future access while attendance, expenses, payroll, assignments, and audit references remain intact.

Separate workforce setup

  • Creating a user does not automatically complete rates, payroll eligibility, or project assignments — those are configured separately.

Overview

Users & Access controls who can enter the company workspace and what general role they receive.

A user account may also have related workforce information such as employee rate, pay type, project assignment, attendance records, expenses, payroll history, approvals, and audit history.

Disabling access must not delete those historical business records.

Who can use it

  • Role

    Admin

    View users

    Company-wide

    Create users

    Yes

    Edit users

    Yes

    Disable/reactivate

    Disable yes; reactivate not exposed in current UI

    Reset access

    Yes

  • Role

    Manager

    View users

    Limited read-only team view

    Create users

    No

    Edit users

    No

    Disable/reactivate

    No

    Reset access

    No

  • Role

    Supervisor

    View users

    No administration

    Create users

    No

    Edit users

    No

    Disable/reactivate

    No

    Reset access

    No

  • Role

    Employee

    View users

    Own account only

    Create users

    No

    Edit users

    No

    Disable/reactivate

    No

    Reset access

    Own password flow only

  • Role

    Super Admin

    View users

    Platform-level support only

    Create users

    According to platform tools

    Edit users

    According to platform tools

    Disable/reactivate

    According to platform tools

    Reset access

    According to platform tools

Permission matrix

Admin-only access changes

Only authorized Admin users should create, change roles, disable, or reset access for another company user.

The Team & Rates page at /employees is available to Admins for full management and to Managers as a read-only team view. Supervisors and Employees are redirected away from this page.

User-management workflow

  1. 1

    Open Users

    Open the company user-management page at /employees (Team & Rates in the current UI title).

  2. 2

    Add the person

    Select + Add Employee and enter the required identity and access information. Email is required and can only be set during creation.

  3. 3

    Assign the role

    Choose Admin, Manager, Supervisor, or Employee — use the lowest role that provides the access the person needs.

  4. 4

    Complete workforce setup

    Add daily or other rates, pay type, payroll group, and project assignments separately when required.

  5. 5

    Maintain access

    Update account details, reset access, or disable the user according to current rules. Physical deletion is not supported.

User details

List and profile fields visible to Admins

Fields shown on the Team & Rates table, edit drawer, and Employee Profile drawer.

Identity and access

  • Full Name
  • Email
  • Mobile
  • Role
  • Position
  • Status (Active / Inactive)

Workforce and payroll (same page)

  • Pay Type
  • Payroll Group
  • Daily Rate
  • Hourly Rate
  • Monthly Salary
  • Overtime Hourly Rate
  • Default Allowance
  • Per Diem Rate
  • Require geofence for check-in/out

Stored but not prominently labeled in the list

  • force_password_change (enforced on next sign-in after Admin password reset or new user creation)
  • created_at and updated_at on the company profile record
  • created_by for audit attribution

Manager read-only view

  • Managers can open /employees as a read-only team view for employees on projects they manage.
  • Managers do not see Admin actions such as Add Employee, Edit, Disable, or Reset Password.
  • Daily Rate visibility follows the same rate-view rules as other employee surfaces.

Creating or inviting a user

Current creation flow (Admin only)

Users are created directly by a company Admin — not through a customer-facing email invitation.

Required fields

  • Full Name
  • Email
  • Role

Optional fields on create

  • Position
  • Mobile
  • Pay Type
  • Payroll Group
  • Labor and payroll rates
  • Require geofence for check-in/out

Resulting user status

  • Company profile is created with is_active: true
  • Auth identity is created with email_confirm: true
  • force_password_change: true is set on the profile

What the Admin sees

  • Success banner with a temporary login password shown once
  • Copy-password control in the create drawer
  • Warning that the password is shown once and must be changed after sign-in

What the new user receives

  • No automatic email from Prospeno with the temporary password
  • Credentials must be shared securely by the Admin

First sign-in behavior

  • User signs in with company workspace URL, email, and temporary password
  • force_password_change requires a new password before continuing

Error behavior

  • Validation errors for missing name, email, or role
  • Duplicate or invalid email returns an error from auth user creation
  • Employee limit reached blocks creation with an upgrade or deactivate prompt

There is no Pending or Invited company-user status in the current implementation.

Email invitation and self-serve invite acceptance are not the active customer flow.

Temporary password and first sign-in

On create or Admin password reset, Prospeno generates a temporary password server-side.

The password is displayed once to the Admin in the web UI and is not emailed automatically.

The password is not stored in a retrievable form for later display.

force_password_change is set on the company profile so the user must choose a new password after a successful temporary-password sign-in.

Share credentials securely

  • Never place temporary passwords in public documents, project notes, or shared group chats.
  • Deliver credentials through a private channel and instruct the user to change the password immediately after sign-in.

User statuses

  • Status

    Active

    Meaning

    User may sign in according to role, assignment, and company subscription state

    Access effect

    Access allowed when other checks pass

  • Status

    Inactive

    Meaning

    User account remains recorded but company access is blocked

    Access effect

    Access denied — Account is disabled

  • Status

    Password change required

    Meaning

    force_password_change is true after create or Admin reset

    Access effect

    Restricted until the user sets a new password

Status table

The list filter uses Active and Inactive labels mapped to is_active on the company profile.

Auth identity and company profile status are related but enforced separately: inactive company users are blocked even when an auth record still exists.

There is no separate Pending, Invited, or Unverified customer status on the Users page in the current UI.

Disable vs delete

Disable user

  • Blocks future company access
  • Preserves the user profile
  • Preserves project assignment history
  • Preserves attendance
  • Preserves expenses
  • Preserves payroll records
  • Preserves audit references
  • May allow later reactivation when supported

Delete user

  • Company users are disabled rather than physically deleted so historical business and audit records remain intact.
  • There is no company Admin delete-user action in the current UI.
  • Admins cannot disable their own account.
  • Disabling the last active Admin is blocked when it would leave the company without an Admin.

Roles

Admin

  • Company-wide administration, settings, financial controls, users, modules, and approved sensitive workflows

Manager

  • Project and operational access according to assignment and implemented permissions
  • Read-only team view on /employees without user-administration actions

Supervisor

  • Assigned operational access with restricted financial and administrative visibility

Employee

  • Own operational workflows such as attendance, assigned work, and supported submissions

Role determines general capability. Project Assignment determines which projects a non-Admin can access. Module entitlement determines whether a paid workflow is available.

See the Roles & Permissions guide for the full permission matrix.

User record vs Team & Rates

Users & Access

  • Sign-in identity
  • Company membership
  • Role
  • Active status
  • Password and access state

Team & Rates

  • Pay type
  • Daily, hourly, or monthly rate
  • Payroll eligibility fields
  • Labor-cost basis
  • Geofence requirement and other workforce settings on the same page

Rates are separate from account creation

Creating a user does not necessarily complete their rate or payroll setup.

The /employees contextual help opens this Users & Access guide because access control is the primary concern; labor rates remain documented in the Team & Rates guide.

User vs Project Assignment

User role

  • Defines general company capability across the workspace

Project assignment

  • Defines which projects a Manager, Supervisor, Employee, or labor personnel may access or appear in
  • Creating a user does not automatically assign every project.
  • Removing an assignment does not disable the user.
  • Disabling the user may block access while preserving assignment history.
  • Assignments do not automatically create attendance or project labor.

User limits

Active users count toward the plan limit

  • Plan enforcement counts active company users (is_active: true) against employee_limit.
  • Inactive users do not free a slot for new creation until they are deactivated — only active users are counted.
  • When the limit is reached, creation fails with an Employee limit reached message and prompts to upgrade or deactivate users.
  • Subscription and Settings surfaces show active user usage against the plan limit.
  • Upgrading increases the allowed active-user capacity according to the target plan catalog row.
  • Downgrade or expiry may restrict new activity without deleting existing user records already above a lower limit.

Resetting access

Admin actions on active users

Reset Password

  • Available from the row actions menu on /employees
  • Generates a new temporary password and sets force_password_change: true
  • Displays the temporary password once to the Admin — not emailed

Disable

  • Sets is_active: false and blocks future sign-in
  • Preserves historical records

User self-service

  • Users can use supported forgot-password and profile password flows for their own account.
  • Email PIN 2FA setup and reset are documented in the Security guide.

Disabled-user behavior

  • Inactive users cannot pass active-account checks during sign-in or API access.
  • Reset Password and Disable actions are hidden for inactive users in the current UI.

Prospeno support

  • Platform Super Admin tools are for internal support only and are not part of the company Admin workspace.

Email changes

Email is required when creating a user but cannot be changed from the Edit Employee drawer in the current UI.

Company Admins cannot change another user’s email through the supported employee update API.

Users should use their own profile and supported account flows for self-service email or password changes where available.

Duplicate emails are rejected during auth user creation.

Reactivation

Disable sets is_active: false on the company profile.

The current Admin UI and employee API expose disable but not a self-serve re-enable action.

Prior role, assignments, and historical records remain on the profile while inactive.

Reactivating an inactive user would count again toward the active user plan limit when supported.

A password reset may be required after a long inactive period depending on auth state.

Contact Prospeno support if a disabled account must be restored and the UI does not offer re-enable.

Secondary details

Search and filtering
  • Search employees... matches name, email, role, position, and mobile client-side on the loaded page.
  • Status filter: All, Active, or Inactive.
  • Server-side pagination applies when the company has more employees than the page limit.
User profile and account identity

Each company user has a company profile row in users tied to a Supabase auth identity for sign-in.

Disabling access updates the company profile; historical business records remain linked to that profile id.

Audit history

Admin updates set updated_by so audit triggers can attribute changes.

Created date is stored on the profile; detailed audit views depend on the surface displaying them.

Project access

Project Assignments control project visibility for non-Admin roles.

See the Project Assignments guide for staffing workflows.

Payroll eligibility

Rates, pay type, and payroll group on /employees support labor cost and payroll modules but do not replace user access control.

Salaries & Payroll remains a separate module guide.

Company or subscription inactivity

An Active user may still be blocked when company subscription, maintenance, or workspace entitlement prevents access.

Review Company Subscription and Company Settings when the whole workspace is restricted.

Support-required cases
  • Restoring a disabled user when no re-enable control is available
  • Auth identity conflicts or orphaned accounts after failed creation cleanup
  • Platform Super Admin interventions outside the company Admin workspace

Security practices

  • Use a unique email per user
  • Assign the lowest necessary role
  • Disable access promptly when someone leaves
  • Never share accounts
  • Never share passwords or one-time codes
  • Review Admin access regularly
  • Use the supported password-reset flow

Important limitations

  • User creation is subject to the company plan active-user limit.
  • A user role does not automatically assign projects.
  • Project Assignment does not replace the user role.
  • User creation does not automatically configure employee rates.
  • Disabling a user preserves historical records.
  • Physical user deletion is unsupported for company Admins.
  • Inactive users cannot sign in according to current enforcement.
  • Password and verification actions depend on the supported auth flow.
  • Managers and Supervisors do not receive Admin settings access unless explicitly implemented.
  • Module entitlement remains separate from user access.
  • This guide does not replace the full Roles & Permissions or Security guides.

Where to find help

Use the ? button in the web application for the current page guide, Getting Started, Module Guides, and Contact Support.

Related links

Jump to the module, marketplace, or broader help resources.

Users & Access Guide — Prospeno Docs