Roles and permissions

The four roles

Roles are per-organization. The same person can be an Owner in their own business and an Employee somewhere they pick up weekend shifts; the two never mix.

Role	Reaches
Owner	Everything, plus the two things nobody else gets: billing and organization settings. Exactly one per organization, and it is transferable.
Admin	Everything a Manager can do, plus organization-wide destructive actions such as archiving. No billing.
Manager	Builds and publishes schedules, invites and manages people, approves time-off and swaps, edits positions, locations, skills and compliance rules, reads insights and the audit log.
Employee	Their own week, availability, time-off requests, swap requests, the open-shift board, the time clock, and their own profile. Nothing about anyone else.

"Manager and up" in the rest of these docs means Manager, Admin or Owner.

How it is enforced

Permission is not a property of a screen. Every operation in the product declares the level it needs — public, member, manager, admin or owner — and that check runs before the operation does, on the server.

The consequence worth knowing: hiding a button is a convenience, not the security boundary. The same check applies whether the request came from the dashboard, the mobile app, the AI agent, or a direct API call with an integration key. There is no path that skips it.

Operations that affect one specific person — cancelling your own time-off request, editing your own display name — additionally verify that the row belongs to you, with a manager override. So an Employee can cancel their own request and not a colleague's.

What an Employee can and cannot see

Can see:

Their published shifts, past and future.
Who else is on shift with them, and in which position.
Open shifts they are eligible to claim.
Swap offers directed at them, and the swaps they started.
Their own availability, time-off history and clock records.

Cannot see:

Anyone's pay rate, including their own if you have not set it.
Manager notes — performance, coaching, incident records.
Unpublished draft weeks.
Insights, analytics, the audit log, billing, settings.

A manager is also somebody's employee. The assistant has a perspective switch for exactly this: a Manager can hold a conversation as themselves-the-employee, with the employee tool set and prompt. Role stays the ceiling — an Employee cannot switch up.

Changing roles and ownership

Promote or demote from Team. Changes take effect immediately, and are written to the audit log with who made them.

Ownership transfer is its own explicit action rather than a role edit, because it moves billing with it. The receiving person must already be an active member of the organization.

To remove somebody, change their status rather than deleting them: Inactive, Suspended or Terminated all keep their history — past shifts, hours worked, records — intact and stop them being scheduled. Deleting people is how you lose your own payroll evidence.

Common questions

Can I have more than one Owner?

No — one per organization, by design, so billing and the final say over the tenant always have an unambiguous holder. Give the second person Admin, which is everything except billing and settings.

Do inactive members still count against my plan limits?

No. The per-location employee cap counts active members, so seasonal staff you set to Inactive between seasons do not consume a slot.