Roles and permissions — who can access what in the web dashboard

Updated 19 Oct 2026 16 min Owner / manager Web app

The Management → Roles and permissions section defines what each employee can do in the web dashboard: which sections they can open, which actions they can perform and which data they can see — rates, payroll, personal details, health records. Most permissions can be limited to locations: for example, a manager sees the schedule and timesheet of their own locations only, while an accountant sees payroll for the whole chain.

How permissions work

A permission is a single capability: opening a section, performing an action or seeing certain data. Permissions are grouped by section: “Analytics and audits”, “HACCP”, “Shift schedule”, “Rates and payroll” and so on. The full list is at the end of this article.
A role is a set of permissions ticked with checkboxes, for example “Accountant” or “HR”. Roles are assigned to employees, and the permissions from all of an employee's roles add up.
Personal permissions — on top of roles, you can grant a specific employee an individual permission or deny it.
A company administrator can do everything at all locations. Roles and personal permissions are not configured for them — to restrict an administrator, clear their administrator mark.

An employee without permissions sees only their own tasks, tests and schedule. Some rights work without roles because of a person's position: a department head sees their department, the author and assignee see their task, and access to instruction folders is set in the instructions themselves.

The Roles and permissions section is available to the administrator and to employees with the “Assigning roles and permissions to employees” or “Access log” permission. It has three tabs: Roles, Employees and Log.

Where a permission applies: locations

For a permission marked with locations you can choose where it applies:

All locations — across the whole chain;
Own locations — where the employee works or manages, plus the location of their shift today;
Locations they manage — locations and regions where the employee is assigned as manager (in “Locations and regions”);
Selected locations — a specific list of locations.

If the same permission comes from several roles with different locations, they are combined. Permissions without a location mark apply to the whole company — they can only be given or not given.

Permissions with an eye icon cover sensitive data: personal details, payroll, rates, health records, proctoring recordings, shopper payouts. Every view of such data is recorded in the access log.

System roles “All employees” and “Location manager”

Every company has two roles that can be edited but not deleted:

All employees — every employee has it. By default: “Analytics”, “Audit log and reports”, “Audit export (Excel, PDF)”, “Audit planner”, “All location tasks”, “HACCP: logs and deviations” and “Filling in HACCP logs” — on own locations.
Location manager — location and region managers have it. By default: “Shift schedule: view”, “Building the schedule”, “Publishing the schedule”, “Clock-in and clock-out”, “Timesheet”, “Employee KPI”, “Employee requests”, “Location settings”, “Handling deviations” and “Confirming task completion” — on the locations they manage.

These defaults repeat what employees and managers could do before roles appeared. If, for example, regular employees don't need analytics, untick it in the “All employees” role.

Ready-made roles: Accountant, HR, HACCP technologist, Auditor

When the section is opened for the first time, the company gets preset roles. You can rename, change or delete them:

Accountant — schedule and timesheet, rates, payroll with approval and payment, payroll export and payslips, employee list.
HR — employees with contacts, adding and editing, employee sign-in, positions, HR card, personal details and documents, hiring, transfer and dismissal, vacations and sick leave, hiring and dismissal templates, employee requests.
HACCP technologist — all HACCP permissions: logs, deviations (including critical ones), health records, registries, plan and settings.
Auditor — analytics and auditor ranking, audit log and export, checklists, planner, all location tasks and confirming their completion.

How to create a role and assign it

Open the section. Go to Management → Roles and permissions, tab Roles.
Create a role. Click New role, enter a name and briefly describe who it is for. To start from an existing role, open it and click Copy.
Tick the permissions. Tick the permissions you need. For a permission marked with locations, choose where it applies. Permissions that the selected one depends on are added automatically, and when you untick a permission, the ones depending on it are removed too. Use Find a permission… to search by name.
Save. Click Create role (for an existing role — Save).
Assign it to employees. In the Who has the role block, click Assign to employees and choose people. Permissions are updated immediately.

To delete a role, click Delete — it is removed from all employees, and their permissions are reduced immediately.

An employee's personal permissions: grant or deny

On the Employees tab, select a person — their roles and permissions appear on the right. The same settings are on the Access tab of the employee card.

Tick or untick the employee's roles.
On the Personal permissions tab, for each permission choose: By roles — as in the employee's roles; Grant — add it personally, with a choice of locations; Deny — remove it even if a role grants it.
Click Save.

A denial overrides any role: for example, you can give an employee the “HR” role but close “Personal details” to them.

Effective permissions and history

The Effective permissions block shows what the employee can actually do, at which locations, and where each permission comes from — which role or personally. If there are unsaved changes, the result is recalculated after saving. The History tab lists all changes to this employee's permissions: who changed what and when; it is visible to employees with the “Access log” permission.

Who can hand out permissions

The administrator configures everything and appoints administrators. Only an administrator can make an employee an administrator or remove that mark.
An employee with the “Assigning roles and permissions to employees” permission assigns roles and personal permissions, but can grant or deny only the permissions they have themselves, and only at their own locations. They cannot change administrators or themselves.
To create and edit roles, the “Editing roles” permission is also needed — within the same limits.

Access log

The Log tab (the “Access log” permission) shows:

changes to permissions and roles: permission granted, denied or removed, locations changed, role assigned or removed, role created, changed or deleted;
making and removing administrators, opening and closing web dashboard access;
views of sensitive data: the employee card and personal details, rates and payroll, documents, health records, proctoring recordings, mystery shopper payouts;
exports (Excel, PDF, payslips);
denials — attempts to open something without permission.

Filters: employee, event type (Permission changes, Views, Exports, Denials), permission and dates. Records are kept for 12 months. Repeated views of the same data within a few minutes are merged into one record.

What happened to the former marks

The “schedule manager”, “payroll access”, “HACCP manager” and “test editor” marks are no longer set in the employee window or in section settings. Those who had them received the corresponding personal permissions at all locations — in the log these entries are “Previous permissions migrated”. From now on these permissions are configured only in Roles and permissions.

Permissions in the AI assistant and the mobile app

The AI assistant in the web dashboard works within the employee's permissions: it shows and changes only what the employee could do themselves. Roles and permissions are configured in the web dashboard; in the mobile app some screens still only check whether the employee is an administrator.

All permissions by section

“By location” — the permission can be limited to locations. “Views logged” — every view of this data is recorded in the access log.

Home and AI Control

Permission	What it gives	By location	Views logged
AI Control settings and service signals	Refresh the report, mute signals, signals about photo fraud and lenient auditors, schedule an audit from a signal	—	—
Company-wide dashboards	Publish dashboards to the whole company and edit shared ones	—	—

Analytics and audits

Permission	What it gives	By location	Views logged
Analytics	Analytics sections and dashboard metrics	yes	—
Auditor ranking	Auditors with strictness scores	yes	—
Audit log and reports	The “Audit log” section, the “Audits” screen and audit reports	yes	—
Audit export (Excel, PDF)	Excel and PDF of audits; without it, the online report opens instead of the PDF	yes	yes
Deleting audits	Delete completed audits	yes	—

Checklists and planner

Permission	What it gives	By location	Views logged
Checklists in the web dashboard	List and view checklists	—	—
Creating and editing checklists	Builder, folders, scenarios, who can access a checklist	—	—
Deleting checklists	Trash and deleting checklists	—	—
Audit planner	The “Planner” section	yes	—
Audit planning	Plans, templates, rescheduling and reassignment	yes	—

Tasks and automation

Permission	What it gives	By location	Views logged
All location tasks	Without this permission, only own tasks are visible (author, assignee, watcher)	yes	—
Confirming task completion	Confirm task completion or send tasks back for rework	yes	—
Deleting other people's tasks	Delete tasks created by others; authors can always delete their own tasks	yes	—
Automation	Violation scenarios, positions and location management	—	—

Instructions and testing

Permission	What it gives	By location	Views logged
Managing the instruction library	Root folders, access to all instructions, AI and API. Permissions for individual folders are set in the instructions themselves	—	—
Creating and editing tests	Create and edit tests	—	—
Testing results	Results and assigning tests to employees	yes	—
Reviewing attempts and proctoring recordings	Grading open answers, voiding, strict mode photos and videos	yes	yes
Exporting test results	—	yes	yes

Mystery shopper

Permission	What it gives	By location	Views logged
Mystery shopper questionnaires	The “Mystery shopper” section: visits and questionnaires	—	—
Managing visits and shoppers	Create a visit, accept, return, reject a questionnaire	—	—
Shopper payouts and their contacts	Payout amounts to shoppers and their contacts	—	yes
Ordering turnkey checks	The “Managed mystery guest” section	—	—

HACCP

Permission	What it gives	By location	Views logged
HACCP: logs and deviations	HACCP sections: overview, “Today”, logs, deviations, registries	yes	—
Filling in HACCP logs	If the log lists positions, also by position	yes	—
Handling deviations	Correct, void an entry, skip a measurement, close a non-critical deviation	yes	—
Closing critical deviations	Close critical deviations	yes	—
Employee health records	Employee health records in HACCP registries	yes	yes
Editing HACCP directories	Equipment, suppliers, calibrations, health records	—	—
HACCP plan	The “HACCP plan” section	—	—
HACCP settings, logs and sites	HACCP settings, logs and sites	—	—

Employees and HR

Permission	What it gives	By location	Views logged
Employee list	The “Employees” section — employees of the locations where the permission applies	yes	—
Employee phone and email	Phone and email in the list and the employee card	yes	—
Adding employees	Create new employees	—	—
Editing employees	Name, position, locations, checklist access	yes	—
Employee sign-in	Web dashboard access, password, invitations	yes	—
Deleting and restoring employees	—	yes	—
Exporting the employee list	Excel with the employee list	yes	yes
Positions directory	Directory of positions	—	—
HR card	Employment, history, vacations, employee onboarding	yes	yes
Personal details	Documents, addresses, tax ID, bank details, emergency contact	yes	yes
HR documents and files	The “Documents” tab in the employee card	yes	yes
Hiring, transfer and dismissal	Hire, transfer and dismiss employees	yes	—
Vacations and sick leave	The “Vacations and sick leave” section	yes	—
Hiring and dismissal templates	Hiring and dismissal checklist templates	—	—

Shift schedule

Permission	What it gives	By location	Views logged
Shift schedule: view	The “Shift schedule” section, without editing	yes	—
Building the schedule	Shifts, templates, auto-fill, employees in the schedule	yes	—
Publishing the schedule	Publish the schedule to employees	yes	—
Clock-in and clock-out	The “Attendance” section	yes	—
Timesheet	The “Timesheet” section	yes	—
Employee KPI	The “KPI” section	yes	—
Employee requests	Vacations, days off, shift swaps	yes	—
Location settings	Clock-in sites, QR, shift templates, staffing needs	yes	—
General rules, holidays and KPI metrics	Holidays, company-wide rules, shared shift templates, KPI metrics	—	—

Rates and payroll

Permission	What it gives	By location	Views logged
Employee rates	Rate, rate history, shift cost in the schedule	yes	yes
Changing rates	Change employee rates	yes	—
Payroll	The “Payroll” section	yes	yes
Approving and paying payroll	Approve, reopen, mark as paid, bonuses and deductions	yes	—
Payroll export and payslips	Payroll Excel and payslips	yes	yes

Company

Permission	What it gives	By location	Views logged
Locations and regions	Create, edit, delete a location or region	—	—
Location staff and managers	Who works at a location and who manages it	—	—
Departments: all departments	A department head sees their own department even without this permission	—	—
Departments: editing	Create and edit departments	—	—
Report mailings	The “Mailing lists” section	—	—
Company details and settings	Name, company details, report language, logo, reminders	—	—
Plan, payment and invoices	Plan, billing contact, issued invoices	—	yes

Access rights

Permission	What it gives	By location	Views logged
Assigning roles and permissions to employees	You can grant only the permissions you have yourself; administrators cannot be changed	—	—
Editing roles	Create, edit and delete roles	—	—
Access log	The “Log” tab in “Roles and permissions”	—	—

Frequently asked questions

How do I give a manager access to payroll for their locations?

Open Roles and permissions → Employees, select the manager and for the “Payroll” permission click Grant, with the scope Locations they manage. The “Employee rates” permission is added automatically. If all managers need payroll access, tick these permissions in the “Location manager” role.

Why doesn't an employee see a section even though they have the role?

Open the employee on the Employees tab and look at Effective permissions: the permission may be denied personally, or it may apply at other locations. For example, “Own locations” are only the locations where the employee works or manages, plus the location of their shift today.

Can I deny something to an administrator?

No, an administrator can do everything. To restrict a person, clear their administrator mark and assign the roles they need.

Who can see that I opened payroll or personal details?

Employees with the “Access log” permission and administrators — on the Log tab. Only views of sensitive data (permissions with an eye icon), exports and access denials are recorded.

Where did “Test editor” and “HACCP managers” go?

These marks have been replaced by the “Creating and editing tests” permission and the “HACCP technologist” role. The former marks were automatically migrated to employees' personal permissions at all locations.

Thank you! This helps us improve the help center.