User Roles & Permissions

What each role can see and do, how to change a role, and how to customize permissions

What a role is

Every person who logs in to your company on Service Envoy has a role. The role decides two things: what they can see (which pages, records and money figures) and what they can do (create, edit, send, approve, delete).

Think of it like a building badge. Logging in gets someone through the front door. Their role decides which rooms their badge opens once they are inside. You change a person's role in one place, and every page follows it on their next click.

This article covers each role in detail, how to stack roles, how to change someone's role, and how to adjust what a role can do for your company. For creating logins, changing login emails and resetting passwords, see Managing User Accounts & Login Emails.

The roles at a glance

• Owner: the person who runs the account. Everything, including your Service Envoy subscription and plan, and the company's money.

• Admin: a second-in-command. Everything the Owner can do, including invoicing your clients, except changing your Service Envoy subscription, plan or payment method, adding or withdrawing marketplace funds, and closing the account.

• Project Manager: runs the work. Tickets, site visits, routing, technicians and budgets, but not invoicing, payments or company settings.

• Accounting: runs the books. Invoicing, payments, payroll, vendors and the company's marketplace funds, with view-only access to the work.

• Staff: a dispatcher or office assistant. Tickets, clients, scheduling and routing, walled off from money, users and settings.

• Technician: does the field work. Sees their own site visits, checks in and out, and logs their time and mileage.

• Read Only: looks but never touches. A good fit for an outside accountant or auditor.

The descriptions below are the defaults. Your Owner or an Admin can adjust what each role can do for your company (see Customizing what a role can do further down), so your company's setup may differ.

Each role in detail

Owner

The Owner is usually the person who signed the company up. Every company has at least one, and Service Envoy won't let you remove or demote the last one.

• Can do: everything in the account.

• Only the Owner can, by default: change the plan and add-ons, manage the subscription and payment method, add funds to or withdraw funds from your marketplace balance, close the account, and hand ownership to someone else.

• Users: the only role that can give someone the Owner or Admin role, change another Owner's role, password or login email, or deactivate another Owner.

• Permissions: the Owner's own permissions can never be narrowed. The Owner is also the only one who can hand the subscription and funding permissions to another role.

Admin

An Admin runs day-to-day operations with the same reach as the Owner, including invoicing your clients and recording their payments. What an Admin can't touch is your company's own Service Envoy account: its subscription, plan and payment method.

• Can do: manage users (except Owners and other Admins), company settings, integrations, lookup lists, clients, sites, employees, technicians, vendors, tickets, site visits, routing, the marketplace and Private Network, client invoices (create, edit and send) and client payments, payroll, reports, vehicles, assets and rates.

• Can see: everything, including invoices, payments, payroll and profitability.

• Can't do, by default: open Subscription & Plan, change your Service Envoy plan or add-ons, cancel or reactivate the subscription, change the payment method on file, add or withdraw marketplace funds, close the account, or give anyone the Owner or Admin role.

Project Manager

The Project Manager is the budget holder for the work. They can spend the money already in the account on jobs, but they can't add money or take it out, and by default they don't see client invoices or payments.

• Can do: create, edit and delete tickets; create, schedule and route site visits; post work to the marketplace or Private Network and cross-post a visit that already has a tech; approve a technician's work and fund visits from your existing balance; request additional pay or expense reimbursement on work your company was hired for; manage clients and sites and share site links with customers; edit technician records; manage rates; choose which notifications go out; and turn the vehicle and mileage check-in requirement on or off.

• Can see: clients, sites, employees, technicians, vendors, the Technician Map, reports (including profitability), the client pay and rates on tickets and site visits, marketplace financials, and insurance requirements (view only).

• Can't do, by default: see or work invoices and client payments, submit finished marketplace work for payment, add or withdraw funds, add or delete employees or vendors, manage users, change company settings, or run payroll.

Accounting

Accounting handles the money side: what clients owe, what technicians and vendors are paid, and payroll.

• Can do: create, edit and send invoices; record client payments and payments to Private Network technicians; run payroll and approve timesheets; review employee absences and no-shows; manage vendors (add, edit, delete); add and edit employees; add and withdraw marketplace funds, fund visits and approve payments; submit finished marketplace work for payment; manage rates and insurance requirements; and create user logins with non-admin roles.

• Can see: tickets and site visits (view only), clients, sites, employees, technicians, a technician's W-9 and tax ID for 1099 filing (every view is recorded), reports including profitability, and email delivery results.

• Can't do, by default: create or edit tickets and site visits, route work, change anyone's role, reset passwords, delete user logins, or change company settings.

Staff

Staff are your dispatchers and office assistants. They do the scheduling and customer work, without access to money, users or settings.

• Can do: create and edit tickets; create, schedule and route site visits; post work to the marketplace; request additional pay or expenses and submit finished marketplace work for payment; manage clients and sites; and add and edit technicians and vendors.

• Can see: clients, sites, employees, technicians, vendors, the Technician Map, invoices (view only) and reports.

• Can't do, by default: delete tickets, delete anyone from the directory, create, edit or send invoices, record payments, cross-post a visit that already has a tech assigned, share site links, see profitability, manage users, or change settings.

Technician

A Technician does the work in the field. Their view of the account is narrowed to their own work.

• Can do: work their own site visits (check in, complete tasks, upload photos and files, check out), log their time and mileage, and message about marketplace work they're involved in.

• Can see: the site visits assigned to them, the clients and sites those visits are for, site history, and their own profile, timesheets and metrics.

• Can't see: your client pricing and rates, other technicians' pay, company financials, or notifications meant for the office. Their bell shows only notifications addressed to them.

• Can't do: create or edit tickets, schedule or route visits, manage clients, sites or people, or request pay changes on the company's behalf.

Read Only

Read Only is for someone who needs to look but should never change anything, such as an outside accountant or an auditor.

• Can see: users, clients, sites, employees, technicians, vendors, tickets, site visits, marketplace financials, payroll, invoices and reports, including profitability.

• Can't do: anything that changes, sends, saves or deletes. This is enforced on every page, whatever permissions the role is given.

• A Read Only user can still manage their own login, password, profile, email signature and notifications.

Giving someone more than one role

A person can hold one main Role plus any number of Additional Roles. They get everything that any of their roles allows, added together.

For example, an office manager who dispatches and also does the books can be Staff with Accounting as an additional role. A role never takes anything away: if their main role can't do something but an additional role can, they can.

Additional roles can be Admin, Project Manager, Accounting, Staff, Technician or Read Only. The Owner role can only ever be a person's main role.

Changing someone's role

1. Go to Admin → User Management.

2. Find the person and click the pencil (Edit) icon on their row.

3. Choose their main role under Role.

4. Tick any Additional Roles they should also have.

5. Click Update User.

The change applies on the person's next click. They don't need to log out.

Who can change roles

• Owners and Admins can change roles. Accounting can create logins with non-admin roles, but can't change a role afterward.

• Only an Owner can give someone the Owner or Admin role.

• Only an Owner can change another Owner's role.

• The last Owner can't be demoted. Make someone else an Owner first.

Vendor logins

A login linked to a vendor record (for example, an outside bookkeeper) can only be given Accounting, Staff or Read Only. Vendors can't be Technicians, Project Managers or Admins, which keeps them out of dispatch, the marketplace and the Private Network.

Customizing what a role can do

If the defaults don't fit how your company works, you can change them. Go to Admin → User Management and scroll down to Role Permissions. This section is open to Owners and Admins.

The grid lists every permission down the left, grouped by area (Users & Access, Tickets, Routing & Site Visits, Invoicing, Payroll and so on), with a column for each role. A tick means everyone with that role has that permission.

• Turn a permission on or off by clicking its box. It saves straight away and applies to every person with that role on their next click.

• Hover a permission's name to read exactly what it allows.

• Use the search box to find a permission by name or area.

• An amber dot on a box means your company changed it from the default.

• A padlock means the box can't be changed: your plan doesn't include that feature, the permission can never be handed out (transferring ownership), or the column is Read Only and the permission would let them change something.

• The Owner column is shown for reference only. The Owner always has everything.

• Managing your Service Envoy subscription and plan, the payment method on file, adding and withdrawing funds, and closing the account are off for every role except the Owner by default. Only the Owner can turn them on for another role. An Admin sees those boxes locked.

• Reset to Defaults clears every change your company made and puts the grid back the way it started. This can't be undone.

The grid changes what a role can do, for everyone who holds it. To change what one person can do, change their role or add an additional role instead.

Menus and permissions

Which menu links a role sees is set by Service Envoy for each role. Whether the buttons on a page work is set by the permissions above. So a person may see a page but find they can only view it, which is how Read Only and view-only permissions are meant to work. If someone needs a page in their menu that they don't have, contact Service Envoy support from Give Feedback.

Quick reference

• Change someone's role → Admin → User Management → pencil → Role → Update User.

• Give someone two jobs → keep their main role and tick an Additional Role.

• Make someone an Admin or Owner → only an Owner can.

• Change what a whole role can do → Role Permissions grid at the bottom of User Management.

• Let a Project Manager see invoices → tick View Invoices (and View Payments if they need payments too) in the Project Manager column.

• Someone who should only look → Read Only.

• Undo every customization → Reset to Defaults on the grid.