[{"data":1,"prerenderedAt":1100},["ShallowReactive",2],{"help:\u002Fhelp\u002Faccount\u002Fsecure-your-account-with-mfa":3,"help-all-categories":265,"help-cat-articles:\u002Fhelp\u002Faccount\u002Fsecure-your-account-with-mfa":385,"help-related:\u002Fhelp\u002Faccount\u002Fsecure-your-account-with-mfa":386},{"id":4,"title":5,"audience":6,"body":7,"category":241,"description":242,"draft":243,"extension":244,"icon":245,"keywords":246,"meta":254,"navigation":255,"order":256,"path":257,"related":258,"seo":261,"stem":262,"updatedAt":263,"__hash__":264},"help\u002Fhelp\u002Faccount\u002Fsecure-your-account-with-mfa.md","Secure your account with two-factor authentication","clinic",{"type":8,"value":9,"toc":221},"minimark",[10,19,24,30,80,84,87,91,97,107,111,170,173,177,181,192,197,201,204,208,214,218],[11,12,13,14,18],"p",{},"Turn on two-factor authentication in ",[15,16,17],"strong",{},"Settings → Profile",": scan a QR code with any authenticator app, confirm a 6-digit code, and save the recovery codes you're shown once. From then on, sign-in asks for a code from your app — so a stolen password alone can't open your business.",[20,21,23],"h2",{"id":22},"how-do-i-turn-on-two-factor-authentication","How do I turn on two-factor authentication?",[11,25,26,29],{},[15,27,28],{},"Before you start:"," install any standard authenticator app — Google Authenticator, Authy, 1Password, Microsoft Authenticator. Every user can do this for their own account; no admin permission needed.",[31,32,33,38,52,56,59,63,69,73],"steps",{},[34,35,37],"h3",{"id":36},"open-your-profile-settings","Open your profile settings",[11,39,40,41,43,44,47,48,51],{},"Go to ",[15,42,17],{},", find the ",[15,45,46],{},"Two-factor authentication"," row in the Security section, and click ",[15,49,50],{},"Enable",".",[34,53,55],{"id":54},"scan-the-qr-code","Scan the QR code",[11,57,58],{},"Scan it with your authenticator app. Can't scan? Type the setup key shown beside the QR code into the app instead.",[34,60,62],{"id":61},"confirm-with-a-code","Confirm with a code",[11,64,65,66,51],{},"Enter the 6-digit code the app now shows and press ",[15,67,68],{},"Verify & enable",[34,70,72],{"id":71},"save-your-recovery-codes","Save your recovery codes",[11,74,75,76,79],{},"Owneli immediately generates single-use recovery codes and shows them ",[15,77,78],{},"once",". Copy or download them into a password manager. When you close the dialog, they can't be viewed again.",[20,81,83],{"id":82},"what-changes-at-sign-in","What changes at sign-in",[11,85,86],{},"After your email and password (or magic link), you're asked for the current 6-digit code from your authenticator app. Enter it and you're in.",[20,88,90],{"id":89},"what-if-i-lose-my-phone","What if I lose my phone?",[92,93,94],"warning",{},[11,95,96],{},"Recovery codes can't yet be typed in at the sign-in screen — self-service redemption is a planned follow-up. If you're locked out, contact an admin or the owner of your business: they can disable your two-factor so you can sign in and re-enrol. Keep your recovery codes available for that conversation.",[11,98,99,100,102,103,106],{},"From ",[15,101,17],{}," you can always see how many codes remain and ",[15,104,105],{},"regenerate"," a fresh set — regenerating invalidates every code from the previous batch.",[20,108,110],{"id":109},"requiring-it-for-the-whole-team","Requiring it for the whole team",[112,113,114,130],"table",{},[115,116,117],"thead",{},[118,119,120,124,127],"tr",{},[121,122,123],"th",{},"Action",[121,125,126],{},"Who can do it",[121,128,129],{},"Where",[131,132,133,144,155],"tbody",{},[118,134,135,139,142],{},[136,137,138],"td",{},"Enrol yourself",[136,140,141],{},"Everyone",[136,143,17],{},[118,145,146,149,152],{},[136,147,148],{},"See who has enrolled (roster)",[136,150,151],{},"Admins",[136,153,154],{},"Settings → Team & access → Security",[118,156,157,163,168],{},[136,158,159,162],{},[15,160,161],{},"Require"," two-factor org-wide",[136,164,165],{},[15,166,167],{},"Owner only",[136,169,154],{},[11,171,172],{},"Once enforced, everyone is prompted to enrol at sign-in. Admins can use the roster to chase stragglers before flipping enforcement on.",[20,174,176],{"id":175},"common-questions","Common questions",[34,178,180],{"id":179},"why-am-i-asked-to-set-up-two-factor-after-signing-in","Why am I asked to set up two-factor after signing in?",[11,182,183,184,187,188,191],{},"Owners and admins who have not enrolled may see an optional setup reminder. ",[15,185,186],{},"Not now"," pauses that reminder for seven days for your account in this browser. ",[15,189,190],{},"Don't remind me"," dismisses the optional reminder for that account in this browser. Clearing browser storage or using a different device can make it appear again.",[11,193,194,195,51],{},"These choices do not disable two-factor authentication or override your business's requirement to use it. You can still turn it on at any time in ",[15,196,17],{},[34,198,200],{"id":199},"which-authenticator-apps-work","Which authenticator apps work?",[11,202,203],{},"Any TOTP app — Google Authenticator, Authy, 1Password, Microsoft Authenticator, and the rest.",[34,205,207],{"id":206},"how-do-i-turn-two-factor-off","How do I turn two-factor off?",[11,209,210,213],{},[15,211,212],{},"Settings → Profile → Disable"," on the two-factor row. If your business requires it, expect to be prompted to enrol again.",[34,215,217],{"id":216},"are-recovery-codes-shown-again-later","Are recovery codes shown again later?",[11,219,220],{},"No. They're displayed exactly once when generated. If you didn't save them, regenerate a new batch — the old ones stop working.",{"title":222,"searchDepth":223,"depth":223,"links":224},"",2,[225,232,233,234,235],{"id":22,"depth":223,"text":23,"children":226},[227,229,230,231],{"id":36,"depth":228,"text":37},3,{"id":54,"depth":228,"text":55},{"id":61,"depth":228,"text":62},{"id":71,"depth":228,"text":72},{"id":82,"depth":223,"text":83},{"id":89,"depth":223,"text":90},{"id":109,"depth":223,"text":110},{"id":175,"depth":223,"text":176,"children":236},[237,238,239,240],{"id":179,"depth":228,"text":180},{"id":199,"depth":228,"text":200},{"id":206,"depth":228,"text":207},{"id":216,"depth":228,"text":217},"account","How to set up two-factor authentication (2FA) in Owneli with an authenticator app, save recovery codes, and get back in if you lose your phone.",false,"md","i-lucide-shield-check",[247,248,249,250,251,252,253],"two factor authentication","set up 2fa","mfa setup","authenticator app","recovery codes","lost my phone 2fa","locked out of 2fa",{},true,30,"\u002Fhelp\u002Faccount\u002Fsecure-your-account-with-mfa",[259,260],"\u002Fhelp\u002Faccount\u002Flog-in-and-reset-your-password","\u002Fhelp\u002Fsettings\u002Froles-and-permissions",{"title":5,"description":242},"help\u002Faccount\u002Fsecure-your-account-with-mfa","2026-09-19","Dq7ePg8DKKeXYQ1oinqtn73s6w_UWFwtFOwYYLP3FuY",[266,277,286,295,305,315,325,335,345,355,364,375],{"id":267,"title":268,"audience":6,"description":269,"extension":270,"icon":271,"meta":272,"order":273,"slug":274,"stem":275,"__hash__":276},"helpCategories\u002Fhelp\u002Fcategories\u002Fgetting-started.yml","Getting started","Set up your workspace, learn the layout, and run your first day.","yml","i-lucide-compass",{},1,"getting-started","help\u002Fcategories\u002Fgetting-started","lTnfg_2tKvxQ9QanJ9XY3shoBHrJNWNfnxhcYaaKKPI",{"id":278,"title":279,"audience":6,"description":280,"extension":270,"icon":281,"meta":282,"order":223,"slug":283,"stem":284,"__hash__":285},"helpCategories\u002Fhelp\u002Fcategories\u002Fcalendar.yml","Calendar & booking","Book, move, and cancel appointments. Block time, work the waitlist, and read the grid at a glance.","i-lucide-calendar",{},"calendar","help\u002Fcategories\u002Fcalendar","s5UMHzRIeTUFi7mdsOyuSluzJBp79U9WTsTpOtbaW-E",{"id":287,"title":288,"audience":6,"description":289,"extension":270,"icon":290,"meta":291,"order":228,"slug":292,"stem":293,"__hash__":294},"helpCategories\u002Fhelp\u002Fcategories\u002Fcheckout.yml","Checkout & payments","Ring up a sale, take tips, handle deposits and fees, issue refunds, and close the drawer.","i-lucide-credit-card",{},"checkout","help\u002Fcategories\u002Fcheckout","4PQPgJd7Z25g0SvtoqqdMlnzk3DlcJpaZhNAiNiYVW0",{"id":296,"title":297,"audience":6,"description":298,"extension":270,"icon":299,"meta":300,"order":301,"slug":302,"stem":303,"__hash__":304},"helpCategories\u002Fhelp\u002Fcategories\u002Fclients.yml","Clients & forms","Add and find clients, read a client profile, and send forms and consents.","i-lucide-users",{},4,"clients","help\u002Fcategories\u002Fclients","u-tqzEJo2gR_wJ7x7y-EMIF3L4TP9EuBWlamwgwCC0I",{"id":306,"title":307,"audience":6,"description":308,"extension":270,"icon":309,"meta":310,"order":311,"slug":312,"stem":313,"__hash__":314},"helpCategories\u002Fhelp\u002Fcategories\u002Fretail.yml","Memberships, packages & gift cards","The things clients buy once and spend down over time, and how each one behaves at checkout.","i-lucide-gift",{},5,"retail","help\u002Fcategories\u002Fretail","wVVr_rc_P9p2RZWwy0XKsNB9fQ7XtQxxIz4qnixkGkg",{"id":316,"title":317,"audience":6,"description":318,"extension":270,"icon":319,"meta":320,"order":321,"slug":322,"stem":323,"__hash__":324},"helpCategories\u002Fhelp\u002Fcategories\u002Foperations.yml","Operations","The internal side of the business, covering your written playbook, task boards, venue incidents, and the policies everyone signs.","i-lucide-briefcase",{},6,"operations","help\u002Fcategories\u002Foperations","kSPRTYYbOW5LBNuaYXGv0C4IE7BqS2n-OkCSI97f-cM",{"id":326,"title":327,"audience":6,"description":328,"extension":270,"icon":329,"meta":330,"order":331,"slug":332,"stem":333,"__hash__":334},"helpCategories\u002Fhelp\u002Fcategories\u002Fteam.yml","Team & scheduling","Working hours, the weekly roster, clock-in, timesheets, and time off.","i-lucide-id-card",{},7,"team","help\u002Fcategories\u002Fteam","1cMbCRwUmewb4t_DwUJ7jJUjntx-odU8jRDgBredsPs",{"id":336,"title":337,"audience":6,"description":338,"extension":270,"icon":339,"meta":340,"order":341,"slug":342,"stem":343,"__hash__":344},"helpCategories\u002Fhelp\u002Fcategories\u002Fgrowth.yml","Reports & growth","Read the numbers, export them, and find the report you actually need.","i-lucide-trending-up",{},8,"growth","help\u002Fcategories\u002Fgrowth","3XyCU-DkoYi7xSPz0tDRohlYkNBUS0YsLo-insknI8o",{"id":346,"title":347,"audience":6,"description":348,"extension":270,"icon":349,"meta":350,"order":351,"slug":352,"stem":353,"__hash__":354},"helpCategories\u002Fhelp\u002Fcategories\u002Fsettings.yml","Settings & admin","Services and pricing, who can see what, and moving your data in from another system.","i-lucide-settings",{},9,"settings","help\u002Fcategories\u002Fsettings","rdLQHp7tfAu5iySbsypfXu1kOuujDAuLVk6yGidNvtQ",{"id":356,"title":357,"audience":6,"description":358,"extension":270,"icon":359,"meta":360,"order":361,"slug":241,"stem":362,"__hash__":363},"helpCategories\u002Fhelp\u002Fcategories\u002Faccount.yml","Your login and profile","Your own login, password, two-factor security, profile, and language.","i-lucide-user-circle",{},10,"help\u002Fcategories\u002Faccount","8JZPH_8Q-lnEEFgysE9gCwyd1pzUe2hfAebATuQ5Pog",{"id":365,"title":366,"audience":367,"description":368,"extension":270,"icon":369,"meta":370,"order":371,"slug":372,"stem":373,"__hash__":374},"helpCategories\u002Fhelp\u002Fcategories\u002Fbook-online.yml","Book online","client","Booking, paying, and managing your visit from your venue's booking page and the private links they send you.","i-lucide-globe",{},20,"book-online","help\u002Fcategories\u002Fbook-online","dUBIoELt-ci1vqbw_VX1VA6PGJV8V-9x4ZmpAk1aXXE",{"id":376,"title":377,"audience":367,"description":378,"extension":270,"icon":379,"meta":380,"order":381,"slug":382,"stem":383,"__hash__":384},"helpCategories\u002Fhelp\u002Fcategories\u002Fportal.yml","Your account and visits","Booking from your account, managing your visits, and using your wallet, memberships and rewards.","i-lucide-user-round",{},21,"portal","help\u002Fcategories\u002Fportal","D8_zQhv9hO2b9PYDADw-ebh1yZUuC0UcBt3DDZbMAH4",[],[387,642],{"id":388,"title":389,"audience":6,"body":390,"category":241,"description":627,"draft":243,"extension":244,"icon":628,"keywords":629,"meta":636,"navigation":255,"order":361,"path":259,"related":637,"seo":638,"stem":639,"updatedAt":640,"__hash__":641},"help\u002Fhelp\u002Faccount\u002Flog-in-and-reset-your-password.md","Log in and reset your password",{"type":8,"value":391,"toc":604},[392,404,408,411,448,482,486,520,531,535,561,567,569,573,576,580,587,591,597,601],[11,393,394,395,399,400,403],{},"Sign in at ",[396,397,398],"code",{},"\u002Fauth\u002Flogin"," with your email and password — or skip the password entirely and have Owneli email you a one-time sign-in link. Forgot your password? ",[15,401,402],{},"Forgot password?"," on the login page emails you a reset link.",[20,405,407],{"id":406},"how-do-i-log-in-to-owneli","How do I log in to Owneli?",[11,409,410],{},"Two ways in, both starting from your email address:",[112,412,413,423],{},[115,414,415],{},[118,416,417,420],{},[121,418,419],{},"Method",[121,421,422],{},"When to use it",[131,424,425,438],{},[118,426,427,432],{},[136,428,429],{},[15,430,431],{},"Password",[136,433,434,435],{},"The everyday route — email + password, then ",[15,436,437],{},"Sign in",[118,439,440,445],{},[136,441,442],{},[15,443,444],{},"Magic link",[136,446,447],{},"You forgot the password, or you're on a device you'd rather not type it on",[31,449,450,454,459,463,471,475],{},[34,451,453],{"id":452},"enter-your-email-and-password","Enter your email and password",[11,455,456,457,51],{},"Press ",[15,458,437],{},[34,460,462],{"id":461},"enter-your-two-factor-code-if-asked","Enter your two-factor code if asked",[11,464,465,466,470],{},"If ",[467,468,469],"a",{"href":257},"two-factor authentication"," is on for your account, type the 6-digit code from your authenticator app.",[34,472,474],{"id":473},"you-land-in-the-app","You land in the app",[11,476,477,478,481],{},"If your business requires two-factor and you haven't set it up yet, a ",[15,479,480],{},"Secure your account"," screen may offer to set it up first — you can do it now or later.",[20,483,485],{"id":484},"how-do-i-sign-in-without-a-password","How do I sign in without a password?",[31,487,488,492,498,502,505,509],{},[34,489,491],{"id":490},"send-yourself-the-link","Send yourself the link",[11,493,494,495,51],{},"Enter your email on the login page and press ",[15,496,497],{},"Send magic link",[34,499,501],{"id":500},"open-the-email","Open the email",[11,503,504],{},"You can either click the sign-in link, or type the one-time code from the email into the field that appears on the login page — both work.",[34,506,508],{"id":507},"didnt-arrive","Didn't arrive?",[11,510,511,512,515,516,519],{},"Use ",[15,513,514],{},"Resend link",", or ",[15,517,518],{},"Use a different email"," to start over.",[521,522,523],"tip",{},[11,524,525,526,530],{},"The magic link only works for accounts that already exist. If you've never been invited to a Owneli business, ",[467,527,529],{"href":528},"\u002Fhelp\u002Faccount\u002Faccept-an-invitation","ask for an invitation"," first.",[20,532,534],{"id":533},"how-do-i-reset-a-forgotten-password","How do I reset a forgotten password?",[31,536,537,541,544,548,554,558],{},[34,538,540],{"id":539},"click-forgot-password","Click \"Forgot password?\"",[11,542,543],{},"It's on the login page, next to the password field.",[34,545,547],{"id":546},"enter-your-email","Enter your email",[11,549,456,550,553],{},[15,551,552],{},"Send reset link",". A confirmation screen tells you it's on the way.",[34,555,557],{"id":556},"set-a-new-password","Set a new password",[11,559,560],{},"Follow the link in the email to the reset page, choose a new password, and sign in as usual.",[562,563,564],"note",{},[11,565,566],{},"For security, the login page never confirms whether an email address has an account — a failed magic link or reset shows the same generic message either way.",[20,568,176],{"id":175},[34,570,572],{"id":571},"why-does-it-say-my-account-has-been-deactivated","Why does it say my account has been deactivated?",[11,574,575],{},"An administrator has ended your access to that business. Contact the business directly — there's nothing to fix on your side.",[34,577,579],{"id":578},"i-signed-in-but-see-access-suspended-or-pending-review-what-now","I signed in but see \"Access suspended\" or \"Pending review\" — what now?",[11,581,582,583],{},"Those are membership states, not login failures. See ",[467,584,586],{"href":585},"\u002Fhelp\u002Faccount\u002Faccount-suspended-or-pending-review","Why is my account suspended or pending review?",[34,588,590],{"id":589},"i-lost-my-authenticator-app-and-cant-get-past-the-code-screen","I lost my authenticator app and can't get past the code screen",[11,592,593,594,596],{},"See the recovery section of ",[467,595,5],{"href":257}," — an admin or the owner can disable your two-factor so you can re-enrol.",[34,598,600],{"id":599},"can-i-stay-signed-in","Can I stay signed in?",[11,602,603],{},"Yes — sessions persist on trusted devices. If your business sets an inactivity timeout, you'll be signed out after that idle period.",{"title":222,"searchDepth":223,"depth":223,"links":605},[606,611,616,621],{"id":406,"depth":223,"text":407,"children":607},[608,609,610],{"id":452,"depth":228,"text":453},{"id":461,"depth":228,"text":462},{"id":473,"depth":228,"text":474},{"id":484,"depth":223,"text":485,"children":612},[613,614,615],{"id":490,"depth":228,"text":491},{"id":500,"depth":228,"text":501},{"id":507,"depth":228,"text":508},{"id":533,"depth":223,"text":534,"children":617},[618,619,620],{"id":539,"depth":228,"text":540},{"id":546,"depth":228,"text":547},{"id":556,"depth":228,"text":557},{"id":175,"depth":223,"text":176,"children":622},[623,624,625,626],{"id":571,"depth":228,"text":572},{"id":578,"depth":228,"text":579},{"id":589,"depth":228,"text":590},{"id":599,"depth":228,"text":600},"How to log in to Owneli with a password or a magic link, reset a forgotten password, and fix the most common can't-log-in problems.","i-lucide-log-in",[630,631,632,633,634,635],"reset my password","can't log in","forgot password","magic link login","sign in without password","login code email",{},[257,528,585],{"title":389,"description":627},"help\u002Faccount\u002Flog-in-and-reset-your-password","2026-08-14","8Ft7WPOOaQyRaUtMBfTlkHhy5NuO4Q8yXwlS_AD-TeE",{"id":643,"title":644,"audience":6,"body":645,"category":352,"description":1090,"draft":243,"extension":244,"icon":245,"keywords":1091,"meta":1092,"navigation":255,"order":371,"path":260,"related":1093,"seo":1096,"stem":1097,"updatedAt":1098,"__hash__":1099},"help\u002Fhelp\u002Fsettings\u002Froles-and-permissions.md","Roles and permissions",{"type":8,"value":646,"toc":1071},[647,650,655,659,662,716,721,725,728,732,751,787,790,843,847,854,918,921,926,930,933,964,971,975,1017,1021,1028,1033,1037,1040,1044,1058,1061,1065],[11,648,649],{},"Access in Owneli is capability-based, not tier-based. There is no hidden ladder where \"manager\" magically unlocks things — every screen and every API call checks a specific capability, and roles are just named bundles of capabilities.",[11,651,652],{},[15,653,654],{},"Settings → Team & access → Permission roles",[20,656,658],{"id":657},"the-four-starting-roles","The four starting roles",[11,660,661],{},"Every business is created with four system roles you can adapt.",[112,663,664,674],{},[115,665,666],{},[118,667,668,671],{},[121,669,670],{},"Role",[121,672,673],{},"What it is",[131,675,676,686,696,706],{},[118,677,678,683],{},[136,679,680],{},[15,681,682],{},"Owner",[136,684,685],{},"Full access to everything, plus owner-reserved actions: enforcing multi-factor authentication and transferring ownership.",[118,687,688,693],{},[136,689,690],{},[15,691,692],{},"Admin",[136,694,695],{},"Full access to the business. Can invite people, manage the team, and change settings.",[118,697,698,703],{},[136,699,700],{},[15,701,702],{},"Manager",[136,704,705],{},"Operational lead. Manages clients, forms and sends, approves time off. Cannot change settings or invite users.",[118,707,708,713],{},[136,709,710],{},[15,711,712],{},"Staff",[136,714,715],{},"Standard team member. The capability set is adjustable per business.",[562,717,718],{},[11,719,720],{},"The owner is deliberately a superuser and is granted every capability, including ones added in future releases. That's so a new feature can never accidentally lock the owner out of their own business.",[20,722,724],{"id":723},"two-axes","Two axes",[11,726,727],{},"Access is controlled along two axes, and both matter.",[34,729,731],{"id":730},"_1-what-you-can-do","1. What you can do",[11,733,734,735,738,739,742,743,746,747,750],{},"Each of roughly three dozen capability areas carries its own actions — typically ",[15,736,737],{},"view",", ",[15,740,741],{},"manage",", and ",[15,744,745],{},"delete",", plus ",[15,748,749],{},"create"," where creating differs meaningfully from editing.",[11,752,753,754,738,757,738,760,738,763,738,766,738,769,738,772,738,775,738,778,738,781,742,784,51],{},"The permission editor groups them the way you think about the app: ",[15,755,756],{},"Calendar",[15,758,759],{},"Scheduling & timesheets",[15,761,762],{},"Sales",[15,764,765],{},"Clients",[15,767,768],{},"Catalog",[15,770,771],{},"Marketing",[15,773,774],{},"Inventory & Retail",[15,776,777],{},"Team",[15,779,780],{},"Reports",[15,782,783],{},"Workspace",[15,785,786],{},"AI concierge",[11,788,789],{},"Things are split more finely than you might expect, on purpose:",[791,792,793,803,812,822,828],"ul",{},[794,795,796,799,800,802],"li",{},[15,797,798],{},"Cash drawer"," is separate from ",[15,801,762],{}," — a cashier can ring up without holding the power to open, count and reconcile the till.",[794,804,805,799,808,811],{},[15,806,807],{},"Scheduling",[15,809,810],{},"Appointments"," — you can grant \"runs the rota and signs off payroll\" without handing over the client calendar.",[794,813,814,817,818,821],{},[15,815,816],{},"Client photos"," and ",[15,819,820],{},"clinical charts"," are separate from the client record — health imagery grants and revokes on its own.",[794,823,824,827],{},[15,825,826],{},"Compensation"," is its own area — someone can see their own earnings without seeing a colleague's.",[794,829,830,738,833,738,836,817,839,842],{},[15,831,832],{},"Purchasing",[15,834,835],{},"stock",[15,837,838],{},"transfers",[15,840,841],{},"products"," each grant independently, so a buyer can raise purchase orders without touching stock counts.",[34,844,846],{"id":845},"_2-which-rows-you-can-do-it-to","2. Which rows you can do it to",[11,848,849,850,853],{},"The ",[15,851,852],{},"data scope"," decides which records an action reaches:",[112,855,856,866],{},[115,857,858],{},[118,859,860,863],{},[121,861,862],{},"Scope",[121,864,865],{},"Meaning",[131,867,868,878,888,898,908],{},[118,869,870,875],{},[136,871,872],{},[15,873,874],{},"All",[136,876,877],{},"Everything in the business",[118,879,880,885],{},[136,881,882],{},[15,883,884],{},"Own",[136,886,887],{},"Only records belonging to this person",[118,889,890,895],{},[136,891,892],{},[15,893,894],{},"Assigned",[136,896,897],{},"Only records they're assigned to",[118,899,900,905],{},[136,901,902],{},[15,903,904],{},"Location",[136,906,907],{},"Only records at their location",[118,909,910,915],{},[136,911,912],{},[15,913,914],{},"None",[136,916,917],{},"Nothing",[11,919,920],{},"Staff-tier defaults reflect how a provider actually works: their own calendar, their assigned clients, their own timesheets, their own sales, their own reports and earnings.",[92,922,923],{},[11,924,925],{},"Granting an action without widening its scope is the most common configuration mistake. Someone with \"view all appointments\" but a scope of \"own\" will still only see their own calendar, and it will look like a bug.",[20,927,929],{"id":928},"fine-grained-client-access","Fine-grained client access",[11,931,932],{},"The client record is the most sensitive surface in the app, so it's split further:",[791,934,935,941,947,953,959],{},[794,936,937,940],{},[15,938,939],{},"Can view client profile"," — the base",[794,942,943,946],{},[15,944,945],{},"Can view contact details"," — email and phone",[794,948,949,952],{},[15,950,951],{},"Can view personal info"," — date of birth and home address",[794,954,955,958],{},[15,956,957],{},"Can view spending and wallet"," — lifetime value, balances, loyalty",[794,960,961],{},[15,962,963],{},"Can add and remove tags",[11,965,966,967,970],{},"Denied fields are masked in the interface ",[15,968,969],{},"and"," stripped from API responses — this is enforced at the server, not hidden with CSS.",[20,972,974],{"id":973},"building-a-custom-role","Building a custom role",[31,976,977,981,984,988,991,995,998,1002,1008,1012],{},[34,978,980],{"id":979},"start-from-the-closest-system-role","Start from the closest system role",[11,982,983],{},"Duplicate it rather than building from an empty matrix. Empty matrices produce roles that can't do their job.",[34,985,987],{"id":986},"turn-on-the-areas-the-role-needs","Turn on the areas the role needs",[11,989,990],{},"Each area has a master toggle. The editor enforces parent-first ordering — a child permission can't take effect while its parent is off.",[34,992,994],{"id":993},"set-the-scope-for-each-area","Set the scope for each area",[11,996,997],{},"Only surfaces with end-to-end enforcement offer a scope picker, so every option you're shown actually does something.",[34,999,1001],{"id":1000},"preview-it","Preview it",[11,1003,511,1004,1007],{},[15,1005,1006],{},"View as"," to see the app exactly as that role sees it. This is the step people skip and then regret.",[34,1009,1011],{"id":1010},"assign-it","Assign it",[11,1013,1014,1015,51],{},"Set the role on each team member under ",[15,1016,777],{},[20,1018,1020],{"id":1019},"what-the-sidebar-tells-you","What the sidebar tells you",[11,1022,1023,1024,1027],{},"Every nav item is capability-gated, so people only see what they can open. An ",[15,1025,1026],{},"eye icon"," beside a link means view-only access — you can read the page but not change anything. It saves a click into a page where every button is disabled.",[92,1029,1030],{},[11,1031,1032],{},"Hiding a link is presentation. The real gate is on the server: every endpoint re-checks the capability and the scope. Restoring a hidden link in the browser gets you an error, not access.",[20,1034,1036],{"id":1035},"multi-factor-authentication","Multi-factor authentication",[11,1038,1039],{},"Owners can require multi-factor authentication for the business. Once enforced, everyone is prompted to enrol at sign-in.",[20,1041,1043],{"id":1042},"suspending-and-offboarding","Suspending and offboarding",[791,1045,1046,1052],{},[794,1047,1048,1051],{},[15,1049,1050],{},"Suspend"," locks someone out immediately while keeping their record and history intact",[794,1053,1054,1057],{},[15,1055,1056],{},"Archive"," runs a reassignment wizard so their upcoming appointments and open work move to someone else before the record is closed",[11,1059,1060],{},"Neither deletes their history. Past sales, appointments and timesheets stay attached to them for reporting and payroll.",[20,1062,1064],{"id":1063},"auditing","Auditing",[11,1066,1067,1070],{},[15,1068,1069],{},"Settings → Compliance → Audit log"," records who did what and when — role changes, permission changes, refunds, voids, merges, deletions. Audit access is its own capability, so a compliance reviewer can read it without being an admin.",{"title":222,"searchDepth":223,"depth":223,"links":1072},[1073,1074,1078,1079,1086,1087,1088,1089],{"id":657,"depth":223,"text":658},{"id":723,"depth":223,"text":724,"children":1075},[1076,1077],{"id":730,"depth":228,"text":731},{"id":845,"depth":228,"text":846},{"id":928,"depth":223,"text":929},{"id":973,"depth":223,"text":974,"children":1080},[1081,1082,1083,1084,1085],{"id":979,"depth":228,"text":980},{"id":986,"depth":228,"text":987},{"id":993,"depth":228,"text":994},{"id":1000,"depth":228,"text":1001},{"id":1010,"depth":228,"text":1011},{"id":1019,"depth":223,"text":1020},{"id":1035,"depth":223,"text":1036},{"id":1042,"depth":223,"text":1043},{"id":1063,"depth":223,"text":1064},"The four starting roles, the two axes that control access, and how to build a custom role without locking yourself out.",[],{},[1094,1095],"\u002Fhelp\u002Fteam\u002Fshifts-timesheets-and-time-off","\u002Fhelp\u002Fgrowth\u002Ffind-and-read-a-report",{"title":644,"description":1090},"help\u002Fsettings\u002Froles-and-permissions","2026-09-01","TENSZfd1Unekw8skVK5ZgEABdPfFFfQpo8przNdYK7o",1790210899732]