Access in Owneli is capability-based, not tier-based. There is no hidden ladder where "manager" magically unlocks things — every screen and every API call checks a specific capability, and roles are just named bundles of capabilities.
Settings → Team & access → Permission roles
The four starting roles
Every business is created with four system roles you can adapt.
| Role | What it is |
|---|---|
| Owner | Full access to everything, plus owner-reserved actions: enforcing multi-factor authentication and transferring ownership. |
| Admin | Full access to the business. Can invite people, manage the team, and change settings. |
| Manager | Operational lead. Manages clients, forms and sends, approves time off. Cannot change settings or invite users. |
| Staff | Standard team member. The capability set is adjustable per business. |
Two axes
Access is controlled along two axes, and both matter.
1. What you can do
Each of roughly three dozen capability areas carries its own actions — typically view, manage, and delete, plus create where creating differs meaningfully from editing.
The permission editor groups them the way you think about the app: Calendar, Scheduling & timesheets, Sales, Clients, Catalog, Marketing, Inventory & Retail, Team, Reports, Workspace, and AI concierge.
Things are split more finely than you might expect, on purpose:
- Cash drawer is separate from Sales — a cashier can ring up without holding the power to open, count and reconcile the till.
- Scheduling is separate from Appointments — you can grant "runs the rota and signs off payroll" without handing over the client calendar.
- Client photos and clinical charts are separate from the client record — health imagery grants and revokes on its own.
- Compensation is its own area — someone can see their own earnings without seeing a colleague's.
- Purchasing, stock, transfers and products each grant independently, so a buyer can raise purchase orders without touching stock counts.
2. Which rows you can do it to
The data scope decides which records an action reaches:
| Scope | Meaning |
|---|---|
| All | Everything in the business |
| Own | Only records belonging to this person |
| Assigned | Only records they're assigned to |
| Location | Only records at their location |
| None | Nothing |
Staff-tier defaults reflect how a provider actually works: their own calendar, their assigned clients, their own timesheets, their own sales, their own reports and earnings.
Fine-grained client access
The client record is the most sensitive surface in the app, so it's split further:
- Can view client profile — the base
- Can view contact details — email and phone
- Can view personal info — date of birth and home address
- Can view spending and wallet — lifetime value, balances, loyalty
- Can add and remove tags
Denied fields are masked in the interface and stripped from API responses — this is enforced at the server, not hidden with CSS.
Building a custom role
Start from the closest system role
Duplicate it rather than building from an empty matrix. Empty matrices produce roles that can't do their job.
Turn on the areas the role needs
Each area has a master toggle. The editor enforces parent-first ordering — a child permission can't take effect while its parent is off.
Set the scope for each area
Only surfaces with end-to-end enforcement offer a scope picker, so every option you're shown actually does something.
Preview it
Use View as to see the app exactly as that role sees it. This is the step people skip and then regret.
Assign it
Set the role on each team member under Team.
What the sidebar tells you
Every nav item is capability-gated, so people only see what they can open. An eye icon beside a link means view-only access — you can read the page but not change anything. It saves a click into a page where every button is disabled.
Multi-factor authentication
Owners can require multi-factor authentication for the business. Once enforced, everyone is prompted to enrol at sign-in.
Suspending and offboarding
- Suspend locks someone out immediately while keeping their record and history intact
- Archive runs a reassignment wizard so their upcoming appointments and open work move to someone else before the record is closed
Neither deletes their history. Past sales, appointments and timesheets stay attached to them for reporting and payroll.
Auditing
Settings → Compliance → Audit log records who did what and when — role changes, permission changes, refunds, voids, merges, deletions. Audit access is its own capability, so a compliance reviewer can read it without being an admin.