All features
Control
Roles & permissions
Roles assembled from granular permissions across every module in the product.
Authorisation is not a job title. A role is a set of permissions the firm assembles, and the rules are evaluated on the server on every request. The interface reads the same permissions only so that nobody is shown a control that would then be refused.
Where an action needs narrowing beyond the permission itself, the narrowing is part of the rule: a manager approves their own direct reports, a stage approver acts on their own stage, a staff member reads their own payslip.
Building roles
- Permission modules spanning matters, tasks, clients, staff, time, consultations, invoices, retainers, documents, billing, settings, communication, administration, roles, expenses, vendors, payroll, leave, complaints, feedback, learning, appraisals, compliance, visitor logs and departments
- Actions defined per module rather than one flag per area
- Roles applied to a department or to an individual
Enforcement
- Evaluated server-side on every request, independently of the interface
- Scope-narrowing rules applied on top of the permission
- A newly added permission is granted to the super-admin role only, so an upgrade never silently widens anybody's access