Roles and permissions
Six roles. Every permission is checked by the server on every request — what you see on screen is a courtesy, not the control.
The source of truth is packages/shared/src/permissions.ts. If this page and
that file ever disagree, the file is right and this page needs fixing.
The six roles
| Role | In one line |
|---|---|
| Owner | Everything, including things that cannot be undone. There must always be at least one. |
| Practice manager | Runs the practice day to day. Everything except ownership and deleting the business. |
| Practitioner | Their own diary and the clinical records of people they treat. |
| Front desk | Books, reschedules, takes payments, looks after the waiting room. No clinical notes. |
| Accountant | Invoices, payments, claims and financial reports. No clinical notes. |
| Marketing | Campaign lists and marketing reports. No clinical information and no money. |
Somebody can hold more than one role. In a small clinic the owner also treats and often runs reception, so one role per login was never true. Permissions are the union of every role held.
What each role starts with
✓ granted by default · — not granted, but an owner may grant it · 🔒 locked, can never be granted
| Owner | Manager | Practitioner | Front desk | Accountant | Marketing | |
|---|---|---|---|---|---|---|
| Diary | ||||||
| See the diary | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| See every practitioner | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Make bookings | ✓ | ✓ | ✓ | ✓ | — | — |
| Move and reschedule | ✓ | ✓ | ✓ | ✓ | — | — |
| Cancel and mark non-attendance | ✓ | ✓ | ✓ | ✓ | — | — |
| Book outside open hours | ✓ | ✓ | ✓ | — | — | — |
| Change working hours | ✓ | ✓ | — | — | — | — |
| Clients | ||||||
| See client records | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Add clients | ✓ | ✓ | ✓ | ✓ | — | — |
| Edit client details | ✓ | ✓ | ✓ | ✓ | — | — |
| Archive clients | ✓ | ✓ | — | — | — | — |
| Merge duplicates | ✓ | ✓ | — | — | — | — |
| Delete an empty record | ✓ | — | 🔒 | 🔒 | 🔒 | 🔒 |
| Directory | ||||||
| See the directory | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Edit the directory | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Clinical | ||||||
| Read their own notes | ✓ | ✓ | ✓ | 🔒 | 🔒 | 🔒 |
| Read any clinical note | ✓ | ✓ | ✓ | 🔒 | 🔒 | 🔒 |
| Write clinical notes | ✓ | 🔒 | ✓ | 🔒 | 🔒 | 🔒 |
| Sign notes | ✓ | 🔒 | ✓ | 🔒 | 🔒 | 🔒 |
| Manage note templates | ✓ | ✓ | — | 🔒 | 🔒 | 🔒 |
| Money | ||||||
| See invoices and balances | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Raise invoices | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Take payments | ✓ | ✓ | — | ✓ | ✓ | — |
| Refund | ✓ | ✓ | — | — | ✓ | — |
| Void invoices | ✓ | ✓ | — | — | ✓ | 🔒 |
| Apply discounts | ✓ | ✓ | — | — | — | 🔒 |
| Submit claims | ✓ | ✓ | — | — | ✓ | — |
| Change prices | ✓ | ✓ | — | — | ✓ | — |
| Reports | ||||||
| Operational | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Financial | ✓ | ✓ | — | — | ✓ | — |
| Clinical | ✓ | ✓ | ✓ | 🔒 | 🔒 | 🔒 |
| Marketing | ✓ | ✓ | — | — | — | ✓ |
| Communication | ||||||
| Send messages | ✓ | ✓ | — | ✓ | — | — |
| Send campaigns | ✓ | ✓ | — | — | — | ✓ |
| See message history | ✓ | ✓ | ✓ | ✓ | — | ✓ |
| Connect a mailbox | ✓ | ✓ | ✓ | ✓ | — | — |
| Read their mailbox | ✓ | ✓ | ✓ | ✓ | — | — |
| Attach mail to a client | ✓ | ✓ | ✓ | ✓ | — | 🔒 |
| Setup | ||||||
| Practice settings | ✓ | ✓ | — | — | — | — |
| Permissions | ✓ | ✓ | — | — | — | — |
| See the Security Centre | ✓ | ✓ | — | — | — | — |
| Act on security | ✓ | ✓ | 🔒 | 🔒 | 🔒 | 🔒 |
A manager holds everything an owner does except writing notes, signing them and deleting a client. The first two because a signature is a professional attestation belonging to the clinician; the third because deciding a record may stop existing should not arrive with the job — though an owner may grant it to a manager they trust with it.
Why some switches are locked
A lock is stronger than a default. It says this role may never hold this permission, however the practice edits its settings.
| Locked | Reason |
|---|---|
| Clinical records, for front desk / accounts / marketing | Clinical records are limited to the people providing care. |
| Writing and signing notes, for a manager | A signature is a professional attestation and belongs to the clinician. |
| Note templates, for front desk / accounts / marketing | A note template is the shape of a clinical record. |
| Deleting a client, for everyone but owner and manager | Archiving hides a record and keeps it. Deleting one is for an owner. |
| Altering financial records, for marketing | Marketing has no reason to void or discount anything. |
| Acting on security, below manager | Ending somebody else's session belongs with whoever runs the practice. |
They exist so a practice cannot configure itself into a clinical or legal problem it would only discover during an audit.
Changing somebody's access
Manage → Permissions.
- Changes take effect immediately — the person is signed out so there is no window where the old access still works.
- Owner access cannot be reduced. Unticking a box against the owner row does nothing.
- The last active owner cannot be removed.
Give the least that lets somebody do the job
Not because anybody is suspected. A login is a target, and the damage a stolen password can do is exactly the damage that login was allowed to do.
Two habits worth keeping:
- When somebody's job changes, take away what they no longer need at the same time as granting what they now do. The second half is the one that gets forgotten.
- Review quarterly against the staff list. People accumulate access.
Previewing another role
An owner or manager can view as another role. Permissions genuinely narrow to that role's — the server enforces it — so a manager checking what reception sees is actually refused the things reception is refused.
The activity log still records who did it. It never says "front desk" because the owner happened to be previewing at the time.