Users, groups and permissions

Access › Users & Employees holds every account, staff and client. Access › Groups & Permissions decides what each staff account can do.

How permissions work

• Permissions belong to groups, not to people. Each user is in a group.
• A group carries a matrix of modules and abilities, such as Tickets · View, Billing · Edit or Documentation · Reveal secrets. Every request is checked against it.
• Superadmin is not a group. It bypasses the matrix entirely. Keep superadmins few and named.
• Client portal accounts are also limited to their own client. A permission never reaches across to another client's data.

Default groups

A new install has four staff groups. Change them to fit how your team works.

Modules in the matrix

Clients, Tickets, Documentation, Billing, Operations, Approvals, Time tracking, Mail, chat and SMS, Security, Passwords, Projects, Calendar, Knowledge Base, Security Training, Sales & CRM, Devices & Agent, Reports, Website, Access & Users and Settings. Some abilities are deliberately narrow:

• Documentation · Reveal secrets and Passwords · Reveal secrets are separate from viewing, so someone can see that a credential exists without seeing it.
• Tickets · Reopen archived sensitive tickets controls who can unlock archived sensitive content.
• Clients · Compliance profile & tracker controls who can change a client's retention preset and compliance checklist.
• Time tracking · Manage all time is needed to approve timesheets.

Add a staff user

1. Open Access › Users & Employees and choose to add a user.
2. Enter their name and work email. The email is their sign-in.
3. Choose their group. Give the least access that lets them do the job.
4. Set their tier. Tier 2 technicians receive SLA escalations.
5. Send the invitation. They set their own password from a single-use link.

Invitations that are not used expire. You can resend one from the user's record.

When a staff member leaves

1. Disable the account the same day. Do not delete it: tickets, time entries and audit records refer to it.
2. End their sessions and remove their two-factor devices.
3. Revoke any API keys they created.
4. Reassign their open tickets and the clients they managed.
5. Rotate shared credentials they could see.

Disabling an account, resetting a password and changing a group are all recorded in the audit log.

Review regularly

• Grant access on request, with the reason recorded, rather than giving wide access by default.
• Treat delete rights as the exception. Trash and restore covers most mistakes, but not all.
• Each quarter, compare the matrix with real job roles and with the audit log.