Access Control

Roles get most people the right access on day one — Access Control is for everything past that. Trim a role for your shop, grant one person one extra ability for a week, and see exactly what would be blocked before enforcement is switched on.

Roles

Every shop starts with the built-in roles — Owner, Administrator, Manager, Service Advisor, Technician, Apprentice — each with sensible defaults for what they can see and do. Built-in roles are read-only so there's always a known-good baseline; to tailor one, clone it into a custom role and tune the permission list, or build a custom role from scratch for setups the built-ins don't cover (a parts manager, a detailing lead).

Permissions are atomic and readable — repair_orders.edit, payments.record, reports.view — grouped by area, each with a plain-language description. A role is just the set of them it grants.

Per-person overrides

Click a person under Users & permissions to adjust just them. An override sits on top of their role: grant an ability their role lacks, or deny one it includes, without touching anyone else.

Overrides can be temporary — give the apprentice inventory.receive until Friday and it reverts on its own, no follow-up needed. Each permission also shows why it resolves the way it does (from the role, from an override, and any scope limits), so the answer to "why can't I…?" is on the screen.

Enforcement — preview first, then flip the switch

Access Control ships in shadow mode: everything is allowed as before, but every action that would be denied under your current setup is recorded in the Would-be denials table. Run the shop for a few days, review the table, and fix any surprises by adjusting roles or overrides.

When the table stays empty, the owner flips Enforcement on and the same rules start actually blocking. No guesswork, no morning of locked-out techs — you saw the full impact before it went live.

Every role change, override, and the enforcement flip itself land in the Audit Log, attributed to whoever made the change.