Users, Roles & Permissions

Equipt/PO and Landscapt/CRM access are controlled by two independent mechanisms, not one unified role model:

• The organization role — a single value on every user's profile (profiles.role): admin, manager, purchaser, technician (shown as Staff), viewer, requestor, or crew. This is the role you pick when inviting someone from Settings → Users, and it's what gates Equipt (CMMS) and PO access.
• CRM custom roles — a completely separate, org-defined permission system for Landscapt, managed at CRM Settings → Roles. Each role is a named set of on/off switches (over a hundred of them — client access, scheduling, accounting, reports, and more) stored as JSONB, closer to Service Autopilot's permission model than to the seven fixed organization roles.

These are the only values profiles.role can hold. Every staff login has exactly one.

A snapshot of what each organization role can do, drawn from the role descriptions shown in Settings → Users → Roles.

"None by default" for CRM access means the organization role alone doesn't grant it — an admin has to separately link the user to a CRM role via CRM Settings → Employees. Client portal accounts are a different login entirely — see the Client Portal guide.

CRM access is governed by crm_roles — organization-defined roles you build yourself at CRM Settings → Roles, not the seven fixed organization roles above. Each role is a flat set of permission keys (client_add, acct_add_modify_invoices, sched_dispatch_board, and well over a hundred others across Home, CRM, Scheduling, Accounting, and Mobile) that you toggle on or off per role.

To give someone CRM access, two things have to both be true:

1. They have a crm_employees record linked to their login. On the employee record, pick the login from the Select a user to link… dropdown — it lists active users who aren't already linked to another employee, and once linked it shows their name and email.
2. That employee record points at an active (non-deleted) crm_roles row — the specific CRM role that defines what they can see and do inside Landscapt.

Without both, a user with a perfectly valid organization role (say, Manager) is blocked from the CRM module entirely — the CRM access gate checks for a crm_role_id, not for anything on profiles.role. The Landscapt tile on their Home screen reflects this too: it only appears once both conditions above are met, so an unlinked user simply doesn't see a tile that would otherwise dead-end in a "not linked" screen.

Money actions are checked inside the database, per permission. Having CRM access is not enough to move money: refunding or voiding a payment needs the refund/void or delete-payment permission, recording or editing a payment or credit needs Add/Modify Payments or Credits, applying money or credit to an invoice needs the payment or credit permission, and merging invoices, invoicing a project milestone and reconciling an invoice's payments need Add/Modify Invoices (reconcile accepts the payment permissions too). The same keys the buttons use are enforced on the server, so a role without them is refused even if it calls the action another way.

Cancelling jobs and bulk-editing clients are enforced the same way. Setting a job to Cancelled needs the Cancel Job permission, and changing a field (account type, source, priority, email opt-in, do-not-market, or status to Inactive) on more than one client at a time needs Bulk Edit. Editing one client at a time only needs the normal client edit permission. A role without the permission sees a "You do not have permission" error rather than a silent failure.

Creating and changing records is checked inside the database too. These permissions are enforced on every save, not just by hiding buttons:

• Invoices and invoice lines need Add/Modify Invoices. Without it, a role can still print or QuickBooks-sync an invoice it can see (which locks it and moves a draft to Printed), but not unlock it or change it. Marking an invoice Sent, or emailing it, needs Email Invoices. Generate Snow Invoices and Create Invoices from Contracts let a role create the draft invoices those screens generate. Completing a visit, or a one-time job, still creates its automatic invoice for anyone allowed to complete it. Once a job has been invoiced, changing its service rates, quantities or taxable flag needs Add/Modify Invoices.
• Job materials on an invoice: anyone who can work a job's Products list can take a material off its invoice (Remove from Invoice, Used — do not Invoice, Not Used) while that invoice is still an unlocked draft; the invoice line and totals update with it. Once the invoice has been printed or sent, that needs Add/Modify Invoices, and a locked invoice must be unlocked first.
• Estimates (and their line items, sub-items, equipment, direct costs, photos and payment-plan milestones) need Add Estimate to create and Edit Estimate to change or delete. Add Estimate alone also covers finishing a new estimate you created that hasn't been sent. Send Estimate alone can mark an estimate sent (and nothing else), and Add Job alone can mark an open estimate accepted when converting it to a job.
• Project billing milestones need Add/Modify Projects or Add/Modify Invoices. Once an estimate is converted to a project, its milestones belong to the project: they show as read-only on the estimate for a role that can edit estimates but not projects. Converting the estimate (Add Job) carries them onto the project. Invoicing a milestone, or changing whether it is invoiced, needs Add/Modify Invoices on either screen.
• Contracts (and their notes) need Add, Edit or Delete Contract for each action; Create Invoices from Contracts may only record the billing dates it stamps.
• New jobs need Add Job (a project also allows Add/Modify Projects).
• Tickets need View/Modify Tickets to edit, close, reassign, delete or restore. A crew login can still edit a ticket it created itself (for example a field upsell suggestion).
• Campaigns need Send/Launch Campaign to be scheduled or sent (including Mark Scheduled), Edit Campaign for other changes and Delete Campaign to delete.
• Services need Add, Edit or Delete Service (or the Scheduling settings permission). Settings → Accounting (tax rate, ACH, card fee, invoice numbering) needs the Accounting settings permission (or Company or CRM settings).
• Automations need Create/Modify Automation; Stop Automation alone can only switch one on or off. Document templates and packages need their Add, Edit or Delete permission. Teams need Teams; the Dispatch Board permission can still add an employee to a crew's roster and set a crew's default equipment.
• Schedules (the recurring-schedule templates) need the Scheduling settings permission to edit, rename, switch off, delete or reschedule; without it the Schedules page and sidebar item are hidden. Add Job can still create a new schedule from a job's Recurring Schedule picker.

Editing an existing job, its visits and crew time stays open to every CRM role in the database, since the crew app writes those. Rescheduling, re-crewing, completing and bulk-updating visits from the office, generating visits and changing a job's materials need one of the scheduling permissions: Dispatch Board, Waiting List, Manage Snow Dispatch, View Jobs or Add Job. Giving an invoice its number (which happens when it is printed, emailed or saved) is open to anyone who can see the invoice.

Client notes, stored card and balance are protected on write. Changing a client's Office Notes needs View Notes. Changing the stored payment method, or turning autopay on, needs View Credit Card #'s plus Add/Modify Payments. Changing a balance directly needs View Balance plus Add/Modify Credits (balances recalculated from invoices and payments are unaffected). Turning autopay off is always allowed. Still hide-only: View Notes, View Credit Card #'s, View Balance, View Billing and Export Lists control what the screen shows and offers, but the data itself is not hidden from a login that queries it directly, and exports are built in the browser from rows already loaded.

Report permissions live on the role editor's Reports tab and work in two layers, both enforced server-side:

• View Report Center (Home > Report Access) is the front door. It is required to open the Report Center, and — as of the latest reporting changes — to run or save a custom analysis, open a saved report, view a Custom Dashboard, or use the Graphics Library. Manage Report Center additionally allows building those and editing the KPI Scorecard, and is also what lets someone create or change dashboards, custom reports and scheduled report emails. The database itself refuses those writes without it, so a view-only role can't do them any other way.
• View & Edit Payroll Report (Home > Report Access) unlocks the Payroll tab in the Report Center, where each person's Start Day / End Day hours are reviewed, corrected and exported. Admins always have it; the seeded Owner, Operations Manager and Office Admin roles have it by default. A profile role of Manager alone does not grant it.
• Individual report keys under CRM Reports, Scheduling Reports, and Accounting Reports each unlock one pre-built report by name (Client Balance, Job Cost Summary, A/R Aging Report, …). The same keys also gate the raw datasets behind custom analyses and dashboard panels, so a role that can't see a payroll or accounting report can't rebuild it ad hoc either: Employees needs Employee Directory; Timesheets needs Job Hours Summary or Employee Directory; Invoices and Invoice Line Items need Invoiced Income by Client, Invoices with Balances, or A/R Aging Report; Payments needs Payment Audit Summary or one of those three; Estimates and Estimate Line Items need View Estimates, Estimates by Stage, or Won Estimates by Service. A dashboard panel the user can't query shows "You don't have permission to view this panel" rather than failing the whole dashboard.
• Dashboard Access (Home > Dashboard Access in the role editor) has one View key per built-in dashboard — Equipt Dashboard, My Day, Reports Dashboard, KPI Scorecard, Driver Safety Scores, Company Report, Social Media, Custom Dashboards, Job Costing, Estimate Builder, and Calculators. A role without a key doesn't see that dashboard in the Dashboards sidebar or overview, and opening its URL directly is blocked. Admins always see everything. A login with no Landscapt role sees none of these dashboards, with one exception: Equipt-only staff (a shop mechanic, say) still get the Equipt Dashboard and Driver Safety Scores based on their organization role. Existing roles were given every Dashboard Access key on, so nothing disappeared when the keys were introduced.

1. Go to Settings → Users. Only Admins see the Invite User and Create Crew Account buttons.
2. Click Invite User, enter their name, email, and pick one of the organization roles.
3. For anyone who isn't an Admin or Crew, optionally pick a Landscapt role. Landscapt access comes from a Landscapt role on an employee record, not from the login role, so choosing one adds them to your employee list and links the two for you. Leave it blank and they can sign in but see a "No Landscapt access yet" screen until an admin links them under Team → Employees. The invite email names your company.
4. They receive an email invitation and set their own password on first login. If the email is already registered elsewhere in the system, a password-reset link is sent instead so they land on the same set-password screen. If the email belongs to a different type of account, such as a client portal login, or to a user in another organization, the invite is refused with a message; use a different email.
5. An Admin can resend a pending invite, change a user's role, or deactivate them at any time from the same table. Deactivating revokes their login outright — it's not just a status label, it bans their account the same moment, so they can't sign in again, and a session that's already open loses access to your organization's data immediately rather than lingering until it expires. A deactivated user shows an Inactive badge and a reactivate icon in place of the trash icon; clicking it restores their login immediately, with their role and any CRM employee link untouched. A deactivated user can't be re-invited (use Reactivate instead), and a deactivated admin can't use the invite, reset-password or deactivate actions. Marking the user's CRM employee record inactive has the same effect on permissions: a deactivated employee keeps no CRM or role permissions until reactivated. Setting an employee's Employment Status to Terminated does the same as deactivating them (and moving them back out of Terminated reactivates them). Deactivating or terminating an employee also takes them off every crew roster, so Start Day and Start Job no longer clock them in, payroll no longer carries them and the crew's headcount drops. Reactivating does not put them back on a crew; add them to a crew again (a Schedule Jobs Directly person gets their one-person crew back automatically). For a shared crew login, this only affects sign-in — to take the crew itself off the Dispatch Board, turn it off under Team → Crews instead.

A separate Create Crew Account flow (also Admin-only, same page) creates a shared login for a field crew team rather than an individual — you set a team name and a password directly, and the credentials are shown once, at creation time. If that password is lost or needs changing later, an Admin can set a new one for the account directly from the Users table. If you leave the optional Login Email blank, the login gets an auto-generated address ending in @crew.landscapt.com; those aren't real mailboxes, so they can't receive a normal password-reset email. Type a real email instead if you want one.

Creating a crew account also creates a matching Landscapt crew and links the login to it, so the crew has a schedule the first time they sign in. If a crew with the same name already exists and has no login, that crew is linked instead. You can re-link or unlink at any time under Team → Crews → Linked Login. The password must not be a common or previously breached one — a weak password is rejected with a message asking for a longer, less guessable one.

An Admin invites maria@greenlawn.com as Staff. What happens immediately, and what doesn't:

• Maria gets an invite email and sets her own password.
• On first login she has full Equipt access: she can create and manage work orders (not just ones assigned to her), log labor and meter readings, submit maintenance requests, and create purchase requisitions and POs for maintenance parts.
• She cannot approve any requisition or PO — Staff isn't an eligible approver role.
• She cannot open Settings, invite other users, or change anyone's role.
• She cannot open Landscapt/CRM at all yet — inviting her as Staff only set her organization role. If she also needs CRM access (say, to see client jobs tied to a work order), an admin has to separately create a crm_employees record for her at CRM Settings → Employees and assign one of the org's CRM roles. Until that happens, she's blocked from every CRM route.

Two more access modes exist outside the organization-role / CRM-role pair above:

• Crew accounts — a shared login (organization role crew) for a field team rather than a person. A crew login is confined to the crew field surface only: viewing and completing assigned jobs, submitting maintenance requests, viewing the Labor Efficiency and Driver Safety Scores dashboards, and uploading photos to job sites. It has no access to purchasing, assets, inventory, settings, or the rest of the CRM module — even attempting to load a CRM route outside the crew surface is blocked, regardless of what a crm_role_id might otherwise allow.

  What a crew login can change is deliberately narrow: it may update only the visits belonging to its own crew, and cannot move a visit to a different crew. Jobs and job service lines are read-only to a crew account, so a crew can never alter a service's price — pricing is only editable by staff roles with the relevant permission. Invoices and payments are not readable by a crew login at all.

• Hiding prices from crews. Settings → Landscapt → Hide pricing from crew accounts stops service prices from being sent to crew devices at all — not merely hidden on screen. With it on, no rate is included in the data the crew app requests, so prices can't be recovered from a shared tablet. Leave it off if you want crews to see what a job is worth.
• Client portal accounts — an entirely different login system for Landscapt's customers (not staff), separate from everything on this page. A client portal login can only ever see that client's own account — billing, services, estimates, tickets, and documents — never any staff surface. See the Client Portal guide for how portal access is granted and what a client can do with it.

• Role dropdown looks editable, isn't always effective. Non-admins see the role selector as disabled in the UI, but the real enforcement is server-side (RLS plus a database trigger) — the disabled control is just there to avoid misleading anyone.
• Changing someone's organization role never touches their CRM role. Moving a user from Staff to Manager doesn't grant or revoke any CRM permissions — those two systems are independent, so check both when adjusting access.
• Photo Module access is a separate per-user toggle, not tied to organization role — except Admins, who always have it on, and Requestors, for whom it doesn't apply.
• A deleted (soft-deleted) CRM role silently revokes access. If a crm_roles row an employee is assigned to gets deleted, that employee loses CRM access the same as if no role were assigned at all — nothing on the user record itself changes to indicate why. To prevent that, the app now refuses to delete a role while employees are still assigned to it ("N employees are still assigned to this role. Reassign them to another role first."); move them to another role, then delete.
• The employee record has a third, unrelated "User Role" field — it grants nothing. CRM Settings → Employees → an employee's User Settings tab shows a User Role field with options like Admin, Manager, Staff, Purchaser, and Viewer — the same familiar names as the organization role. It is purely a display label on crm_employees.user_role and has no effect on access anywhere in the app. Once the employee is linked to a login, it's auto-populated from that login's real organization role and shown read-only, so it can't drift out of sync — before a login is linked, it's just a manually-set label. Don't confuse it with either the organization role or the Landscapt Role (crm_role_id) on the same tab.

• Deactivating a role. An inactive role grants nothing, so Landscapt asks before deactivating one and says how many active employees hold it. A role that active employees still hold can't be deactivated or deleted until they're moved to another role.
• The owner's employee record. Signing up creates an employee record for the owner with the Owner role, so they show up in sales rep and assignee pickers and in My Day's “Mine” view from day one.
• Who can change a role or linked login. On an employee record, only an admin can change the Landscapt Role or link and unlink a login. Other roles with Edit Employee see those controls disabled.
• Permission changes apply within a minute. A changed role reaches people already signed in within about a minute, or as soon as they return to the browser tab.
• Sequence approvals. Approving or rejecting a held automation message needs an admin, a manager, or Create/Modify Automation. The Approvals button is hidden from everyone else.
• Report Center data. Running reports needs View Report Center, checked in the database as well as on the page. Crew logins can still see the dashboards shared with crews.
• Invites. An invite can only give a Landscapt role that is active. Inviting someone whose old employee record is inactive (a re-hire) links and reactivates that record.