Your team works in the admin app, and each person sees only what their role allows. ClientOS ships with six built-in roles and lets you build your own from 122 individual permissions, so a writer never sees your margins and a bookkeeper never sees your client list unless you want them to. This page covers inviting staff, roles, the permission groups, security policy and the audit log.

Where things live#

Screen	Menu path	Route	Permission
Team members and roles	Avatar menu → Team	/team	See the team
Team policy	Settings → Team	/settings/team	Team policy
Your own security	Avatar menu → Security	/settings/security	Everyone
Audit log	Settings → Logs	/settings/logs	Audit log

The team screen#

Team shows Team size, Utilisation, Delivered this month and Invited, and has two tabs:

• Members: everyone with their Status, Role, Load (work held against their capacity), Delivered and On time. Tabs filter Current, Active, Invited, Archived and Deleted, and you can sort by Busiest or Most delivered.
• Roles: every role with its description, and a Who can see what matrix showing which sections each role reaches.

Member status	Meaning
Active	Signed in and working.
Invited	Added but hasn't signed in yet.
Archived	Can't sign in; can be restored.
Deleted	Left the team for good; still named on their work.

Invite a team member#

1. Go to Team and click Invite member.
2. Enter Name and Email.
3. Choose a Role. Only roles you could grant in full are offered. Sensitive permissions in the chosen role are listed under it.
4. Set Capacity: how many pieces of work they can hold at once. Zero keeps them off the delivery rota, which suits an owner or a bookkeeper.
5. Click Send invite.

They can sign in as soon as you add them. Staff sign in with an emailed six-digit code, the same as clients, and can set a password and two-factor authentication under Security. There's no invitation link to lose.

Manage members#

From a member's row:

• Change their Role from the dropdown.
• Edit their name, email and capacity.
• Resend invite if they haven't signed in yet.
• Archive them. They can't sign in from then on, and their name stays on their orders, tickets and notes. Restore them any time from the Archived tab.
• Delete permanently an archived member. They leave the team for good and can't be restored, but their work stays and is still credited to them.

Built-in roles#

Role	Summary
Owner	Everything, including billing, the price book and team management.
Ops manager	Orders, clients and reporting. No payments or price book.
Account manager	Their accounts, orders and leads. No costs or inventory.
Writer	Their own assigned work and nothing else.
Outreach	Their own assigned work. No prices, margins or client list.
Finance	Revenue, invoices, payments and margin. No content or delivery.

What each built-in role can reach, in short:

Role	Can reach
Owner	Every permission, including any added in future updates.
Ops manager	The dashboard (without money), all orders, tickets, chat, the task board, clients and companies, subscriptions (view), reports, read-only store, the team and roles (view), and process settings (orders, tickets, clients, messaging, saved replies, tags, templates).
Account manager	The dashboard (without money or capacity), orders, tickets, chat, the task board (view), clients and companies, referral partners, leads, invoices (view and send), subscriptions (view), reports, the price book (view) and saved replies.
Writer	Their own assigned orders and their tasks. No prices, no contact details.
Outreach	The same as Writer today. Kept separate so the two can diverge.
Finance	The money dashboard, orders (view and export), clients (view, contact details and export), invoices, payments, refunds, account credit, subscriptions, expenses, profit and loss, reports, coupons, referral payouts and payment settings.

Build a custom role#

1. Go to Team → Roles and click New role.
2. Enter a Name (for example "Junior writer") and a One-line description.
3. Under Start from, pick an existing role to copy, or Nothing — start empty.
4. Tick the permissions the role should have. Use the filter to search all 122, for example "refund", "margin" or "settings". Sensitive permissions are highlighted.
5. Click Create role.

Edit a role from the Roles tab and click Save. Changes apply to everyone in the role on their next click.

When you tick a permission that depends on another (for example "Assign work" needs "See orders"), the editor ticks the one it depends on for you.

Rules that keep roles safe#

• You can't grant more than you hold. Creating, editing or inviting with a role is refused if it includes a permission you don't have.
• The Owner role can't be narrowed. It always holds every permission. You can rename it.
• Someone must always manage the team. The last person able to manage the team and roles can't be moved out of that role or archived.
• A role with members can't be deleted, and built-in roles can't be deleted at all.
• Nobody changes their own role.
• Nobody demotes or removes a teammate who can do more than they can. Such members are marked Can do more than you.

Permission groups#

The 122 permissions are grouped in the role editor under these headings. Most groups follow the same pattern: a "see" permission for reading, then separate permissions to create, edit, delete or export.

Group	Covers
Overview	The dashboard, and each of its panels separately: revenue and margin, what needs a decision, at-risk work, team capacity and recent activity.
Orders	Seeing all orders or only Their own orders, See prices, placing, editing, assigning, delivering any order, cancelling or refunding, deleting and exporting.
Tickets	Seeing, opening, replying, assigning, closing and deleting tickets.
Messages	Using chat, sending messages, managing conversations and deleting other people's messages.
Tasks	Seeing the task board, unassigned tasks and everyone's tasks, and adding, completing, assigning and deleting tasks.
Clients	Seeing clients, See contact details, adding, editing, deleting or merging, exporting, View the portal as a client, seeing and changing companies, and referral partners and payouts.
Billing	Invoices (see, raise, edit, send and chase, void, export), recording payments, refunds, adjusting account credit, and subscriptions (see, start, edit, cancel, charge now).
Books	Expenses (see, log, edit, delete), Costs and margin, exporting the books, and reports (see, export and send).
Store	The price book (see, add, reprice, remove), forms (including publishing), coupons, and traffic tracking links.
Sales	Leads (see, add, work, delete) and Connect the website for website lead capture.
Team	Seeing the team, inviting, changing and removing teammates, and seeing, creating, editing and deleting roles.
Settings	One permission per settings screen: company, payments, team policy, modules, integrations, storage, orders, tickets, clients, messaging, saved replies, tags, templates, client portal, emails, language, audit log and import.

Permissions flagged as sensitive are the ones that show cost or margin, move money, expose contact details or hand someone the keys: for example Revenue and margin, Costs and margin, Refund a payment, Export clients, View the portal as a client, Invite someone and most settings.

Assigned-only access#

Two permissions decide how much of the order list someone sees:

Permission	Sees
See orders	Every order.
Their own orders	Only orders assigned to them.

The Writer and Outreach roles hold only Their own orders, so they open and deliver their own work without seeing anyone else's, the client list, or any prices. Without See prices, amounts are hidden throughout the order screens. See Orders and delivery.

Settings → Team#

Rules that apply to everyone you invite.

Option	What it does
Default role	The role pre-selected when you invite someone. Roles wider than your own access are disabled.
Tell the team when someone joins	When an invited member signs in for the first time, everyone who can see the team page hears about it, in the bell and by email.
Require two-factor authentication	Applies to every admin account. Members without it are prompted at their next sign-in and can't skip. Once required, they can't turn it off.
Sign out inactive sessions	Signs out a team member's session after 15 minutes, 30 minutes, 2 hours or 8 hours with no activity, and the sign-in screen tells them why. A tab left open doesn't count as activity. Off until you turn it on.

Two-factor authentication#

Anyone can turn on two-factor authentication under Security: click Set up, scan the QR code with an authenticator app, enter the code and click Turn on. Ten single-use backup codes are shown once; save them somewhere safe. At sign-in, after the emailed code or password, they enter the six-digit code from their app or choose Use a backup code.

With Require two-factor authentication on, team members must set it up before they can continue. Clients choose for themselves in the portal.

What happens when access is missing#

ClientOS hides what a role can't reach:

• Menus are filtered. The sidebar, ⌘K search and settings list show only pages the person can open.
• 404, not 403. Opening a page or calling the API without the permission returns "not found" rather than "forbidden", so nobody can probe which pages or records exist.
• Fields are left out, not blanked. Without See contact details, See prices or Costs and margin, those values aren't sent to the browser at all.
• Changes apply immediately. Narrowing a role takes effect on the person's next click; there's no need to sign them out.

Modules strip permissions#

When you turn a module off under Settings → Modules, its permissions stop working for every role. For example, turning off Helpdesk removes every ticket permission and Ticket settings, and its pages and API answer as though they don't exist. The permissions come back, and nothing is lost, when you turn the module on again. See Settings reference.

The audit log#

Settings → Logs records every change made through the product: who made it, what area, which record, and when. It's append-only, so nothing in it can be edited or removed.

Filter by:

• Area: Orders, Billing, Clients, Tickets, Tasks, Expenses, Referrals, Reports, Messages, Sales, Settings, Sign-in and Automatic (changes made by the system).
• Who: anyone on the team, or Automatic.
• Record: one specific record.

Role changes, invitations, "Sign in as" sessions, shared invoice links and settings changes all appear here.

Tips#

• Start custom roles from the closest built-in role, then remove what they shouldn't have.
• Give contractors Writer so they see only their own work.
• Turn on Require two-factor authentication before inviting anyone who can see money.
• Set capacity honestly. It drives the load figures and the team capacity panel on the dashboard.