Roles and permissions
What each built-in role can do, how to make your own role from a copy, and how to choose the roles and companies each person can reach.
On this page
Everyone who signs in to the panel has a role and a set of companies. The role decides what they can see and change. The companies decide where. A person has one sign-in for every company they can reach.
Admin can do everything on this page. A custom role with users.manage can open Users and access and change people's roles, within the limits at the end of this page. Only people with the Admin role can make, change or delete a custom role.
The built-in roles
ValiCrew comes with five roles. You cannot change them, but you can copy one into a role of your own. Users and access shows them under Roles, in plain words, with how many people hold each one.
| Role | Can work on | Decides |
|---|---|---|
| Admin | Everything, including billing, users, roles and workspace settings | Everything |
| HR | Staff, the schedule and rosters, places, documents, salary and the bank salary file, requests, tasks, journeys, third parties, assets, the access register, Emiratisation and reports; sees vehicles | Leave, attendance and timesheets, PRO renewals |
| Operations | Vehicles, the schedule and rosters, places, documents, reminders, tasks, journeys, third parties, assets, the access register and reports; sees staff | Vehicles and places, not leave, attendance or pay |
| Read-only | Sees staff, the schedule, attendance, places, vehicles, documents, reports and tasks | Nothing |
| PRO | The renewal desk only | Renewal cases |
The PRO role is for a government services PRO. It is given by choosing Government services PRO as the Member type, and that account holds no other role.
Permissions for the settings screens
A custom role is a list of permissions. These are the ones that open the settings screens:
| Permission | Opens |
|---|---|
users.manage |
Users and access, Security and the Audit trail |
workspace.manage |
Group policies, Mail, File storage, most lists and Free Basic Training |
companies.manage |
Companies and each company's details |
billing.manage |
Billing |
workspace.export |
Export your data |
Make your own role
- Go to Settings and choose Users and access.
- Under Roles, in plain words, choose New role from a copy.
- In Copy from, pick the role closest to what you need, and type the New role name.
- Choose Submit. The new role opens with the same permissions as the one you copied.
- Tick or untick Permissions, then choose Save changes.
To start from nothing, choose Every permission to open the Roles list, add a role there with a Name and its Permissions, and choose Create. A role name must be new, and it cannot be the name of a built-in role.
Change or delete a custom role
Open the custom role from Roles, in plain words or from the Roles list. Change its Name or Permissions and choose Save changes. Everyone who holds the role is signed out and signs in again with the new permissions.
You can delete a custom role from the Roles list once nobody holds it. Take it off every person first. Built-in roles can be viewed, not changed or deleted. The Roles list can also copy any role under a new name.
Give a person a role and companies
- Go to Settings and choose Users and access.
- Next to the person, open More and choose Edit.
- In Roles & access, tick their Roles.
- In Company portfolio, choose Selected companies and tick the Companies, or choose All active companies, including future companies.
- Choose Save changes.
The person is signed out of any open session and signs in again with the new access. Only active companies can be picked. To bring someone new in, see Invite your team.
Limits for user managers
Someone who manages users without the Admin role:
- can only give roles whose permissions they hold themselves, and never Admin;
- can only give access to companies they reach themselves;
- cannot change an Admin, or anyone with more permissions than they have;
- can give All active companies, including future companies only if they have it themselves.
The workspace always keeps at least one Admin who can sign in. A change that would remove the last one is refused.