People and access

The Access screen is where you add people to your organisation, decide what they may do and how widely they reach, and record who may decide in somebody else’s name.

Open it from Administration → Access. It has three tabs:

Tab	What it holds
People	Every account in the organisation — people and service accounts — with their roles, reach and sign-in status
Roles	Roles, what each may do, and how far each reaches. See roles and permissions
Delegation	Who may approve in another person’s or a role’s name. Only shown to people who can view roles

The stat strip counts users, invited (only when somebody is waiting on an invitation), roles and permissions.

The two things that decide access

What somebody can do is their roles. How widely they can do it is their scope — the sites and places they are granted. The two are independent: a powerful role scoped to one site is narrow, and a modest role with no scope reaches the whole organisation.

No grants means every site. A person with no site or place grants reaches every site in the organisation, not none. Granting their first site narrows them from everything to that one; removing their last widens them back to everything. The screen says “every site” in as many words, and the sentence above the table counts how many people have no site grants.

Scope is enforced by the server on every read. Somebody who cannot reach a site cannot reach it by typing an address either. Changes take effect on their next request — they do not need to sign out.

Warnings at the top of the screen

Banners appear above the tabs when something needs attention, and only then.

Banner	When it appears	What to do
One account is locked out / {n} accounts are locked out	Somebody has entered a wrong password too many times. Shows the number of failed attempts and when the lock ends.	Unlock now clears the lock and the attempt counter, and is recorded in the audit trail under your name. A very high attempt count is worth looking into before clearing. Shown on every tab.
Two-step sign-in	At least one person has set up an authenticator. Lists who is Enrolled, how many recovery codes each has left, and who is Not set up.	Clear it removes somebody’s authenticator and voids their recovery codes — the way back for a lost phone with no codes left. You give a reason; they are emailed, and it is recorded against you.
{n} accounts have no role	An account exists with no role — it can sign in and do nothing.	Grant a role from their row. New invitations cannot be sent without one.
One invitation has expired / {n} invitations have expired	An invitation ran out before it was accepted.	Send it again from their row. They cannot fix it themselves: “forgot password” needs an account that can already sign in.

The People tab

A new organisation has one role, the System Administrator, which can see and do everything. Create a narrower role on the Roles tab before inviting anybody who should not run the organisation — the invitation form warns you when the administrator is the only role on offer.

Search by name or email narrows the list. The table pages through long lists.

Column	What it shows
Person	Name, and the address or username they sign in with. Markers beside the name: service for a service account; a works number (for example W-1003) when the account is on the workforce; also in 1 other organisation when the same login is used in another organisation (a count, never the names). Click the name to open their grants.
Roles	Every role they hold. none in red means they can sign in and do nothing.
Can do	How many permissions their roles add up to.
Reaches	Every site (amber) when they have no site grants, otherwise the codes of the sites and the places they are granted.
Status	active, suspended or deactivated; for an invitation, invited with when it expires and how many times it has been sent, or invitation expired.
Last seen	When they last signed in — never, or not yet for an invitation.

A row with no role is tinted red, and a row that is not active is tinted amber.

Row actions

Action	Shown for	What it does
Send again	Invitations	Makes a fresh link and emails it again. The previous link stops working.
Withdraw (person with a minus)	Invitations	Asks first, then withdraws the invitation and removes the account with it. Use it for an invitation sent to the wrong address: until it goes, the right address cannot be invited. Nothing is lost, because an account that never accepted has done nothing.
Suspend (pause)	Active accounts	Asks first. They stop being able to sign in immediately and any session they hold is revoked. Their history stays and keeps their name. Reversible.
Reactivate (play)	Suspended or deactivated accounts	Lets them sign in again with the roles and scope they had, using the password they already had.
Set password (key)	Active people, not service accounts or invitations	Sets a new password for them — see setting a password.
View (eye)	Everyone	Shows their details, roles, reach and workforce number without changing anything.
Edit (pencil)	Everyone	Opens the edit form.
Remove (bin)	Active, suspended or deactivated accounts	Asks first, then removes them — see removing somebody.

The buttons are icons held in view at the right of the row, whatever the width of the table; hover over one for its name. Remove is drawn in red. Actions that change an account need the permission to edit users; removing needs the permission to remove users. Somebody without them can read the list but sees a note saying so, and none of the actions.

Inviting someone

Invite a person opens the Add a person form above the list. Everything is asked at once — roles and sites included — and written in one go, so there is no half-set-up account.

The Add a person form on the Access screen

The first question, How they get in, changes the rest of the form:

Choice	What happens
Send them an invitation (default)	They get an email with a link and choose their own password; nobody else ever knows it. The account becomes active when they accept. The link lasts a week and can be sent again.
Set a password now	For somebody with no mailbox, or where no mail goes out at all. The account is active immediately and nothing is sent. You pass the password on yourself, and they must change it the first time they sign in.

When you choose Set a password now, a second question appears, What they sign in with: A username — they have no email at all (the default on this path) or Their email address.

Field	What it means	Notes
Name	Their full name.	Required. Shown against everything they do — assignments, approvals, comments.
Email	Where the invitation goes, and what they sign in with.	Required unless you chose a username. No two active accounts may share one.
Username	What they sign in with when they have no email.	Only for Set a password now with a username. Required there. Letters, digits, dot, dash and underscore — a works number reads well. They sign in with it and your organisation’s code, like `tech01@ACME`.
Password	Their first password.	Only for Set a password now. Required there. Not stored as typed; they must change it at first sign-in. Must meet your password policy.
Phone	A phone number.	Optional. Used for SMS notifications and callouts.
Job title	What the job is.	Optional. Descriptive only — it grants nothing.
Reporting manager	Who this person reports to.	Optional. Approval steps assigned to “the manager” go to this person. Choose from existing accounts.
Language	Which language the app and their notifications are in.	Optional. Only on the invitation path. If left empty and your organisation asks people their language at first sign-in, they are asked.
Default screen	Where they land after signing in.	Optional. Only on the invitation path. Choose from the product’s main screens. If they lose permission to open it, they land on Today instead.
Roles	What they may do.	Required — at least one. Without a role they could sign in and do nothing, so the invitation is refused. See roles.
Sites	Which sites they reach.	Optional. Left empty, they reach every site; the first one you name starts restricting them. A site that has been switched off is not offered.
What they may do at those sites	Read, Write or Admin.	Appears once you name a site. Read to look, write to raise and complete work, admin to configure the site; what they may do at all still comes from their roles. Grants made from this form are currently saved at Read whatever you choose here — check the level in the person’s Sites panel afterwards and edit it there if needed.

Locale and timezone are not on this form — they are each person’s own, set on their profile once they accept. Send invitation (or Create the account on the password path) is enabled once the required fields are filled. What you see afterwards:

Situation	Message
Invitation sent	”Invitation sent to … They become active when they open the link and choose a password.”
The address already has an account in another organisation	They can sign in now with the password they already have; no link is sent, and your organisation appears for them at sign-in.
Password set	”… can sign in now. Give them that and the password you chose — they will be asked to change it straight away.”

The new person’s row opens straight away, ready for any further grants.

Adding people from your directory

Where your organisation has an enabled directory connection with a branch of the directory to search, Add from your directory appears beside Invite a person. Use it to add people who already have a Windows or directory account, without typing their details again. Organisations without such a connection do not see the button. Type part of a name, a Windows account name or an address and click Search. Leave the box empty to list everybody; a single character is refused, because it would match almost everyone. When you have more than one directory connection, choose which one to search first. Only the first 50 people are shown, so type more of a name to narrow a long list. Each person found shows their name, account name, address and job title. Click Add beside the one you want. What is added is what the directory holds — the name, the address and the job title — and the account is linked to the directory entry, which is what Windows sign-in matches first. Nobody is emailed. There is no invitation to accept and no password to choose: they sign in with their Windows account or their directory password, and start with the connection’s default role. The panel stays open after each addition, so you can add a team one after another.

What you see	What it means
”{name} was added.”	A new account was created and linked to the directory.
”{name} already has an account here. It is now linked to your directory.”	They were already in the organisation. Nothing else changed.
”… which is {status}. It is now linked to your directory; reactivate it if they should sign in.”	They have an account here that is not active. Reactivate it from their row if they should sign in.
Disabled in your directory, Locked out in your directory or Expired in your directory in place of Add	The directory says the account cannot be used, so it is not offered. It is shown rather than hidden so you know the search did find them.
Add greyed out	Your directory holds no address for them. Every account here needs one.

A person can also be refused when you click Add: because their address is at a domain the connection does not accept, because they already have an account here under a different address, or because their name, phone or job title in the directory is longer than the product keeps.

Warnings on the form

Warning	When	What it means
The only role here is the Administrator	Your organisation has no role but the System Administrator.	Create a narrower role first unless this person should run the organisation.
{role} is a role for somebody outside the company	You picked a role marked for people outside the company.	An account invited here is not linked to any vendor, so their screens come back empty. Invite contractors and suppliers from Commercial → Vendors → their Contacts tab → Invite instead, which writes that link. Open Vendors takes you there. An outsider also needs at least one site — the form will not send without one, because an account with no site grant reaches every site.
An account with no email address cannot be written to	You chose a username.	They will never receive a notification and cannot reset their own password; somebody with access to this screen must set them a new one when they forget it. If they have any address — even one shared with a supervisor — use it instead.

A person’s grants and workforce link

Click a person’s name to open their grants beneath the row.

A person's roles, sites, places and workforce link opened under their row

Panel	What it holds	Notes
Roles	Their roles. Grant a role adds one; each has edit and remove buttons.	”No roles” in red means they can sign in and do nothing.
Sites	The sites they reach. Grant a site adds one, with its access level.	Removing the last one asks first, because it widens them to every site.
Places	Buildings, floors or rooms inside a site. Grant a place adds one.	A place reaches what stands in it, and the site’s records that stand nowhere in particular. Where a place is already covered by a site grant, the panel says so.
Workforce	Whether work can be assigned to them.	See below.

Putting someone on the workforce

An account that signs in is not automatically somebody work is assigned to. The Workforce panel says which they are:

Already a technician — their name and works number, how they are engaged, their team, and Add them to a team / Another team… to put them in a further team.
Not on the workforce — “Not somebody work is assigned to.” Two ways in:

Button	Use it when	Fields
Put them on the workforce	They are new to the roster.	How they are engaged (Employee, contractor, agency — what the rate card is read through) · Based at (their home site, which also decides who can see them on the roster; No home site allowed) · Team (optional) · Worker number (their payroll or employee number; left empty, the next number in the sequence is used). Their name, email and phone come from the account.
They are already a technician	They are on the roster already, with skills and history, and have just been given a login.	Which technician are they? — only technicians nobody signs in as are offered. Their skills, qualifications and history stay where they are.

This panel is the only way to add a technician: every technician signs in, so the roster is built from accounts. Service accounts are never on a roster. See technicians.

Editing a person

The pencil on a row opens Edit person.

Section	Field	What it means	Notes
Identity	Email	What they sign in with and where anything addressed to them goes.	Set once — it cannot be changed after the account exists.
	Username	What they sign in with when they have no email.	Set once.
	Name	Shown wherever their actions appear.	Required.
	Phone	For SMS notifications and callouts.	Optional.
Access	Service account	An integration rather than a person.	Excluded from anything that assumes a human — no notifications, no assignment.
Reporting	Reporting manager	Who this person reports to.	Approval steps assigned to a manager use this.
	Cost centre	Where their bookings are charged when nobody chose who pays.	Optional. Left empty, such a booking is charged to nobody.
How the app reads for them	Language	The language of the app and their notifications.
	Locale	How dates and numbers are formatted for them.
	Timezone	Their own clock.	Quiet hours on notifications are read in it, so a wrong one wakes somebody up.
	Default screen	Where they land after signing in.	Falls back to Today if they lose access to it.

An account needs an email or a username, because one of the two is how they sign in. If you empty both, the form says so before it saves and marks both boxes. Status is not on the form: an account becomes active by accepting its invitation, and is suspended, deactivated or reactivated with the row actions. Fields your organisation has added in the form studio appear here too, and Edit form opens the form studio for this form if you may change it.

Service accounts

Add a service account creates an identity for an integration rather than a person. There is nobody to invite, so it is created active and nothing is emailed. It can never sign in with a password: whoever is wiring up the integration issues it a key on API keys, or on the reader it is for. The button opens the same New identity form as the API keys screen, and both make the same thing, so an identity made here appears straight away under Acts as when a key is issued.

Field	What it means	Notes
Code	A short identifier, like `stores-integration`.	Required. Lower case letters, digits and hyphens. It becomes part of the account’s address and cannot be changed afterwards.
Name	What the integration is called on screen.	Required.
What it is for	A sentence on the integration’s purpose.	Optional, but it is the first question an access review asks.
Roles	What the integration may do.	Optional. With no role it can do nothing, and a key for it would be refused, so the form warns in amber while the list is empty.

Create it makes the identity and tells you the address it was created as. It reaches every site, like any account with no site grants; narrow it to a site, or change its roles, from its row here. Service accounts show service beside their name, are never sent notifications or assigned work, and have no Set password action. The button is offered only to people who may create API keys.

Setting somebody’s password

The key button, Set password, opens a small form under the row:

Field	What it means	Notes
New password	Their new password.	Required. Not stored as typed, and not recoverable — if it is lost, set another. Must meet your password policy.
They must change it at first sign-in	Forces a change on their next sign-in.	On by default. Turned off, the password you chose stays valid indefinitely — and you both know it.

Prefer letting people reset their own password from the sign-in screen. This is for accounts with no email, or somebody who cannot receive the reset email.

Suspending, deactivating and removing

Action	Effect	Reversible
Suspend	Stops sign-in immediately and revokes their sessions. Use for leave or an investigation.	Yes — Reactivate
Deactivate	The same, for somebody who has left.	Yes — Reactivate
Remove	Takes them off the list and stops sign-in. Everything they did — work closed, readings taken, approvals given — keeps their name.	No

Removing somebody

Removing cannot be undone. If the intent is temporary, suspend instead. If they had a handset, end its sessions on Authentication first; a device can only be revoked by the person it is enrolled to, from Your devices on their profile.

How scope combines

A person reaches a record when their roles allow the action and the record is inside their scope:

Layer	Set on	Empty means
Person’s sites and places	The person’s row (People tab)	Every site
Role’s sites, places, business units, departments, asset categories and asset statuses	The role (Roles tab)	Everything
Role’s Only the assets that are theirs, Work orders they see and Work orders they change	The role’s edit form	The whole register their sites reach

See narrowing a role.

Field-level access

Who may see or answer an individual field — a cost field only planners fill in, a field hidden from contractors — is set field by field in the form studio, under Who may answer it and Hidden from. Ticking a role under Who may answer it restricts the field to the ticked roles; ticking a role under Hidden from hides it from that role only. For the product’s own fields, hiding applies to the form and the record screen, while lists, exports and reports still show the value.

Delegation

The Delegation tab records who may decide in somebody else’s name — for holiday cover, or for a committee that meets offline and has its decision recorded afterwards. A delegate is always recorded as themselves, acting on behalf of whoever they name: the decision says who clicked and whose authority they used. Nobody signs in under another person’s account.

The form for letting somebody decide in another name

The list shows each arrangement:

Column	What it shows
Delegate	Who does the deciding
May decide for	The person, or the role (marked a role), whose authority they use
Between	From and until — no end for a standing arrangement
In force	in force, not yet, lapsed or switched off
Why	The reason recorded

A line above the list says how many arrangements are in force today; only those are offered on the approval screen. Each row has Edit this delegation and Remove this delegation. Add a delegation opens Let somebody decide in another name:

Field	What it means	Notes
Who will be doing the deciding	The delegate.	Required.
In whose name	For a person — holiday cover, somebody signs for them — or For a role — a committee nobody holds as a job.	Choose one, then pick the person or the role (Whose authority). Required.
From	When it starts.	Defaults to today.
Until	When it ends.	Optional. Leave it open for a standing arrangement; an end date is what makes cover stop without anybody remembering. Cannot be before From.
Why this exists	The reason.	Recorded with the arrangement.

Grant it saves a new arrangement; Save saves an edit. When editing, switching an arrangement off stops the authority immediately and keeps the record of it.

Multiple organisations

One login can belong to more than one organisation — a consultant working across several sites, for example. After the password, they choose Which organisation?, and a switcher at the foot of the navigation moves between them. Switching moves you: you are in exactly one organisation at a time, and what you may do is decided entirely by your account there. On this screen, such an account shows also in 1 other organisation.

Users and technicians

A user signs in; a technician is somebody work is assigned to. Every technician is a user, linked through the workforce panel. Technicians themselves are managed under technicians.

Who can use this screen

To	Permission (as the grid shows it)
See the people list	Anybody in the organisation can read the directory
Invite people, or add them from your directory	User · create
Add a service account	User · create and the permission to create API keys
Edit, suspend, reactivate, set passwords, unlock, clear an authenticator	User · edit
Remove people or withdraw invitations	User · delete
See the Delegation tab and roles	Role · view
Create, edit or delete roles and their permissions	Role · create, Role · edit, Role · delete

See the permission reference.

Setting up

Configuration

The two things that decide access

Warnings at the top of the screen

The People tab

Row actions

Inviting someone

Adding people from your directory

Warnings on the form

A person’s grants and workforce link

Putting someone on the workforce

Editing a person

Service accounts

Setting somebody’s password

Suspending, deactivating and removing

Removing somebody

How scope combines

Field-level access

Delegation

Multiple organisations

Users and technicians

Who can use this screen