> ## Documentation Index
> Fetch the complete documentation index at: https://docs.assetinfinity.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Role reference

> The twelve default roles and what each one can actually do.

Every new organisation starts with twelve roles. They are a starting point — you can change what
each includes, and add your own.

## The roles

| Role                          | For                            | In short                                                                                 |
| ----------------------------- | ------------------------------ | ---------------------------------------------------------------------------------------- |
| **System Administrator**      | The person who owns the system | Everything                                                                               |
| **Maintenance Administrator** | A senior maintenance lead      | Everything maintenance, plus most configuration                                          |
| **Maintenance Manager**       | Running the department         | All maintenance and reliability; inventory and tools read-only; may approve requisitions |
| **Maintenance Planner**       | Planning the work              | Full control of work and maintenance plans; reads assets, inventory and vendors          |
| **Maintenance Supervisor**    | Running the shop floor         | Assigns, edits and closes jobs; moves rounds; records failures                           |
| **Technician**                | Doing the work                 | Own jobs, meter readings, stock movements, tools, failures, photographs                  |
| **Storekeeper**               | The stores                     | Full inventory and tools; reads jobs; raises requisitions                                |
| **Procurement User**          | Buying                         | Full procurement; reads vendors and inventory                                            |
| **Vendor**                    | An external contractor         | Only the jobs given to them, and the assets those concern                                |
| **Requester**                 | Anyone who reports faults      | Raise and see their own requests; view assets                                            |
| **Auditor**                   | Compliance                     | Read and export everything; full audit access. Changes nothing                           |
| **Executive**                 | Leadership                     | Read everything; full analytics                                                          |

## Where the boundaries sit

<AccordionGroup>
  <Accordion title="Supervisor against Planner">
    A supervisor **moves** a preventive round; only a planner decides it stops happening. The
    supervisor owns today; the planner owns the schedule.
  </Accordion>

  <Accordion title="Technician against Supervisor">
    A technician may **add** a photograph or a comment to a job; they may not remove one. A
    supervisor may. The photograph of the thing you were sent to fix is evidence, and evidence
    should not be removable by the person it concerns.
  </Accordion>

  <Accordion title="Technicians and meter readings">
    Technicians can create *and* edit meter readings. Taking a reading is the most ordinary thing a
    technician does — a role that could fit a new meter and then not write a number on it would be
    an inversion.
  </Accordion>

  <Accordion title="Manager against Storekeeper">
    A maintenance manager **reads** inventory but does not move stock; a storekeeper moves stock but
    does not plan maintenance. A manager can approve a requisition.
  </Accordion>

  <Accordion title="Vendor">
    Deliberately narrow. A vendor sees the jobs given to them and the assets those concern — not
    your asset register, not your other vendors, not your costs.
  </Accordion>

  <Accordion title="Asking the copilot against accepting its suggestions">
    A technician may **ask** the [copilot](/analytics/copilot) and read what comes back — somebody
    standing at the machine wanting to know how to repair it is the whole point of the feature. They
    may not **accept** a suggestion, because accepting writes to a record, and that stays with the
    roles that already edit one.

    Agreeing to switch the copilot on at all is a configuration permission, not a maintenance one.
  </Accordion>

  <Accordion title="Auditor against Executive">
    Both read everything and change nothing. An auditor additionally gets the **audit trail** —
    field-level history of who changed what. An executive gets analytics instead.
  </Accordion>
</AccordionGroup>

## Combining roles

Give somebody several and they get the union. A working combination is Planner + Supervisor for a
small plant where one person does both.

## Making your own

Add a role and choose its permissions. Permissions are grouped by area — assets, work, maintenance,
inventory, tools, workforce, vendors, procurement, reliability, analytics, documents, admin — and
each has view, create, edit and delete where those make sense.

<Note>
  The twelve defaults are marked as system roles. You can change what they contain, but the codes
  stay, so the [dashboards](/get-started/dashboards) keep knowing which board to offer whom.
</Note>

## Which dashboard each role gets

| Role                                                                 | Boards                           |
| -------------------------------------------------------------------- | -------------------------------- |
| System Administrator, Maintenance Administrator, Maintenance Manager | My work · Operations · Executive |
| Planner, Supervisor                                                  | My work · Operations             |
| Executive, Auditor                                                   | My work · Executive              |
| Everyone else                                                        | My work                          |

## Roles are not scope

A role says **what** somebody may do. It does not say **where**. Site and asset access do that, and
they are set per user — see [people and access](/setup/access).


## Related topics

- [People and access](/setup/access.md)
- [Notifications](/config/notifications.md)
- [Administered lists](/config/administered-lists.md)
- [Currency and exchange rates](/config/currency.md)
- [Root cause and corrective actions](/assets/root-cause.md)