# Roles and permissions

ShiftTracker gives every login exactly one of 10 roles, and describes what a role may do with a catalogue of 280 permissions in 21 categories. This page lists the roles, shows how much of each category each role is granted, and then gives every permission in full. It also explains what a grant does and does not tell you.

<!-- GENERATED FILE — do not edit. Run `npm run docs:reference` after changing the sources named at the foot of the page. -->

## Which roles can somebody have?

A login has exactly one role. The role decides which part of the platform that login lands in — the organisation's application, an agency's, the employee portal, the client portal, or ShiftTracker's own internal area — and then what it may do once there. There are 10.

| Role | Who this is | Permissions granted |
|---|---|---|
| Super Admin | ShiftTracker's own operations staff. A Super Admin login is sent to the internal `/ops` area and cannot reach the ordinary application; no other role can reach `/ops`. | none in this catalogue |
| Admin | Runs one organisation, including its account settings, its users and its agency relationships. | 215 |
| Manager | Runs the rota and the people day to day. | 162 |
| Control | The control room. Watches live cover and check calls as they happen. | 64 |
| Employee | An organisation's own member of staff, using the employee portal for their own shifts, availability, timesheets and leave. | 29 |
| Agency Admin | Runs one agency: its officers, its own users, and what it puts forward against requests. | 85 |
| Agency Coordinator | Works an agency's requests and proposals without running the agency itself. | 51 |
| Officer | An agency's guard. Documented as mobile-first: the officer experience is the app, not the web application. | 19 |
| Contractor | Exists in the database and in this catalogue, but nothing in the product refers to it — there is no way to give anybody this role today, and no screen it leads to. | 13 |
| Client | The company a site is billed to. A client login reaches a separate portal — a coverage dashboard, its invoices and its own profile — and nothing else. Client access is decided by that portal, not by this catalogue, which is why the role appears in no grant list below. | none in this catalogue |

## What can each role do?

The catalogue holds **280 permissions** in **21 categories**. Rather than read all 280, start here: this is how much of each category each role is granted. A dash means the role holds nothing in that category at all.

### Organisation roles

The four roles inside the organisation that owns the rota.

| Category | Admin | Manager | Control | Employee |
|---|---|---|---|---|
| Dashboard & Analytics | 4 of 8 | 4 of 8 | 4 of 8 | 1 of 8 |
| User Management | 11 of 12 | 4 of 12 | 2 of 12 | — |
| Employee Management | 33 of 45 | 31 of 45 | 8 of 45 | 12 of 45 |
| Check Call System | 13 of 17 | 12 of 17 | 2 of 17 | 4 of 17 |
| Sites Management | 9 of 10 | 8 of 10 | 4 of 10 | — |
| Agency Management | 14 of 18 | 6 of 18 | 2 of 18 | — |
| Officers Management | 3 of 21 | 3 of 21 | 2 of 21 | — |
| Requests & Assignments | 12 of 18 | 11 of 18 | 6 of 18 | — |
| Roster & Schedule | 3 of 4 | 3 of 4 | 3 of 4 | — |
| Shift Management | 13 of 17 | 13 of 17 | 8 of 17 | 4 of 17 |
| Timesheets & Payroll | all 12 | all 12 | 3 of 12 | — |
| Leave Management | all 13 | 11 of 13 | 3 of 13 | — |
| Reports & Analytics | 8 of 12 | 8 of 12 | 3 of 12 | — |
| Documents & Compliance | 4 of 6 | 4 of 6 | — | — |
| Settings & Configuration | all 16 | 5 of 16 | — | — |
| Notifications | all 11 | 7 of 11 | 7 of 11 | 7 of 11 |
| Broadcast System | all 7 | all 7 | — | — |
| Administration | all 13 | — | — | — |
| File Storage | all 5 | 3 of 5 | 2 of 5 | — |
| Contractor System | 4 of 8 | 3 of 8 | — | — |
| Forms & Submissions | all 7 | all 7 | 5 of 7 | 1 of 7 |

### Agency and contractor roles

The roles on the supplying side.

| Category | Agency Admin | Agency Coordinator | Officer | Contractor |
|---|---|---|---|---|
| Dashboard & Analytics | 2 of 8 | 2 of 8 | 1 of 8 | — |
| User Management | 10 of 12 | 2 of 12 | — | — |
| Employee Management | — | — | — | — |
| Check Call System | — | — | — | — |
| Sites Management | 8 of 10 | 6 of 10 | — | — |
| Agency Management | 6 of 18 | 3 of 18 | — | — |
| Officers Management | 7 of 21 | 5 of 21 | 11 of 21 | — |
| Requests & Assignments | 6 of 18 | 6 of 18 | — | — |
| Roster & Schedule | 1 of 4 | 1 of 4 | — | — |
| Shift Management | 8 of 17 | 6 of 17 | — | — |
| Timesheets & Payroll | 7 of 12 | 3 of 12 | — | — |
| Leave Management | — | — | — | — |
| Reports & Analytics | 6 of 12 | 3 of 12 | — | — |
| Documents & Compliance | 4 of 6 | 2 of 6 | — | 2 of 6 |
| Settings & Configuration | 6 of 16 | — | — | — |
| Notifications | 7 of 11 | 7 of 11 | 7 of 11 | 7 of 11 |
| Broadcast System | — | — | — | — |
| Administration | — | — | — | — |
| File Storage | 3 of 5 | 1 of 5 | — | — |
| Contractor System | — | — | — | 4 of 8 |
| Forms & Submissions | 4 of 7 | 4 of 7 | — | — |

## How is a permission key written?

Keys read `category.action.qualifier` — `sites.view.details`, `employees.edit.payroll`, `requests.share`. The qualifier is dropped when the action needs no narrowing.

Every permission also records the action it represents, drawn from a fixed list of 13: `view`, `create`, `edit`, `delete`, `approve`, `reject`, `export`, `upload`, `submit`, `assign`, `manage`, `monitor`, `execute`. All are in use.

## Can one person be given a permission their role does not have?

Yes, in both directions, and the override wins. A permission granted to an individual applies even where their role does not carry it; a permission revoked from an individual is withheld even where their role does carry it. An override can be given an expiry date, after which the role's own answer applies again.

Two consequences worth knowing before you rely on it:

- **Individual overrides take effect immediately.** They are read fresh on every check.
- **Changes to what a *role* is granted do not.** Role grants are cached for five minutes per running copy of the application, so a change made by a migration can take that long to be seen — longer where several copies are running, until each has refreshed.

## Does every permission in this list gate something?

No, and this is the most important thing to understand before reading the tables below.

This catalogue is what the platform *declares*. A key appearing here, granted to your role, means the platform has a name for that ability and has given it to you. It does not by itself mean that a particular screen or button asks the question — most of the catalogue is not consulted anywhere in the product today.

Access is also decided in ways that never touch this catalogue at all: which area of the product a login is allowed into is settled by the role alone, before any permission is read, and a number of screens still check the role directly rather than asking about a permission. So granting somebody a key from this list will not always make a hidden button appear.

Read the tables below as **the vocabulary of what the platform can distinguish**, and as an accurate record of what each role is granted — not as a map of every check in the product.

## What is in each category?

All 280 permissions follow, grouped by category and complete — nothing is left out. "Granted to" lists every role the seed gives the key to; a key granted to nobody is marked as such.

### Dashboard & Analytics

Access to dashboard views and analytics across the platform. 8 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `dashboard.view.organization` | Access main organization dashboard with stats and widgets | Admin, Manager, Control |
| `dashboard.view.requests_summary` | View today's requests widget on dashboard | Admin, Manager, Control |
| `dashboard.view.schedule` | View weekly schedule widget on dashboard | Admin, Manager, Control |
| `dashboard.access.quick_actions` | Use quick action shortcuts on dashboard | Admin, Manager, Control |
| `dashboard.view.employee` | Access employee portal dashboard | Employee |
| `dashboard.view.agency` | Access agency dashboard overview | Agency Admin, Agency Coordinator |
| `dashboard.view.officers_summary` | View agency officers overview widget | Agency Admin, Agency Coordinator |
| `dashboard.view.officer` | Access officer portal dashboard | Officer |

### User Management

User administration, roles, and account management. 12 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `users.view.list` | View all users in the organization or agency | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `users.create.organization` | Add new users to organization | Admin, Manager |
| `users.create.agency` | Add new users to agency | Agency Admin |
| `users.edit.own_org` | Update user details within own organization/agency | Admin, Agency Admin |
| `users.delete.own_org` | Remove users from organization/agency | Admin, Agency Admin |
| `users.view.details` | View complete user profile information | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `users.reset_password` | Reset password for any user | Admin, Agency Admin |
| `users.change_role` | Modify user role assignments | Admin, Agency Admin |
| `users.toggle_status` | Enable or disable user accounts | Admin, Agency Admin |
| `users.manage.permissions` | Grant or revoke specific permissions for users | Admin, Agency Admin |
| `users.view.statistics` | View user metrics and analytics | Admin, Manager, Agency Admin |
| `users.view.role_analytics` | View role breakdown analytics | Admin |

### Employee Management

Employee profiles, HR data, and workforce management. 45 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `employees.view.list` | View all employees in directory | Admin, Manager, Control |
| `employees.search` | Search and filter employee directory | Admin, Manager, Control |
| `employees.create` | Add new employee to roster | Admin, Manager |
| `employees.quick_create` | Fast employee creation with minimal fields | Admin, Manager |
| `employees.view.profile` | View complete employee profile | Admin, Manager, Control |
| `employees.edit.profile` | Update employee information | Admin, Manager |
| `employees.delete` | Remove employee from system | Admin |
| `employees.view.medical_details` | View employee health information | Admin, Manager |
| `employees.edit.medical_details` | Update employee health information | Admin, Manager |
| `employees.view.emergency_contacts` | View employee emergency contact information | Admin, Manager, Control |
| `employees.edit.emergency_contacts` | Update employee emergency contacts | Admin, Manager |
| `employees.delete.emergency_contact` | Remove emergency contact | Admin, Manager |
| `employees.view.bank_details` | View employee banking information | Admin, Manager |
| `employees.edit.bank_details` | Update employee banking information | Admin, Manager |
| `employees.view.tupe` | View transfer of undertakings information | Admin, Manager |
| `employees.edit.tupe` | Update TUPE information | Admin, Manager |
| `employees.view.operations` | View employee operational data | Admin, Manager, Control |
| `employees.edit.operations` | Update employee operational data | Admin, Manager |
| `employees.view.payroll` | View employee payroll information | Admin, Manager |
| `employees.edit.payroll` | Update employee payroll information | Admin, Manager |
| `employees.view.break_payments` | View break payment configuration | Admin, Manager |
| `employees.edit.break_payments` | Update break payment configuration | Admin, Manager |
| `employees.view.holiday_accrual` | View holiday balance and accrual | Admin, Manager |
| `employees.edit.holiday_accrual` | Adjust holiday balance and accrual | Admin, Manager |
| `employees.view.photo` | View employee photograph | Admin, Manager, Control |
| `employees.upload.photo` | Upload employee photograph | Admin, Manager |
| `employees.delete.photo` | Remove employee photograph | Admin, Manager |
| `employees.view.grades` | View all employee grade levels | Admin, Manager, Control |
| `employees.create.grade` | Add new grade level | Admin, Manager |
| `employees.edit.grade` | Update grade level | Admin, Manager |
| `employees.delete.grade` | Remove grade level | Admin |
| `employees.view.availability` | View employee availability schedule | Admin, Manager, Control |
| `employees.edit.availability` | Update employee availability schedule | Admin, Manager |
| `employee.view.own_schedule` | Employees can view their own shift schedule | Employee |
| `employee.submit.check_calls` | Employees can submit check call reports | Employee |
| `employee.view.own_reviews` | Employees can view their performance reviews | Employee |
| `employee.view.own_timesheets` | Employees can view their timesheet submissions | Employee |
| `employee.submit.timesheet` | Employees can submit timesheets for approval | Employee |
| `employee.edit.own_timesheet` | Employees can update timesheets before approval | Employee |
| `employee.view.own_leaves` | Employees can view their leave requests | Employee |
| `employee.submit.leave_request` | Employees can request time off | Employee |
| `employee.cancel.leave_request` | Employees can cancel their leave requests | Employee |
| `employee.edit.own_availability` | Employees can update their availability | Employee |
| `employee.view.available_shifts` | Employees can browse open shifts | Employee |
| `employee.view.own_applications` | Employees can view their shift applications | Employee |

### Check Call System

Check call monitoring, patterns, and compliance tracking. 17 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `check_calls.monitor.dashboard` | Access check call monitoring dashboard | Admin, Manager |
| `check_calls.mark_complete` | Manually mark check calls as complete | Admin, Manager |
| `check_calls.manual_book_on` | Manually book employee on shift | Admin, Manager |
| `check_calls.manual_book_off` | Manually book employee off shift | Admin, Manager |
| `check_calls.view.logs` | View historical check call records | Admin, Manager, Control |
| `check_calls.search` | Search and filter check call records | Admin, Manager, Control |
| `check_calls.export` | Export check call records to CSV | Admin, Manager |
| `check_calls.view.patterns` | View all check call pattern templates | Admin, Manager |
| `check_calls.create.pattern` | Add new check call pattern | Admin, Manager |
| `check_calls.edit.pattern` | Update check call pattern | Admin, Manager |
| `check_calls.delete.pattern` | Remove check call pattern | Admin, Manager |
| `check_calls.assign.pattern` | Link pattern to site | Admin, Manager |
| `check_calls.run.escalation_cron` | Execute check call escalation process | Admin |
| `employee.view.own_check_calls` | View current check call window | Employee |
| `employee.submit.check_call` | Submit check call report | Employee |
| `employee.book_on` | Submit book-on check call | Employee |
| `employee.book_off` | Submit book-off check call | Employee |

### Sites Management

Site administration and configuration. 10 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `sites.view.list` | View all sites in organization | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `sites.create.organization` | Add new site for organization | Admin, Manager |
| `sites.create.agency` | Add new site for agency | Agency Admin, Agency Coordinator |
| `sites.view.details` | View complete site information | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `sites.edit` | Update site information | Admin, Manager, Agency Admin, Agency Coordinator |
| `sites.delete` | Remove site from system | Admin, Agency Admin |
| `sites.assign.check_call_pattern` | Link check call pattern to site | Admin, Manager |
| `sites.view.shifts` | View all shifts for a site | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `sites.view.schedule` | View site shift schedule | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `sites.export` | Export site information | Admin, Manager, Agency Admin |

### Agency Management

Agency partnerships, relationships, and invitations. 18 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `agencies.view.list` | View all agencies | Admin, Manager, Control |
| `agencies.discover` | Search for agencies in the network | Admin, Manager |
| `agencies.create` | Add new agency to system | Admin |
| `agencies.view.details` | View complete agency information | Admin, Manager, Control |
| `agencies.edit` | Update agency information | Admin |
| `agencies.delete` | Remove agency from system | Admin |
| `agencies.view.relationships` | View partnerships and relationships | Admin |
| `agencies.create.relationship` | Link agency to organization | Admin |
| `agencies.view.for_sharing` | View agencies available for request sharing | Admin, Manager |
| `agencies.view.outgoing_invitations` | View sent agency invitations | Admin, Manager |
| `agencies.send.invitation` | Invite agency to partnership | Admin, Manager |
| `agencies.view.incoming_invitations` | View received partnership invitations | Agency Admin, Agency Coordinator |
| `agencies.accept.invitation` | Accept partnership invitation | Agency Admin |
| `agencies.view.invitation_details` | View invitation information | Admin, Agency Admin, Agency Coordinator |
| `agencies.view.organizations` | View client organizations (agency side) | Agency Admin, Agency Coordinator |
| `agencies.request.partnership` | Request to work with organization | Agency Admin |
| `agencies.export` | Export agency information | Admin |
| `agencies.view.statistics` | View agency metrics and analytics | Admin, Agency Admin |

### Officers Management

Officer profiles, assignments, and agency workforce. 21 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `officers.view.shared` | View agency officers shared with organization | Admin, Manager, Control |
| `officers.view.details` | View complete officer profile | Admin, Manager, Control |
| `officers.unshare` | Remove officer access | Admin, Manager |
| `officers.view.list` | View all officers in agency | Agency Admin, Agency Coordinator |
| `officers.create` | Add new officer to agency | Agency Admin, Agency Coordinator |
| `officers.view.profile` | View complete officer profile | Agency Admin, Agency Coordinator |
| `officers.edit` | Update officer information | Agency Admin, Agency Coordinator |
| `officers.delete` | Remove officer from agency | Agency Admin |
| `officers.send.invitation` | Email setup invitation to officer | Agency Admin, Agency Coordinator |
| `officer.setup.profile` | Complete officer profile setup | Officer |
| `officer.verify.setup_token` | Verify officer invitation token | Officer |
| `officer.view.own_profile` | Officer can view their profile | Officer |
| `officer.edit.own_profile` | Officer can update their profile | Officer |
| `officer.view.own_shifts` | Officer can view assigned shifts | Officer |
| `officer.view.own_schedule` | Officer can view their calendar | Officer |
| `officer.accept.shift` | Officer can accept shift assignment | Officer |
| `officer.decline.shift` | Officer can decline shift assignment | Officer |
| `officer.view.own_documents` | Officer can view their documents | Officer |
| `officer.upload.document` | Officer can upload documents | Officer |
| `officer.delete.own_document` | Officer can delete their documents | Officer |
| `officers.export` | Export officer information | Agency Admin |

### Requests & Assignments

Request creation, sharing, proposals, and assignments. 18 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `requests.view.list` | View all requests | Admin, Manager, Control |
| `requests.create` | Create new staffing request | Admin, Manager, Control |
| `requests.view.details` | View complete request information | Admin, Manager, Control |
| `requests.edit.own` | Update request information | Admin, Manager, Control |
| `requests.delete` | Remove request from system | Admin |
| `requests.share` | Share request with agencies | Admin, Manager |
| `requests.unshare` | Remove agency access to request | Admin, Manager |
| `requests.export` | Export request data to CSV | Admin, Manager |
| `requests.view.shared` | View requests shared by organizations | Agency Admin, Agency Coordinator |
| `requests.view.shared_details` | View details of shared requests | Agency Admin, Agency Coordinator |
| `proposals.view.list` | View all proposals | Agency Admin, Agency Coordinator |
| `proposals.submit` | Submit officer proposal for request | Agency Admin, Agency Coordinator |
| `proposals.edit` | Update proposal information | Agency Admin, Agency Coordinator |
| `proposals.withdraw` | Remove submitted proposal | Agency Admin, Agency Coordinator |
| `assignments.view.list` | View confirmed assignments | Admin, Manager, Control |
| `assignments.confirm` | Confirm officer for request | Admin, Manager, Control |
| `assignments.cancel` | Cancel confirmed assignment | Admin, Manager |
| `assignments.edit` | Update assignment details | Admin, Manager |

### Roster & Schedule

Roster management, shift scheduling, and calendar views. 4 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `roster.view.dashboard` | Access roster scheduling dashboard | Admin, Manager, Control |
| `roster.view.agency` | Access agency roster schedule | Agency Admin, Agency Coordinator |
| `roster.filter.by_site` | Filter roster view by site | Admin, Manager, Control |
| `roster.navigate.dates` | Change week/date in roster | Admin, Manager, Control |

### Shift Management

Shift creation, assignments, applications, and patterns. 17 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `shifts.view.all` | View all shifts in system | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `shifts.create` | Add new shift to schedule | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `shifts.view.details` | View complete shift information | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `shifts.edit` | Update shift information | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `shifts.delete` | Remove shift from schedule | Admin, Manager, Control, Agency Admin |
| `shifts.assign.employee` | Assign employee to shift | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `shifts.unassign.employee` | Remove employee from shift | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `employee.apply.shift` | Employee can apply for open shift | Employee |
| `employee.withdraw.application` | Employee can cancel application | Employee |
| `shifts.view.applications` | View all shift applications | Admin, Manager |
| `shifts.approve.application` | Accept employee shift application | Admin, Manager |
| `shifts.reject.application` | Decline employee shift application | Admin, Manager |
| `shifts.view.pattern_days` | View shift pattern schedule | Admin, Manager, Control |
| `shifts.edit.pattern_days` | Update shift patterns | Admin, Manager |
| `shifts.export` | Export shift data | Admin, Manager, Agency Admin |
| `employee.view.broadcasts` | Employee can view shift broadcasts | Employee |
| `employee.respond.broadcast` | Employee can accept/decline broadcast | Employee |

### Timesheets & Payroll

Timesheet approvals and payroll processing. 12 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `timesheets.view.all` | View all timesheet submissions | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `timesheets.view.employee` | View specific employee timesheet | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `timesheets.approve` | Approve timesheet submission | Admin, Manager, Agency Admin |
| `timesheets.reject` | Reject timesheet submission | Admin, Manager, Agency Admin |
| `timesheets.edit` | Update timesheet information | Admin, Manager, Agency Admin |
| `timesheets.export` | Export timesheet data to CSV | Admin, Manager, Agency Admin |
| `timesheets.view.payroll` | View payroll summary reports | Admin, Manager |
| `timesheets.process.payroll` | Process payroll for period | Admin, Manager |
| `timesheets.view.summary` | View timesheet summary statistics | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `timesheets.bulk_approve` | Approve multiple timesheets at once | Admin, Manager |
| `timesheets.calculate_hours` | Calculate worked hours from timesheets | Admin, Manager |
| `timesheets.audit` | Review timesheet compliance | Admin, Manager |

### Leave Management

Leave requests, approvals, and holiday calendars. 13 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `leaves.view.all` | View all employee leave requests | Admin, Manager, Control |
| `leaves.approve` | Approve employee leave request | Admin, Manager |
| `leaves.reject` | Reject employee leave request | Admin, Manager |
| `leaves.view.calendar` | View leave calendar overview | Admin, Manager, Control |
| `leaves.export` | Export leave records | Admin, Manager |
| `leaves.view.balance` | View employee leave balances | Admin, Manager |
| `leaves.adjust.balance` | Manually adjust leave balance | Admin, Manager |
| `holidays.view` | View public holidays | Admin, Manager, Control |
| `holidays.create` | Add public holiday | Admin, Manager |
| `holidays.edit` | Update public holiday | Admin, Manager |
| `holidays.delete` | Remove public holiday | Admin, Manager |
| `holidays.import` | Bulk import public holidays | Admin |
| `leaves.override` | Book absence past the earned-balance and conflict rules, with a recorded reason | Admin |

### Reports & Analytics

Business intelligence, reporting, and data exports. 12 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `reports.view.dashboard` | Access reports overview dashboard | Admin, Manager, Control |
| `reports.view.shift_summary` | View shift summary analytics | Admin, Manager, Control |
| `reports.view.payroll_summary` | View payroll summary report | Admin, Manager |
| `reports.view.payroll_detail` | View detailed payroll breakdown | Admin, Manager |
| `reports.view.site_analysis` | View site performance analytics | Admin, Manager, Control |
| `reports.export.csv` | Export reports as CSV | Admin, Manager, Agency Admin |
| `reports.export.excel` | Export reports as Excel | Admin, Manager, Agency Admin |
| `reports.view.compliance` | View compliance and audit data | Admin, Manager |
| `reports.view.agency` | Access agency analytics dashboard | Agency Admin, Agency Coordinator |
| `reports.view.agency_performance` | View agency performance metrics | Agency Admin, Agency Coordinator |
| `reports.view.site_activity` | View site activity breakdown | Agency Admin, Agency Coordinator |
| `reports.export.agency` | Export agency report data | Agency Admin |

### Documents & Compliance

Document management and compliance tracking. 6 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `documents.view.all` | View all uploaded documents | Admin, Manager, Agency Admin, Agency Coordinator |
| `documents.upload` | Upload new documents | Admin, Manager, Agency Admin |
| `documents.delete` | Remove documents from system | Admin, Manager, Agency Admin |
| `documents.view.compliance` | View compliance and certification documents | Admin, Manager, Agency Admin, Agency Coordinator |
| `contractor.view.own_documents` | Contractors view their documents | Contractor |
| `contractor.upload.document` | Contractors upload documents | Contractor |

### Settings & Configuration

System configuration, organization settings, and preferences. 16 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `settings.view.organization` | Access organization settings page | Admin, Manager, Agency Admin |
| `settings.edit.general` | Update general configuration | Admin, Agency Admin |
| `settings.edit.branding` | Update logo and colors | Admin, Agency Admin |
| `settings.edit.check_calls` | Configure check call behavior | Admin |
| `settings.view.billing` | View subscription and billing | Admin, Agency Admin |
| `settings.manage.subscription` | Update subscription plan | Admin, Agency Admin |
| `settings.setup.organization` | Initial organization setup | Admin |
| `settings.view.org_status` | Check organization setup status | Admin |
| `settings.view.usage_limits` | View plan usage and limits | Admin, Manager, Agency Admin |
| `settings.view.grades` | View all employee grades | Admin, Manager |
| `settings.create.grade` | Add new employee grade | Admin, Manager |
| `settings.edit.grade` | Update employee grade | Admin, Manager |
| `settings.delete.grade` | Remove employee grade | Admin |
| `settings.view.integrations` | View third-party integrations | Admin |
| `settings.manage.integrations` | Configure third-party integrations | Admin |
| `settings.view.api_keys` | View API access keys | Admin |

### Notifications

Notification preferences and management. 11 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `notifications.view.own` | View personal notifications | Admin, Manager, Control, Employee, Agency Admin, Agency Coordinator, Officer, Contractor |
| `notifications.mark_read` | Mark notification as read | Admin, Manager, Control, Employee, Agency Admin, Agency Coordinator, Officer, Contractor |
| `notifications.delete.own` | Remove personal notification | Admin, Manager, Control, Employee, Agency Admin, Agency Coordinator, Officer, Contractor |
| `notifications.mark_all_read` | Mark all notifications as read | Admin, Manager, Control, Employee, Agency Admin, Agency Coordinator, Officer, Contractor |
| `notifications.dismiss_all` | Dismiss all notifications | Admin, Manager, Control, Employee, Agency Admin, Agency Coordinator, Officer, Contractor |
| `notifications.view.preferences` | View notification settings | Admin, Manager, Control, Employee, Agency Admin, Agency Coordinator, Officer, Contractor |
| `notifications.update.preferences` | Update notification settings | Admin, Manager, Control, Employee, Agency Admin, Agency Coordinator, Officer, Contractor |
| `notifications.view.queue` | View pending notifications (admin) | Admin |
| `notifications.process.queue` | Process notification queue (admin) | Admin |
| `notifications.clear.queue` | Clear notification queue (admin) | Admin |
| `notifications.send.custom` | Send custom notification to users | Admin |

### Broadcast System

Shift broadcasts and employee responses. 7 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `broadcasts.view.page` | Access broadcast shifts interface | Admin, Manager |
| `broadcasts.view.available_shifts` | View shifts available for broadcasting | Admin, Manager |
| `broadcasts.view.eligible_employees` | View employees eligible for broadcast | Admin, Manager |
| `broadcasts.create` | Send shift broadcast to employees | Admin, Manager |
| `broadcasts.cancel` | Cancel active broadcast | Admin, Manager |
| `broadcasts.view.responses` | View employee responses to broadcasts | Admin, Manager |
| `broadcasts.export` | Export broadcast statistics | Admin, Manager |

### Administration

System administration, control room, and audit functions. 13 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `admin.view.control_room` | Access admin control room dashboard | Admin |
| `admin.execute.actions` | Execute system-level administrative tasks | Admin |
| `admin.view.data_lifecycle` | View partition status and data lifecycle | Admin |
| `admin.create.partitions` | Create database partitions | Admin |
| `admin.delete.partitions` | Delete old database partitions | Admin |
| `admin.view.railway_lifecycle` | View Railway deployment status | Admin |
| `admin.execute.railway_actions` | Execute Railway deployment tasks | Admin |
| `admin.view.audit_logs` | View security and access audit logs | Admin |
| `admin.export.audit_logs` | Download audit log data | Admin |
| `admin.create.user` | Create user via admin interface | Admin |
| `admin.view.system_health` | Monitor system health and performance | Admin |
| `admin.manage.database` | Database administration tasks | Admin |
| `admin.view.error_logs` | View system error logs | Admin |

### File Storage

File uploads, downloads, and storage management. 5 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `storage.upload` | Upload files to storage | Admin, Manager, Agency Admin |
| `storage.download` | Download files from storage | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `storage.delete` | Remove files from storage | Admin, Agency Admin |
| `storage.view.employee_photos` | View employee photographs | Admin, Manager, Control |
| `storage.manage.quotas` | Configure storage limits | Admin |

### Contractor System

Contractor jobs, profiles, and reviews. 8 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `contractor.view.available_jobs` | Browse available contractor jobs | Contractor |
| `contractor.view.own_jobs` | View assigned contractor jobs | Contractor |
| `contractor.view.own_profile` | View contractor profile | Contractor |
| `contractor.view.own_reviews` | View contractor reviews | Contractor |
| `contractors.view.reviews` | View all contractor reviews (org) | Admin, Manager |
| `contractors.submit.review` | Review contractor performance | Admin, Manager |
| `contractors.view.list` | View all contractors | Admin, Manager |
| `contractors.manage` | Manage contractor relationships | Admin |

### Forms & Submissions

Form templates, deployments, submissions, lookup tables, and form reporting. 7 permissions.

| Key | What it allows | Granted to |
|---|---|---|
| `forms.templates.view` | Browse the form library and view form templates | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `forms.templates.create` | Create form templates and import them from the library | Admin, Manager |
| `forms.deployments.view` | View which templates are deployed to which sites and shift triggers | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `forms.submissions.view` | Review submitted forms across the organisation | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `forms.submissions.create` | Complete and submit a deployed form, including reading its lookup tables | Admin, Manager, Control, Employee |
| `forms.reports.view` | Form analytics, heatmaps and performance metrics | Admin, Manager, Control, Agency Admin, Agency Coordinator |
| `forms.lookup_tables.manage` | Create, edit, import and delete form lookup tables | Admin, Manager |

## How is this page produced?

It is generated, not written. Every key, description and grant is read from the permission seed files in the repository (`database/seeds/01-permission-categories.sql`, `database/seeds/02-permissions-part1.sql`, `database/seeds/02-permissions-part2.sql`, `database/seeds/02-permissions-part3.sql`, `database/seeds/02-permissions-part4-forms.sql`, `database/seeds/03-role-permissions-part1.sql`, `database/seeds/03-role-permissions-part2.sql`, `database/seeds/03-role-permissions-part3.sql`, `database/seeds/03-role-permissions-part4-forms.sql`) and the role list from the database schema. Regenerate it with `npm run docs:reference`; a check in the test suite fails if what is committed here has fallen behind those files.

## What else should I read?

- [Organisation, agency, client — who is who](/docs/concepts/organisation-agency-client) — what each side of the platform is for
- [Status reference](/docs/reference/status-reference) — what the words on the chips mean
- [Glossary](/docs/reference/glossary) — the vocabulary used above