Roles & Permissions

Overview

Core concepts

• Roles live at the community level. Each community defines its own roles.
• A user can hold one or more roles in a community, but only one is active at a time. They switch their active role from the community/role switcher in the app drawer, and permissions come from whichever role is active — roles are not combined.
• Roles are per community. Someone who works in more than one community has separate role(s) in each, independent of the others.
• Default deny. With no active role — or a permission left at its lowest setting — access is denied. Nothing is open until you grant it.

How permissions work

Every permission is one of three kinds.

1 · Access levels (graduated)

Most permissions use an ordered scale. Each level includes everything below it:

• None — the feature is hidden; no access.
• View — read-only.
• Create — view, plus add new records.
• Edit — create, plus change existing records.
• Full — edit, plus delete and any administrative extras.

The exact meaning varies slightly per feature — the reference tables spell out each one.

2 · On/off toggles

A simple switch: the user either has access to that screen or feature, or doesn't.

3 · Void passes (special)

Voiding a pass is sensitive, so it has its own three-way setting:

• None cannot void any pass.
• Own Passes can void only passes the user created.
• Any Pass can void any pass in the community.

Managing roles

Role management is itself a permission (Role Management), so only users you trust with it can change roles.

Create or edit a role

1. Open Role Management.
2. Create a new role, or open an existing one to edit.
3. Give it a Role Name.
4. Work through the permission categories, setting each level or toggle.
5. Save.

The Create Role form walks through every permission category. Work top to bottom — set each level or toggle, then tap Create Role at the bottom to save.

Assign a role to a user

In User Management, open the user, choose Select a Role, and pick the role. You can assign more than one role to the same person. Use Remove Role to revoke one.

Using more than one role

A person can hold several roles in a community, but only one is active at a time. They switch their active role from the community/role switcher in the app drawer (shown as Community (Role)), and their permissions come from whichever role is active — the roles are not stacked together.

This is handy for covering shifts. For example, an officer who occasionally picks up a dispatch shift can be given the Dispatch role in addition to their normal one. When they cover the shift they switch their active role to Dispatch, then switch back afterward. Because only the active role applies, make sure each role contains everything needed for that job on its own, rather than relying on two roles to combine.

Security Operations

Visitor Management

Access Control

Property

Reports

User & Administration

Example role recipes

Starting points — adjust to your community. — means leave at None/Off.

Best practices

• Grant the least access needed. Start low and raise a permission only when someone actually needs it.
• Reserve "Full" and "Any." Delete rights and Void → Any Pass belong with supervisors and administrators, not front-line staff.
• Separate field and supervisor duties. For incidents and traffic tickets, Create is the field officer and Edit is the reviewer — keep them in different roles so submissions get a second set of eyes.
• Limit Role and User Management. Anyone with Full on these can reshape access for the whole community — grant sparingly.
• Test a role by logging in as it. Assign a new role to a test user and confirm the screens and actions look right before rolling it out.

Getting help

Questions about designing your roles? Reach the Palmetto Guard team at info@palmettoguard.com.