A role is a set of ticks. Open one from the Roles tab and the editor lays every permission out in groups, with a Save at the foot. A member holds exactly what their role holds, and nothing combines or inherits: two roles are never added together, because a member has one.
Open rolesView, and view all
Three areas draw a line between seeing the screen and seeing everything on it. View contacts, View enquiries and bookings and View your tasks and tasks on your bookings open the surface. The matching View all key decides how much of it is populated.
Without View all enquiries and bookings, a member sees the enquiries and bookings they are assigned to, and nothing else. Without View all contacts, they see contacts reached by that assigned work, plus the contacts they created themselves. Give them enquiry visibility across the board but not contacts, and every contact attached to any job comes into view instead.
Without View all tasks, they see the tasks assigned to them, the tasks they created, and every task on a booking they are assigned to. See Tasks.
The editor prints scope notes beside the contact and enquiry view keys, so the choice is visible while you are making it.
Email has its own pair. Connect and use your own email covers mailboxes belonging to that member. View and send team emails reads every stored team email and sends from any connected mailbox, including correspondence about contacts and bookings the member could not otherwise open. The editor notes both. See Inbox.
Out of scope reads as absent
Scope is merged into the query, not checked afterwards. A record outside a member's scope answers as if it never existed, rather than as a locked door with a name on it.
Permissions that need other permissions
Some permissions need others alongside them.
- View analytics and reports needs View enquiries and bookings, View all enquiries and bookings and View invoices and payments. Reports total up every job and every payment, so a role that could see the total without being able to open what made it up would be reading numbers it cannot check.
- Manage branding needs View branding.
- View all contacts needs View contacts, and View all enquiries and bookings needs View enquiries and bookings. A View all key widens what its view key opens, so without that key there is nothing to widen.
- View all tasks, Create, edit, assign and delete tasks and Manage task templates each need View your tasks and tasks on your bookings.
- Manage inventory and allocations needs View inventory.
- Export organisation data needs every permission that reads something the archive holds: View contacts and View all contacts, View enquiries and bookings and View all enquiries and bookings, View quotes, View packages, View invoices and payments, View contracts, View questionnaires, View run sheets, View branding, View and send team emails, View inventory, and View your tasks and tasks on your bookings with View all tasks. An export is the whole organisation, so the role must already be able to see all of it. The archive itself is on Export.
- Delete enquiries and bookings needs Edit, move and close enquiries and bookings. Deleting a record outright is strictly more than editing it, so a role that could erase a job it may not touch would make no sense.
The editor locks both directions. A dependent cannot be ticked until its prerequisites are, and the checkbox explains what it needs. A prerequisite cannot be unticked while something still depends on it, and that checkbox says what is holding it. The API enforces the same rule, so nothing gets in by another door.
AI access
Use the AI assistant covers every AI feature in the console: Arby, Brief me on an enquiry or booking, and AI drafting in the email composer. Paired with Manage automations, it also shows Build with Arby on the automations list. Manage AI settings is the organisation-wide policy on AI. Nothing appears unless AI is turned on for the organisation.
Inventory access
When inventory and crew gear are enabled, a member can see their own gear assignments without either inventory permission. This access is read-only: they cannot see the whole stock list, another member's gear or mark their own gear returned.
View inventory shows the organisation's stock, availability and allocations. Manage inventory and allocations adds stock changes, assignments, checkout, returns and releases. The starting Admin role holds both; the starting Member role holds neither.
Turning tracking on or off and changing inventory settings takes Manage organisation settings. See Inventory settings and Crew gear.
Every permission
| Permission | Key |
|---|---|
| Connect and use your own email | email.connect |
| View and send team emails | email.use_team |
Contacts
| Permission | Key |
|---|---|
| View contacts | contacts.view |
| View all contacts | contacts.view_all |
| Create contacts | contacts.create |
| Edit contacts and notes | contacts.edit |
| Delete contacts | contacts.delete |
| Merge duplicate contacts | contacts.merge |
| Manage custom contact fields | contact_fields.manage |
Enquiries and bookings
| Permission | Key |
|---|---|
| View enquiries and bookings | pipeline_items.view |
| View all enquiries and bookings | pipeline_items.view_all |
| Create enquiries and bookings | pipeline_items.create |
| Assign members to enquiries and bookings | pipeline_items.assign |
| Edit, move and close enquiries and bookings | pipeline_items.edit |
| Delete enquiries and bookings | pipeline_items.delete |
| Manage workflows, stages and automations | pipelines.manage |
| Manage custom fields for enquiries and bookings | pipeline_fields.manage |
| Send messages to clients through the portal | client_messages.send |
| Rotate and revoke client portal links | portal_access.manage |
| View run sheets | run_sheets.view |
| Edit run sheets | run_sheets.manage |
Tasks
| Permission | Key |
|---|---|
| View your tasks and tasks on your bookings | tasks.view |
| View all tasks | tasks.view_all |
| Create, edit, assign and delete tasks | tasks.manage |
| Manage task templates | task_templates.manage |
Calendar
| Permission | Key |
|---|---|
| Manage anyone's unavailability | calendar.busy.manage_all |
| Manage calendar settings | calendar_settings.manage |
| Manage members' calendar feeds | calendar_feeds.manage_all |
Quotes and packages
| Permission | Key |
|---|---|
| View quotes | quotes.view |
| Edit and send quotes | quotes.manage |
| View packages | packages.view |
| Manage packages | packages.manage |
| View inventory | inventory.view |
| Manage inventory and allocations | inventory.manage |
Payments
| Permission | Key |
|---|---|
| View invoices and payments | payments.view |
| Create, edit, issue and void invoices | payments.manage_invoices |
| Record manual payments | payments.record |
| Void payments | payments.void |
| Manage payment settings | payment_settings.manage |
| Manage the Stripe connection | stripe.manage |
Analytics and reporting
| Permission | Key |
|---|---|
| View analytics and reports | reporting.view |
Contracts
| Permission | Key |
|---|---|
| View contracts | contracts.view |
| Send and retry contracts | contracts.manage |
| Manage contract templates | contract_templates.manage |
Questionnaires
| Permission | Key |
|---|---|
| View questionnaires | questionnaires.view |
| Send, edit and answer questionnaires | questionnaires.manage |
| Manage questionnaire templates | questionnaire_templates.manage |
Integrations
| Permission | Key |
|---|---|
| Manage accounting integrations | accounting_integrations.manage |
| Manage outbound webhooks | webhooks.manage |
| Manage API keys | api_keys.manage |
| Import data from other tools | imports.manage |
AI writing
| Permission | Key |
|---|---|
| Use the AI assistant | ai.use |
| Manage AI settings | ai_settings.manage |
Branding
| Permission | Key |
|---|---|
| View branding | branding.view |
| Manage branding | branding.manage |
Organisation
| Permission | Key |
|---|---|
| Manage enquiry forms | form.manage |
| Edit and delete other members' notes | activities.moderate |
| Manage automations | automations.manage |
| Export organisation data | organization.export |
| Manage organisation settings | organization.settings.manage |
| Manage customer communication defaults | communications.manage |
| Manage members | members.manage |
| Invite members | invitations.manage |
| Manage roles | roles.manage |
The three roles you start with
Owner holds everything, permanently and by definition. It stores no keys at all: the flag on the role bypasses each check, which is why an owner picks up new permissions the day they ship. It cannot be renamed, re-permissioned or deleted.
Admin is seeded with every key in the table above, but it is a normal role. Untick something and it is gone.
Member is seeded for the work rather than the settings: connecting and using their own email, viewing, creating and editing contacts, the same for enquiries and bookings, sending portal messages, viewing and editing run sheets, viewing and managing tasks, viewing and sending quotes, viewing packages, viewing invoices and payments, viewing contracts, viewing and sending questionnaires, the AI assistant, and viewing branding. None of the View all keys is included, so a new member starts on their own assigned work.
See Team and roles for creating a role and moving people onto it.