Access profiles and permissions

Every person has an access profile and a set of permission chips. The profile is the starting point. The chips decide what they can actually open and change.

The access profiles

• Owner: the workspace's final authority. Owners pass every permission check whatever their chips say, including settings and the subscription. A workspace always keeps at least one active owner.
• Office admin: day-to-day management. Someone added as an office admin starts with Manage users, Manage jobs, Manage schedule, Manage sites, Manage clients, Manage assets, Manage vehicles, Manage forms, Review submissions, Manage share packs, Manage chat, Manage documents, Binder, Manage lone worker, View reports, View evidence and Field worker access. They do not start with Manage access, the time, leave, compliance or money chips, or Read sensitive info. Give those one at a time.
• Supervisor: runs their own part of the operation and works in the field too. Someone added as a supervisor starts with Manage jobs, Manage schedule, Manage chat, View evidence, Manage lone worker and Field worker access, and with Jobs and schedule cover set to Only workstreams they manage. See Workstream scope. On a phone, supervisors start in the field app and can switch to Admin view from the settings menu on Me.
• Field worker: the field app — their day, their work, capture and chat. Field worker access only.
• Custom: a set of chips that matches none of the above. You can only give someone Custom access through a spreadsheet import. They start with field worker access, and you then pick their chips in Edit access & role.

On the Free plan, only Owner and Field worker are available. Supervisors and office admins are on the Team plan and above, and custom access on the Crew plan and above.

Edit access & role

Open the person in Users, choose View full profile, then Edit access. The Edit access & role dialog holds:

• Access profile, Worker classification, Work pattern, Reports to, Team, Trade and Driver capability.
• Permissions: the chips, grouped by the part of the workspace they open.
• Jobs and schedule cover, which appears once the person holds Manage jobs or Manage schedule.

Changing the Access profile here re-ticks the chips from a starting set for that profile, which isn't always the same as the set above. Check the chips before you choose Save.

The permission chips

Group	Chips
People and access	Manage users, Manage access
Operations	Manage jobs, Manage schedule, Manage sites, Manage clients, Manage assets, Manage vehicles, Field worker access
Forms and compliance	Manage forms, Review submissions, Manage share packs, Manage compliance, Override eligibility, Manage lone worker, View evidence
Commercial	Manage commercial, Manage bills & expenses, Manage pay rates, Manage subscription
Workforce records	Manage documents, Binder, Manage pay documents, Manage time clock, Manage leave, Read sensitive info
Workspace and oversight	Manage settings, Manage chat, Manage help desk, View audit trail, View reports

The ones worth knowing well:

• Manage users: the person. Invite a new starter, edit their profile, set their team, trade, work pattern and who they report to, and record and review their credentials.
• Manage access: what anybody may do. The access profile, the chips and Jobs and schedule cover. Without it, that part of the dialog is read-only ("You can see this person's access but not change it. Ask an owner for access administration.") and everything else still saves. So the person who does your people admin doesn't automatically decide everybody's authority.
• Manage schedule: shifts, routes and assignments, plus the alerts when workers don't confirm. On its own it can't put someone on work their credentials or permits don't allow: the schedule shows the refusal, and you change the crew or ask someone who can override.
• Manage compliance: authorisations and permits, defect control, AI review decisions, and verifying a person's credentials. See Credentials and competency.
• Override eligibility: waving somebody through a credential or permit check that a supervisor is allowed to pass. It's what offers Assign anyway? when a shift, a route, a visit or a bulk change is refused, and Publish anyway when shifts are held back at publishing. It also answers people who ask to start work a check has stopped. Each override needs a reason, is recorded against your name, and lasts until that piece of work ends. A requirement set so that nobody can allow it can't be overridden by anyone. Kept separate from Manage schedule on purpose.
• Manage forms builds forms, templates and schedules. Review submissions signs off what comes back from site, which is a supervisor's daily job.
• Manage share packs: publishing a pack to a link anyone can open. It's the only chip whose effect reaches outside your workspace.
• Manage lone worker: the lone worker board, the escalation ladder and the history. It's the only way to see where a lone worker was standing, and without it a contact on the ladder is alerted but can't mark the alarm handled or close it. Supervisors and office admins added now start with it; people added before it became a default don't have it, because it opens colleagues' locations, so give it to them one at a time. The ladder marks any contact who "Cannot take the alarm".
• Manage time clock and Manage leave: timesheets and time records, and leave. Office admins don't start with either.
• Manage documents: a person's documents, such as contracts, handbooks and right-to-work files. Manage pay documents: earnings statements, self-bill statements and other pay documents, on top. Filing a handbook doesn't entitle anyone to read somebody's pay. The worker can always read their own.
• Binder: the company's documents. Its holders keep the Binder's folders and files, choose who each folder is shared with, publish new versions and see who has read them. They see every folder; everyone else sees only what's shared with them. See The Binder.
• Read sensitive info: national identifiers, right-to-work checks, emergency contacts, disciplinary and appraisal documents, and confidential form answers. Every view of sensitive info is recorded in the audit trail.
• Manage pay rates: what people are paid — the Pay tab on a person's record, and pay runs. Deliberately not implied by any other chip.
• Manage commercial: money in — contracts, rate cards, measures, valuations, variations and invoices.
• Manage bills & expenses: money out — bills, suppliers, purchase orders, payment runs, subcontractor deductions, expense approvals and the expense form settings. Separate from Manage commercial, because the bookkeeper who pays suppliers isn't always the person who prices the work. On its own it opens Commercial on an Overview of the money going out, with the Bills and Expenses tabs and the Measures tab everyone has for recording their own measures; the pricing tabs, and the money coming in on the overview, need Manage commercial.
• Manage subscription: your own Maliru plan and payment details.
• Manage settings: branding, modules and alert rules.

The rules nobody can get round

The server enforces these, not just the screen:

• "You can only grant permissions you hold yourself." Nobody can hand out, or give themselves, power they don't have.
• "Only an owner can grant owner access." Only an owner can change an owner's account.
• "Only an owner can grant access administration." Holding Manage access isn't enough to pass it on, so it can't spread one delegation at a time.
• "Only an owner can change access for someone who administers access." The same goes for deactivating them. The rule guards their authority and their account; their profile details can still be edited by anyone with Manage users.
• "Access administration is required to give somebody more than field access." This applies to adding people too: without Manage access, you can only add field workers.
• "The workspace must keep at least one active owner."
• "You cannot deactivate your own account."
• Owner and office admin accounts need an email address.

Every change to someone's access is written to the audit trail, with the chips added and removed.

Taking access away in bulk

In the Users list, tick one or more office admins and choose Demote to field user. "This removes office-admin access and returns the selected people to standard field-user access." The snackbar says how many were changed. Anyone the rules above protect is skipped.

What people see

The navigation follows the modules your workspace has switched on, not each person's permissions. Someone without Manage users may still see Users in the menu, but can't load or change anything there. The real checks always happen on the server.

Workstream scope is the one setting that hides things: someone limited to the workstreams they manage doesn't see other workstreams' jobs, routes or shifts at all, and their timesheets show only people who clocked time in their workstreams.

Tip: prefer profiles over one-off sets of chips. "Office admin without Manage users" is easier to reason about in a year's time than twelve different hand-picked combinations.

Confidential forms and expenses

Confidential form answers and their files need Read sensitive info. General access to Forms, Users, Evidence or a job isn't enough. See Confidential forms and reviewer fields.

Expenses can be reviewed by people with Manage bills & expenses, or by the managers above the claimant in their Reports to chain. Nobody may approve their own expense, or one they filed for someone else. A manager's view of their team's expenses doesn't open the rest of Commercial. See Expenses and reimbursements.

Share packs are gated by Manage share packs. A guest link opens that pack only; it doesn't make the recipient a member of your workspace. See Sharing forms and documents outside your workspace.