Admin Customization & Permissions

1. How access works

Access is built from three pieces:

• Roles are named groups, such as "Estimator" or "Project Manager". Each site has its own roles.
• Permissions are the things a role can be given: a side-menu page, a tab on a record, or a special action.
• Grants connect the two. When you tick a box for a role, that role is granted that permission.

The rules are simple:

• Nothing is allowed until it is granted. A new role starts with no access. If a box is not ticked, people in that role do not get it.
• Roles add up. A person with more than one role gets everything any of their roles allows.
• Administrators get everything, whatever is ticked. This means a mistake on the Roles screen can never lock the Administrators out. The few exceptions are listed in section 2.
• Roles are deactivated, not deleted. You can only deactivate a role once nobody has it.
• Changes apply right away for everyone with that role once you click Save.

2. The Roles & Permissions screen

Where: Site Admin → Roles & Permissions. Only Administrators can use this screen. Anyone else who opens it sees "Only Administrators can manage roles and permissions."

Left column

• Roles: every active role at your site. The badge shows how many users have it. Click a role to load its settings.
• New Role: opens a dialog with Role Name and Full access to Document Library (see section 5). A new role has no access until you tick boxes and save.
• Users in selected Role: a read-only list of the people who have the selected role.

Right side, for any role except Administrators

• Rename: opens the same dialog, where you can also change the Document Library option.
• Deactivate: blocked while anyone still has the role. You'll see a message asking you to reassign those users under Site Settings → Users first.
• Save: saves every checkbox below it.
• Four groups of checkboxes, from top to bottom:
  1. Side-menu pages, grouped by menu category (section 3).
  2. Tabs on each type of record, one box per tab (section 4).
  3. HR Full Access (view all employees' employment details) (section 5).
  4. Grant Client/Vendor Portal Access (section 5).

The Administrators role

You can't rename or deactivate the Administrators role. It already has access to everything, so its screen only shows the five items that even Administrators must be granted:

If someone lacks one of these grants, the page or tab shows a message saying it needs an explicit grant, even for Administrators. The QuickBooks Actions menu entry appears when a person holds any of the three QuickBooks grants.

3. Side-menu access (full list)

These are all the side-menu checkboxes on the Roles screen, grouped as the screen groups them. For each item a role has:

• Ticked: the item appears in the menu, and the page opens.
• Not ticked: the item is left out of the menu. If the person types or bookmarks the page address, they see: "You don't have access to this page yet. If you need it, ask your site administrator to grant permission."

A menu group with no allowed items is hidden completely. The same rules apply to the category overview pages and to the More panel on phones.

explicit grant marks the items that Administrators must also be granted (section 2). You grant them to other roles here in the same way.

Menu entries you don't grant

• Roles & Permissions and Role Checklists appear under Site Admin for Administrators. They have no checkbox of their own.
• The top bar's Help, Submit Ticket, SMS, Email and My Tasks buttons are always shown. The page behind each one still follows the grants above.

4. Tab access on records

The second block of checkboxes on the Roles screen has one group per record type, headed "Record tabs". A role only sees a tab it has been granted. Administrators see every tab.

• The first tab is always shown. That is the record's own edit form, such as the Project or Company details.
• A tab grant does not open the page. It only matters if the role can already reach that kind of record through its side-menu grant.
• Tabs hidden with Tab Order stay hidden, even when a role is granted them (section 10).

Employee tabs have one more check. Dependents, Important Dates, Leave Balances, Health Info, Benefits and Certifications & Degrees are employment details. A person only sees them when the record is their own, the employee is somewhere below them in the reporting chain, or they have HR Full Access (section 5). The same rule applies to the Org Structure panel on the employee form. On the Employees screen, only Administrators can open an existing employee record, and Administrators see every tab.

Records with no tab checkboxes, such as Service Requests, Timesheets and Cost Database items, follow page access only. If a role can open the page, it sees the whole record.

5. Special permissions and actions

6. Administrator-only and role-name checks

Some features don't use checkboxes. They check whether the person is an Administrator, or whether they have a role with a specific name.

Administrators only

Checks by role name

These look for roles named exactly Staff or Terminators. Renaming those roles changes who passes.

• Campaign expenses (Campaigns page): only Administrators, Staff or Terminators can add or edit expenses. Everyone else can view them.
• Service Catalog: Delete: only Administrators, Staff or Terminators. Everyone else can view and edit, but not delete.

Document Library entries

An entry can be restricted to one role. Only people in that role, or in a role with Full access to Document Library, can see it. For everyone else it doesn't appear in the list at all.

7. Giving people roles

Where: Site Admin → Site Settings → Users.

• The grid shows Username, Email, Mobile Phone, Roles, Active and the linked Employee.
• New User (the + button): pick the Person, enter their Email (this is also their username), and optionally a Mobile Phone. Then tick any Roles. Active is ticked for you, and so is the role named "Users" if your site has one. The new person gets an email with a link to set their own password.
• Edit: change email, phone, Active, and roles. Reset Password sets a new password, unless the login also signs in to other ClientManager sites. In that case only the owner can change it, using Forgot Password.
• Tick as many roles as you need. Their access adds up (section 1).

To see who has a particular role, select it on the Roles & Permissions screen and look at Users in selected Role.

8. Site Settings, tab by tab

Where: Site Admin → Site Settings. Anyone whose role has the Site Settings grant can open it. Everything here applies to your whole site. The order of these tabs, and whether most of them show, can be changed with Tab Order.

9. Side Menu (hide menu entries)

Where: Site Settings → Side Menu. Applies to every user at your site.

• Every menu entry has a checkbox, grouped like the real menu. Untick any area your business doesn't use, such as Programs or Real Estate, and click Save. The change appears after the page is refreshed.
• Show All Again brings every entry back.
• Site Settings is marked "(always shown)" and can't be unticked, so you can always get back to this screen.
• This screen also covers the entries without role checkboxes: Roles & Permissions, Role Checklists, and one QuickBooks Actions entry for all three QuickBooks grants.

10. Tab Order (reorder and hide tabs)

Where: Site Settings → Tab Order. Applies to every user at your site.

1. Pick an Entity: Project, Person, Employee, Site Settings, Company, Lead, Opportunity, Asset, Campaign, Communication or Property.
2. Order: drag tabs, or use the up and down arrow buttons. The first tab in the list is locked in place.
3. Visible: untick a tab to hide it for everyone, such as Warranty on Project. The first tab can't be hidden. On Site Settings, Tab Order itself can't be hidden.
4. Click Save.

A tab hidden here is hidden for every user, including Administrators, whatever their roles allow. A tab left visible here is then shown only to roles granted it (section 4).

11. Reference Admin (lookup lists)

Where: Reference Admin in the side menu. It lists the dropdown lists used across the app, on two tabs: Standard, and Extended (lists with extra fields such as rates or dates). Anyone with the Reference Admin grant can browse the lists. Only Administrators can change them.

• Mine and Shared values. Each list mixes your site's own values (Mine) with shared defaults (Shared). You can add, edit and delete your own values. Shared values can't be edited.
• Hide a shared value. Open a Shared value and click Hide. It disappears from your site's dropdowns and lists, and shows a Hidden badge in Reference Admin. Click Unhide to bring it back.
• Allow inline quick-add from dropdowns elsewhere in the app. This per-list checkbox, with its own Save, decides whether people can add a new value straight from a dropdown.
• Depending on the list, a value may also have a Display Order or a Color. Every value has an Active flag.
• Separate pages: Leave Types are managed under Leave Management → Leave Types. Currency has its own page, linked from the bottom of Reference Admin.

12. Custom Fields

Where: Site Admin → Custom Fields, with one entry each for Company, Person, Employee, Project, Lead and Site. Each entry has its own role grant. Definitions apply to your whole site.

• Company, Person, Employee, Project and Site each have four tabs: Text Fields, Date Fields, Checkbox Fields and Choice Fields. Lead has one list of Lead fields.
• Each field has a Description, Display Order and Active flag. Most fields also have Required. Checkbox fields have Default Checked instead.
• Choice fields have an Options button, where you can add options and turn them on or off.
• Project fields only: Limit to Project Category shows the field only on projects in that category, such as Construction & Remodeling. Leave it blank to show the field on every project. A category covers every Project Type within it.

People fill in these fields on the record's Custom Fields (or Custom Info) tab, so that tab's grant and visibility decide who sees them.

13. Role Checklists and Current Users

Role Checklists

Where: Site Admin → Role Checklists. These are onboarding steps and ongoing duties assigned by role. Each checklist has a Checklist Name and a Role (the role can't be changed after saving). Every user with that role sees it on their own My Tasks page.

Current Users

Where: Site Admin → Current Users. Shows who is connected right now, when they connected, and for how long. Use Refresh to update it. Closing a tab removes that person from the list.

14. Personal preferences

These settings belong to each person. They don't affect anyone else, and an Administrator doesn't set them.

15. How the layers stack

Side-menu entries

• Site Side Menu setting. If the entry is unticked under Site Settings → Side Menu, nobody sees it in the menu. This check comes first.
• Role grant. Otherwise, the entry shows if the person is an Administrator or any of their roles is granted it. For Query Builder, Franchise Dashboard and QuickBooks Actions, an explicit grant is required even for Administrators.
• Opening the page directly. Only the role grant counts here, not the Side Menu setting. A person without the grant sees "You don't have access to this page yet."

Tabs on a record

• Page access. The person must be able to open that kind of record at all.
• Tab Order visibility. A tab hidden there is gone for everyone, including Administrators.
• Tab grant. The tab shows if the person is an Administrator or one of their roles is granted it. The first tab always shows.
• Employee details rule. On Employee records, the restricted tabs also need the record to be the person's own or a report's, or the person needs HR Full Access.

Buttons and actions

• Special permissions (portal access, HR Full Access, Document Library full access) come from the role settings in section 5. Administrators always have the first two.
• Administrator-only and role-name checks (section 6) apply on top. Grants can't change them.
• Personal preferences (section 14) only change how grids look for that one person. They never add or remove access.

Worked example

Dana has two roles: Estimator and Users. The site's settings:

• Estimator is granted Projects, plus the Project tabs Dashboard, Estimates, Notes and Warranty.
• Users is granted Companies, People and My Tasks.
• Under Site Settings → Side Menu, the Administrator unticked Programs. Under Tab Order, they hid Warranty on Project.

What Dana sees:

• Side menu: Projects (from Estimator), Companies and People (from Users). Programs would be hidden anyway, but Dana was never granted it. Leads isn't granted, so opening its address shows "You don't have access to this page yet."
• A Project: the Project form, then Dashboard, Estimates and Notes. Warranty is granted but hidden by Tab Order, so it doesn't show. Resources, Invoices & Payments and the other tabs aren't granted, so they don't show either.
• Project resources: neither role has Grant Client/Vendor Portal Access, so Is Client, Is Vendor and Can Access Project are read-only.
• Grids: Dana's Choose Columns picks on Projects apply only to Dana.

An Administrator at the same site would see every menu entry except Programs, and every Project tab except Warranty. They would still need explicit grants for Query Builder, Franchise Dashboard and the QuickBooks items.