Docs/Start Here

Roles and Permissions

Roles and permissions in Manifold assign each person the level of access that exposes only the work they need.

For: Admins managing team access3 min read4 sections

Role permission explorer

Use this to choose the least-powerful role that still lets someone do their job.

  • Full tenant access
  • Team and roles
  • Billing and settings
  • All operational work
Access exampleCustomer-safe walkthrough

Give each person the least power they need

Owner, office, engineer, client, and platform roles each see a different slice. Choosing the least-powerful role keeps client data controlled and the audit trail clean.

What you see

  • Role-aware navigation, so each user sees only their workflows.
  • Tenant-scoped data, so organisations stay separated.
  • Client portal access constrained to a single client relationship.

How to use it

  • Use the engineer role for field staff; do not grant office controls.
  • Use client portal users for landlords and agents.
  • Give everyone their own account so actions stay attributable.
  • Deactivate leavers instead of recycling accounts.

Roles and scope

OwnerFull tenantSettings, billing, team, all work
OfficeOperationsClients, checks, records, exports
EngineerField workOwn assigned checks on mobile
ClientPortalApproved records for their client

Decision guide

SituationRecommended actionProof it worked
A new field engineerInvite with the engineer role.They see only assigned checks on mobile.
A landlord wants visibilityInvite a client portal user.They see only their approved records.
Someone leftDeactivate the account.They can no longer sign in; history is preserved.

Troubleshooting path

  1. 1If a user cannot see a page, check the role and ask them to sign in again.
  2. 2If an engineer cannot see a check, confirm assignment and active status.
  3. 3If a client sees too little, check portal visibility and delivery.

Related docs

Accounts, sign-in, and securityClient portalSecurity, privacy, and data handling

Role Summary

  • Owner (shown as Owner / Admin on the Team screen): full tenant access, including account settings, billing, team controls, and all operational work.
  • Office: day-to-day workspace access for clients, properties, checks, defects, records, invoices, reports, and exports. Office can see the engineer list and settings but cannot add engineers, invite people, or change workspace settings.
  • Engineer: mobile-first access to assigned gas safety checks and the submit workflow. No office-only controls.
  • Client (shown as Client / agent): read-only portal access to approved records and client-visible property information.
  • Platform admin: internal control-plane access for customer support and tenant operations.

Permission Behaviours Customers Notice

  • Navigation changes by role. A user may not see a page if their role does not include that permission.
  • Data is tenant-scoped. Users should not see another organisation’s clients, properties, or records.
  • Engineers can only be assigned checks while active, and should not inherit office-only controls.
  • Client portal users stay inside portal routes and see only approved, client-scoped data.
  • Sole-trader mode collapses the office and engineer experience for a single operator without breaking these boundaries.

Troubleshooting Access

Troubleshooting

  • User cannot see a page: an owner checks their role under Settings, then Team, and the user signs out and back in after a role change. Only owners can invite people or change roles, and an invitation can carry the owner, office, engineer or client role.
  • Engineer cannot see a check: confirm the check is assigned to them, is active, and is scheduled.
  • Client cannot see a record: confirm the record is delivered or shared and portal visibility is enabled for that client.
  • Unexpected redirect to sign-in: the session expired, cookies were blocked, or an invitation link is stale.

Least-Power Access

Give each person the least powerful role that still lets them do their job. It keeps client data controlled and keeps the audit trail meaningful.

  • Use the engineer role for field staff; do not grant office controls they do not need.
  • Use client portal users for landlords and agents rather than sharing office credentials.
  • Give everyone their own account so records, approvals, and changes stay attributable.
  • Deactivate leavers instead of recycling their account for someone new.

Was this page useful?

Previous

How Manifold Fits Together

Next

Accounts, Sign-In, and Security