Roles and permissions

A role decides what someone can see and do. Everyone gets a role in each brand they work in, and Settings > Roles & Permissions is where you look at those roles and build your own. You need the Tenant Admin role to open it.

The built-in roles

The System Roles tab lists the roles that come with WorkWing. You can’t edit or delete them, but you can Clone any of them as the starting point for a role of your own.

Role	Who it’s for
Tenant Admin	Whoever owns the account. Everything, in every brand
Brand Administrator	Runs a brand: its settings, job types, people and reports
Operations Manager	Runs the work: jobs, customers, resources and reports, across brands
Operator	Day-to-day dispatch: creating, scheduling and assigning jobs
Resource	A field worker. Sees the jobs assigned to them, in the mobile app
External Worker	A contractor. Assigned jobs only, and it’s given out automatically when you invite one

What each role can do

Tenant Admin holds everything, so the interesting comparison is between the other four.

	Brand Administrator	Operations Manager	Operator	Resource
Create and edit jobs	Yes	Yes	Yes	Their own
Delete jobs	Yes	No	No	No
Assign people to jobs	Yes	Yes	Yes	No
Reschedule a locked job	Yes	Yes	No	No
Move a job to another brand	No	No	No	No
Create and edit job types	Yes	No	No	No
Create and edit customers	Yes	Yes	Yes	No
Create and edit resources	Yes	Yes	No	No
Create and edit teams	Yes	Yes	No	No
Record parts on a job	Yes	No	Yes	Add only
Create and edit parts	Yes	No	No	No
Create and edit custom fields	Yes	No	No	No
Configure brand settings	Yes	No	No	No
Edit email templates	Yes	No	No	No
Create a brand	No	No	No	No
View reports	Yes	Yes	No	No
Build custom reports	Yes	No	No	No
Report an observation	Yes	Yes	Yes	Yes
Turn an observation into a job, or close it	Yes	Yes	Yes	No
Set business hours	Yes	No	No	No
View the audit log	Yes	Yes	No	No
Manage members, roles, API keys and webhooks	No	No	No	No

Every No across all four is something only a Tenant Admin holds out of the box.

A resource sees the observations they raised themselves, whatever their role says, so a field worker can follow up what they reported.

Reopening a completed job

Completed, cancelled and failed jobs are locked. Reopening one to correct it is a separate permission, and only Tenant Admin holds it out of the box. Add it to a custom role if your operations managers need to fix closed work. See Statuses and workflow.

Roles in each brand

Roles are held per brand, so what someone can do depends on the brand they’re working in. An invitation gives the role in the brand you pick when you send it. Once someone has joined, Change role on their row in Team Members changes the role in a brand they already belong to, and that page shows what each person holds where.

To give an existing colleague a role in a brand they don’t belong to yet, use Add to brand on their row. A second invitation doesn’t do it, because someone who’s already a member can’t accept one. A Tenant Admin works in every brand. For a field worker, Brand access on their resource record decides which brands offer them work. See Adding a resource.

Custom roles

If none of the built-in roles fits, build one. Open the Custom Roles tab and click Create Custom Role, or Clone a system role and edit the copy.

Give it a Role Name and a description.
Pick its Capabilities. They’re grouped by what they act on, with a search box and a tick-all control on each group. Each one says in plain words what it allows, such as “Create new jobs” or “Assign jobs to resources”.
Click Create Role.

You need at least one capability. The name has to be different from every other role you have.

Custom roles cover work inside a brand. Organisation-wide permissions stay with Tenant Admin, so a custom role can’t be given the audit log, brand creation, the parts catalogue, custom fields, skills, integrations, privacy tools, moving jobs between brands, or the organisation settings. Cloning a system role drops those and keeps the rest.

Edit, clone and delete a custom role from the actions menu on its row. Deleting one takes those permissions away from everyone holding it, so give them another role first.

What’s next

Team members: invite people and set who’s an admin
External workers: contractors and their access