A manager role brings together the permissions needed in the browser. Configure the role as an admin user and add users whose duties are similar. Distinguish between the user's browser access, role membership and the permissions granted by the role.

Check the prerequisites for access

The user must have active Admin portal credentials. Check this by opening the user's details from Manage user accounts → List of users in the browser menu. A manager role alone does not give the user browser access. If needed, see adding a user.

A manager role defines browser access. Permissions for Android and iOS are configured separately through mobile user roles, even if the user uses both with the same account. See mobile user roles and folder permissions. A feature-specific permission also does not enable a feature that the organization does not have: for example, warehouse and purchase order functions must be enabled before they can be used.

Open the role and select its members

  1. Open Manage user accounts → User roles.
  2. Select Create new manager user role at the top of the page. To edit an existing role, click the pencil icon on its row. The settings in the edit form are on the Manager user role tab.
  3. Enter the Name of the role and, if needed, a description explaining its purpose.
  4. Open the Users section. Move the people you want from the All manager users list on the left to the list of selected users on the right. Remove a member by moving them back. You can search by name or email address.

The member selection includes manager users; admin users are not added to this role. An ordinary manager user cannot create or change manager role permissions. Being able to view a role therefore does not mean that its settings can be saved.

Select permissions to complete, edit and view tasks

Under Tasks in the form's Responsibilities and rights in Tasks and Service Requests section, the options serve different purposes:

  • Right to complete tasks you are responsible for allows users to view and complete their own tasks and handle the products, time logs, comments and attachments associated with a task. On its own, it does not grant permission to edit the task's general settings.
  • Right to complete and edit own tasks also allows more extensive task editing, such as changing the due date, Spot, workers, resourcing, task template and task form.
  • Right to create tasks for Spots the role can see, even if the role lacks folder edit/create permissions allows tasks to be created based on the role's folder read permissions. When creating a task through this option, the Spot must belong to a folder hierarchy allowed for the role. The workers that can be selected are the role's members, the user themselves, their own manager roles, and roles and their members whose visibility is allowed by the content permissions. Permission to create a task does not itself grant permission to complete or edit the new task.
  • Hide other users' tasks even if the role has folder permissions restricts the task visibility provided by this role's folders to the user's own tasks. It does not grant any new permissions.

Own tasks are tasks where the user is personally assigned as a worker, their manager or mobile user role is assigned as a worker, or the task's workers follow their role. This definition is not based solely on a single responsible person field. With permission to complete a task, it can be completed when its status is In Progress or In Review; the task's other completion requirements must still be met.

Hiding other users' tasks keeps the user's own tasks visible, along with tasks visible through another manager role's folder permissions or reviewer selection. Check all of the user's roles if visibility is broader than expected.

Checking restrictions on task creation: do not rely solely on clearing the task creation option to prevent task creation. The current implementation may allow a user to create a task even when none of their manager roles has this option selected. Test in practice as the user that task creation is prevented.

Grant access to other users' tasks

In the same Tasks section, select The role acts as a task reviewer in the tasks of the following other roles. From the options that appear, select either Permission to complete tasks assigned to these roles or Permission to complete and edit tasks assigned to these roles. The first option is the default.

Specify the targets in the Users and roles to which the reviewer's right applies field. Selecting a user applies to tasks assigned to that person as a worker where the workers do not follow a role. Selecting a role applies to tasks where the selected role is assigned as a worker or the workers follow it. If the intention is to handle tasks that follow a role, select the role; selecting only one of its members does not cover those tasks.

The more limited option allows the selected tasks to be viewed and completed in the In Progress and In Review statuses, and information related to completing them to be handled. The broader option also allows general task editing. The name of the reviewer role therefore does not mean view-only access. See the separate instructions on reviewing a task and its report.

Role resourcing settings for tasks is a separate expandable area in this section. Resourcing settings relate to work planning; they do not replace the permissions defined above.

Configure folders and their content permissions

Go to Access rights to folders and their contents in the form and select Role grants permissions for folders and other content. Under it, open Select folders to add permissions into.

On each folder row, configure Create, Read, Edit and Delete under Folders and Spots as needed. Add a permission by clicking the plus icon in the cell. A selected permission is shown as a check mark; click it to clear the selection. Select all selects the row's four content permissions. Clicking its check mark clears all permission selections on the row, including Management.

The permissions extend to the selected folder's subfolders and their Spots. Read allows folders and Spots to be viewed. Content permissions also apply to tasks, messages, files, notifications, costs and reservations associated with Spots. For example, Edit may allow tasks in the folder hierarchy to be edited and completed; it is a broader permission than simply completing one's own tasks.

Management is a separate option for managing the folder hierarchy. Clicking its plus icon also selects all four content permissions. Management allows subfolders to be created, edited and deleted, but does not allow the selected root folder to be edited or deleted. Conversely, Edit or Delete under Folders and Spots alone does not allow folder management.

Clearing the Management check mark leaves the content permissions in place. If you want to reduce those as well, clear them separately and check the row again. When removing an individual content permission, also check the Management selection.

For an existing role, the folder list initially shows only the selected folders. Clear Show only the selected folders when you want to add permissions for other folders.

Note before saving: if you clear the main Role grants permissions for folders and other content option and save, the role's saved folder permissions are removed and its content permission selections are cleared. This does more than simply hide the settings. Enabling the option again requires the permissions to be configured again. This change does not delete Spots or their content.

Configure permissions for other functions

Manager's content rights is below the folder selections. Open the function group you need and configure Create, Read, Edit and Delete on its rows. Selecting Edit or Delete also selects Read in the interface. The plus box in a column heading selects that permission on the group's editable rows; the minus box clears those selections.

Folder permissions apply to assets and their content, while these permissions apply to managing items such as products, price lists or forms. Configure both if the work requires both.

  • Task and Service Request Management: task templates, task forms and their fields, hourly maintenance templates and long-term maintenance plans. Managing a task template or form is different from completing an individual task.
  • Assets, devices, tools: attributes, device cards and tags. For example, editing the structure of a device card and editing a field value on a Spot require different permissions.
  • Warehouse management: products, product categories, warehouses, warehouse events, purchase orders, product inquiries, and vendors and purchase order email templates.
  • Customers: customers and their contact persons, contracts, offers, work orders and price lists.
  • Reservations: reservation sites and reservation costs. Permission to handle a Spot's reservation also depends on folder permissions.
  • Other management: general notifications, the order portal, visibility in user and role selections, and working time monitoring.

Not all boxes can be edited. Read is already allowed for task templates, task forms, hourly maintenance templates, attributes, tags, work orders and the order portal. Create for the order portal means placing an order; Edit and Delete cannot be selected.

Use a template as a starting point

Select role template is at the beginning of the Manager's content rights section. Select, for example, Basic permissions or a warehouse and purchase order template that suits your needs. A template replaces the editable permission selections on the function rows it covers: it may also remove previously selected permissions.

A template does not configure folders, warehouse restrictions, visible roles or task permissions. Check those separately and review the content permission rows as well. No permissions does not remove Read permissions that are already allowed or permissions from the user's other roles. All permissions does not grant admin user status.

Distinguish between products, warehouse management and warehouse events

The Warehouse management row in the Warehouse management group grants broader permissions for configuring warehouses and warehouse slots. Read includes viewing warehouse information, events and purchase batches; Edit also includes performing warehouse events and correcting purchase batches.

Permission for warehouse events provides a more limited alternative without permission to edit warehouse and warehouse slot configurations. Its Read permission allows viewing, and Edit allows events such as receiving, issuing, inventory and transfers. Create and Delete cannot be selected on this row: Edit is used to perform a new event.

Select the warehouses under Additional options on each row you use. Without a warehouse selection, the row's permissions are not saved. Warehouse selections are configured separately for each row, and permissions from the user's different roles are combined. Read access to products and performing a warehouse event serve different needs; also grant the necessary product permissions.

The Projektilla warehouse does not appear in the list of selectable warehouses. It is automatically added to the warehouse restrictions in use when saving.

Configure visibility in selection lists and working time permissions

Open Other management. Additional options on the Visibility to Manager Users and Visibility to Mobile Users rows define which other roles and their users a manager can find in selection lists restricted by permissions, for example when selecting workers. The user's own roles are also taken into account. This does not grant permission to edit user accounts or the settings of the selected roles.

On the Working time monitoring row, select the required permissions and the manager or mobile user roles whose members' entries the person handling them needs to access. Permit all expands the target group to all users and disables role selection. Belonging to a working time rule does not replace these permissions. Handling work hours may also require access to the relevant task or service request. See checking permissions for functions and time logs and working time rules and entry types.

Check service request permissions separately

Task permissions alone do not determine how service requests can be handled. Selecting a manager role's completion or editing option allows it to be used in responsible role selections for service requests, but the actual permissions to view, complete, edit and create service requests are defined in the service request type.

For an existing role, the Responsibilities and rights in Tasks and Service Requests section also contains a Service requests list. It shows the role's responsibility, observer and creation settings for each type. Open a type's settings by clicking its name. This list is not yet available on the form for creating a new role. See configuring service request visibility and permissions.

Save and verify the effects

Save a new role with Create new manager user role, and changes to an existing role with Save. The role must grant folder and content permissions or have Right to complete tasks you are responsible for selected. Selecting only the reviewer, creation, hiding or broader own-task editing option does not meet this saving requirement.

Adding or removing members affects both permissions and workers who follow the role. A background update adds new members to unfinished tasks that follow the role, creates default resourcing for them, and removes departing members' worker assignments and associated resourcing. This update from the role form does not change the workers on completed tasks.

The update also applies to group tasks that follow the role, hourly maintenance task definitions, active offer task settings, and default resourcing for tasks, task templates and contracts. It does not mean that all tasks personally assigned to a user are removed. Removing the last member from a role may be prevented if the role is needed in tasks or other resourcing definitions.

Member additions and removals are recorded in the role history in the background. Reopen the saved role and select the History tab to check membership changes. The history does not list every change to a content permission selection.

  1. Reopen the role and check its members, task options, folders, content permissions and Additional options. In particular, check the outcome of using a template and removing permissions.
  2. Wait for the background update of membership changes and, if needed, check the workers and resourcing of a task that follows the role.
  3. As a role member in the correct customer account, test viewing the required Spot or work and performing the relevant change. Simply being able to open a view does not confirm permission to edit.
  4. Also check that the restriction works for an asset or task to which access is not intended. If the result differs from what you expected, check the user's other roles, reviewer selections and service request type settings. See investigating a user's access.