Roles and Permissions

Clean Estimate uses the owner, admin, office, rep, and crew membership roles managed from Settings > Team > Permissions. Only an all-location owner with Manage team (manage_team) can grant, remove, or reset saved permissions for another non-owner member. Managers with Manage team can manage other non-owner profile, role, assignment, and access fields inside their scope, but cannot change individual permission grants. The server enforces the saved member record; Clean Estimate does not edit one shared permission template for everyone with the same role.

A Settings section you can't edit shows a plain-language, read-only banner instead of a raw permission flag — for example "Read-only — team management is granted to Owner, Administrator by default" instead of "no manage_team permission." When a flag's default is granted to every role or to none (or has no Team Management control yet, such as manage_integrations), the banner names the required permission and stops there rather than naming a role.

Current V2 permission model

A role supplies the starting permission bundle. The saved per-member flags are authoritative afterward. Changing a member's role reseeds the role defaults, so Clean Estimate asks for confirmation before replacing individual grants.

The non-owner roles available during invitation are:

• Administrator (admin) — broad office and administration defaults.
• Office (office) — scheduling, invoice, export, and shared-pipeline

defaults without broad company administration.

• Sales representative (rep) — road-sales defaults, including sales appointments,

invoice work, and calling.

• Crew (crew) — the least-privileged field-work starting bundle.

Owner is protected and cannot be assigned from the invitation workflow. Some special capabilities, including franchise-console access, are explicitly granted rather than inferred from the displayed role.

Inbox and Phone permission groundwork

V2 now safely stores five future Inbox and Phone permission keys on each member: view_inbox, manage_inbox, view_phones, view_phone_recordings, and acknowledge_phone_coaching. Existing member records are upgraded in resumable batches without replacing an explicit saved false. Invalid or unknown saved keys are quarantined for repair instead of being guessed, and an organization cannot switch to strict permission records until every member record is complete.

The prepared defaults are: Owner and Administrator receive all five; Office receives Inbox view/manage plus Phone view/recordings; Sales representative receives coaching acknowledgement and retains calling; Crew receives none. Managing Inbox implies viewing Inbox. Viewing phone recordings supplies only the minimum Phone context needed to render an authorized recording; it does not grant Phone administration.

These five controls are not yet shown in Settings > Team > Permissions, and current Inbox and Phone routes have not switched to them. Existing visible access behavior remains unchanged during this compatibility phase. This avoids presenting a revocation control before every affected route can honor it.

To change one member's permissions:

1. Open Settings > Team > Permissions.
2. Select another member inside your location scope.
3. Toggle only the permissions that person's work requires.
4. Confirm the saved state before relying on the new access.

The owner needs Manage team, all-location access, and cannot change their own permissions from this workflow. A manager cannot change individual grants, and a location-pinned manager cannot manage a member outside that location. Deactivation revokes current access but keeps the saved role and permissions; successful Reactivation restores them only after the Clerk organization membership is confirmed.

The member selector also includes a separate Red Line pricing access control. Its role defaults allow Owner, Admin, and Sales representative, and deny Office and Crew. A saved allow or deny overrides the role default; select Use role default to clear it. A teammate who can manage the selected member can change this Red Line setting. Effective floor display still depends on Red Line being enabled and the estimate's assigned teammate having access. This setting does not grant View all commissions; see Commissions for preview rules.

See Adding Your Team for invitation setup and Team Management for profiles, location and crew assignment, pending invitations, and Activity.

Current V2 Calendar permissions

V2 stores permission overrides on each teammate rather than editing one shared role template. The Calendar defaults are:

Manage calendar allows office-wide web scheduling, moving, releasing, conflict overrides, and deciding customer appointment-change requests from Tasks. It also allows one-time standalone job creation for existing active customers and saved properties in the teammate's location scope, and opens the location-scoped governed repeat-work queue so the teammate can create its one frozen-scope unscheduled job. Run sales appointments makes an active teammate eligible to be the separate appointment assignee at service locations they can access. Grant the second permission to a technician only when that person should run sales visits; the lead's assigned sales rep does not change.

A web-capable teammate with Run sales appointments but without Manage calendar can schedule only a lead they own, only with themselves as the appointment assignee, and cannot override a conflict. The rep role remains a mobile-only role; its default Run sales appointments permission does not grant access to the full web administration surface.

To change either permission:

1. Open Settings > Team.
2. Find an in-scope teammate and select Permissions.
3. Toggle Manage calendar or Run sales appointments.
4. Confirm the saved override before assigning new work.

In the Team permissions editor, only an all-location owner with manage_team can change another non-owner member's individual grants. Capacity for an all-location appointment assignee is checked across the organization even when the dispatcher is pinned to one office. Calendar converts each event from its service location's timezone before comparing intervals, so a cross-office overlap cannot be hidden by different wall-clock times. A location-scoped teammate may see a conflict badge without seeing the private customer or event details from the other office.

These flags do not change the mobile app's visible layout, navigation, labels, or styling. The approved mobile appointment save waits for the shared calendar to accept the revision, closes on success, and stays open with an error when the slot, assignee, permission, connection, or revision is rejected. Mobile users still cannot override a conflict.

Current V2 Invoice money permissions

Invoice preparation and money movement are separate authority levels. An active member needs Manage invoices (manage_invoices) to create, edit, or deliver an invoice. The same grant can change the organization-wide customer payment offer Let customers prepay when rebooking the exact completed work under Settings > Customer payment offers; enabling that default-off offer affects which eligible customers can choose prepayment. Office Collect payment, including Open secure card checkout, and Refund require both Manage invoices and Issue refunds (issue_refunds).

That two-grant rule describes ordinary invoice money actions. Resolving an exact-work row through Refund attention also requires Manage calendar because the action is available only inside the teammate's location-scoped repeat-work queue. A teammate needs all three grants—Manage calendar, Manage invoices, and Issue refunds—to start or retry that governed repeat-work refund. Calendar-only teammates can see the operational hold but cannot receive the financial command details or perform the refund.

The service does not trust a capability loaded when the page opened. It locks and rechecks the current active member, both grants, and current all-office or same-office entitlement inside the invoice money operation. Revoking either permission, deactivating the teammate, or assigning them to another office blocks a stale Collect, hosted-Checkout, or Refund even if an older page had already shown the action; it also blocks any provider-refund recovery retry for that actor.

The same two-grant rule protects the Deposit received and Waive actions for a non-membership proposal deposit. The deposit service rechecks the exact signed-in member, active state, Manage invoices, Issue refunds, and current all-office or same-office entitlement while holding the authorization lock. A cached page permission cannot win a race with a committed deactivation, grant removal, or office reassignment. Stripe's verified payment webhook is a separate system path and does not impersonate an office member. A monthly-plan acceptance remains checkout-only even before plan reconciliation creates its plan row.

V1 reference boundary: The five-role labels, shared role-template editor, and broader historical catalog below describe Clean Estimate V1. They are retained as historical reference, not as current Team controls. Current V2 intentionally keeps authoritative permissions on each member so a role-wide template change cannot silently expand access for unrelated teammates.

Franchise report access (Current V2)

The read-only Franchise report requires an active platform-linked franchisor workspace, all-location access, and the explicit View the franchise console permission. This permission is not included in role defaults; it must be granted to the intended member. It does not grant access to member-company records. See Franchise Reporting.

Clean Estimate V1 used role-based access control to determine what each team member could see and do. It had five built-in V1 roles with customizable defaults under Team > Permissions. The historical details below document that system.

Permissions are enforced in the admin APIs too, not only in the visible UI. If a role does not include a permission like messages.send, automations.manage, holiday_lights.manage, or estimates.manage, CE Pro now returns 403 even if someone tries to hit the route directly from the browser or a copied API request.

Some record-detail actions also keep role- and ownership-based rules on top of the broad permission system. For example, sales reps can still delete only their own assigned leads and estimates, while client and job deletes stay limited to owner and manager roles even if someone can open the detail page.

The Five Roles

Owner (Purple Badge)

Full access to everything. Owners can manage billing, delete the organization, and control all settings. Every account needs at least one Owner.

Manager (Blue Badge)

Access to everything except billing management and organization deletion. Managers can invite team members, configure pricing, manage clients, and view all reports.

Sales Rep (Green Badge)

Can create and manage estimates, view clients, work the sales pipeline, and send messages. Sales reps can delete only leads assigned to them and estimates assigned to them. Cannot delete clients or jobs, and cannot access organization settings or team management.

Crew Lead (Orange Badge)

Can view the job schedule, update job statuses, and see details for assigned jobs. Cannot create estimates, delete records, or access settings.

Technician (Yellow Badge)

The most limited role. Can view today's schedule and update job status for assigned jobs. Cannot delete records or access anything else.

Permission Groups

Permissions are organized into groups. Each group controls access to a section of the app.

Dashboard and Analytics

• View the main dashboard
• View revenue analytics
• View service mix analytics
• View geography analytics
• View sales cycle analytics
• Export analytics data

Default access: Owner, Manager.

Jobs and Schedule

• View the schedule
• Create one-time standalone jobs for existing active customers and properties, schedule and edit supported jobs, and review/materialize one frozen-scope unscheduled job from the governed repeat-work queue when Manage calendar is granted
• Assign crews to jobs
• Update job status
• View route optimization in V1; current V2 route optimization remains required parity
• Delete jobs from the job detail page in V1 (owner and manager only); current V2 does not expose this action

Default access: Owner and Manager have both Schedule view and Schedule manage. Sales Reps, Crew Leads, and Technicians start with Schedule view only unless an Owner customizes the role.

Estimates and Clients

• Create estimates
• Edit estimates
• Send estimates
• Delete estimates
• View client list
• Edit client records
• View pipeline

Default access: Owners and managers can delete any client, lead, or estimate in their org. Sales reps can delete only leads and estimates assigned to them. Crew leads and technicians cannot delete records.

Proposal reassignment and rep handoff actions also follow the Estimates manage permission now. A teammate who can only view estimates can still open the record, but they cannot reassign ownership or push a handoff through the API.

On mobile, the center Create launchers and global Quick Add use the effective server permission matrix for the selected workspace. They do not assume that every owner/manager/sales role can create every record after an override is saved. Global Search uses the same authority: field defaults search only assigned jobs, while CRM and estimate filters appear only when their read permissions are active. Conversation search remains in Inbox.

The More record links use that same server response. If an owner grants a crew lead or technician access to Clients, Leads, Estimates, Jobs, Invoices, or Task/Event workflows, those destinations can appear for that user; removing the corresponding permission hides them again. The built-in role name does not override the saved permission grant.

Employee Time Clock, availability, training, and eligible My Pay screens do not grant Team administration. The Team directory, team timecards, and timesheet approval screens stay owner/manager only.

Communications

• Send SMS messages
• Send emails
• View message threads
• Access the messaging inbox
• Trigger manual review requests
• Manage phones (manage_phones) - configure the company SMS sender and

current V2 inbound-call/forwarding/voicemail settings, and read the organization-bound Twilio webhook displayed in Settings

• View Phone Activity - open permission-scoped call history and call detail
• Place Phone Calls (place_phone_calls) - use Quick dial, callback

actions, and Android voice registration

Default access for the legacy messaging and phone-activity controls: Owner, Manager, Sales Rep. This category default does not apply to Manage phones. Current V2 stores five bundle keys that are distinct from the legacy labels above: owner is Owner; admin is the full-access Admin counterpart to the legacy Manager workflow; office is the limited Office membership; rep is Sales Rep; and crew is the shared current V2 authorization bundle for Crew Lead and Technician workflows. The V2 manage_phones flag defaults on only for owner and admin; office, rep, and crew default it off. The V2 place_phone_calls flag defaults on for owner, admin, and rep, and off for office and crew. Any saved per-member override applied by an all-location owner with manage_team is authoritative after those defaults are seeded.

That default describes the existing web and V1 communications controls. Current V2 native More > Inbox uses the focused Road-role boundary instead: owner, admin, office, and rep memberships can open the customer Inbox, while a crew-only membership cannot. V2 does not reuse the legacy messaging switch for that destination. Its outbound actions still enforce the live matched-customer, contact, consent, company-sender, provider, stale-thread, and idempotency gates.

Phone viewing and phone calling are separate permissions. In the V1 six-tab mobile baseline, Phone stays visible for every role so navigation does not shift. When viewing is disabled, that V1 tab explains that access is controlled here and makes no call-history request. When viewing is enabled but calling is disabled, call history remains readable but the dialer and callback actions are omitted. Crew leads and technicians can be granted either permission through the saved role override just like the other editable roles. Current V2 Road uses Home / Leads / Create / Estimates / More, and current V2 Crew uses Today / Truck / My pay / More; neither current V2 shell exposes Phone. The frozen V2 mobile Inbox does not yet expose call activity or callback controls backed by these permissions. Quick dial, callback, Android voice registration, and the separate Phone destination remain required parity pending explicit approval of the preserved mobile proposal.

Manage phones is separate from both permissions. It grants configuration access; by itself it does not grant call-history viewing, Quick dial, callback, or Android voice registration. Owner and admin role bundles enable it by default. An all-location owner with manage_team can open Settings > Team > Permissions and toggle manage_phones for another non-owner member. Managers can review the saved grant but cannot change it. No one can change their own permission flags from this workflow. Changing that teammate's base role reseeds the role defaults, so review the individual flag after a role change. The permissions editor shows the stored flag name manage_phones.

The same all-location-owner, manage_team, non-owner-target, and no-self-change rules apply when toggling place_phone_calls from the teammate permissions list. This calling flag is independent of manage_phones: granting phone setup access does not grant callbacks, and granting callbacks does not grant phone configuration.

Services

These permissions cover specialized service modules:

• Holiday Lights — Create and manage holiday lighting proposals, inventory, and designs.
• Fleet — Create and manage fleet wrap proposals and vehicle inventory.
• Commercial — Create and manage commercial building proposals and the commercial pipeline.

Default access: Owner, Manager, Sales Rep (create and manage). Crew Lead (view assigned jobs only).

Administration

These permissions cover system-level settings:

• Automations (V1 parity) -- V1 separated workflow viewing and management.

Current V2 does not expose the configurable workflow area or these controls.

• AI -- Access AI-powered tools such as lead scoring, pricing analysis, and supported estimator helpers.

• Operations / Equipment — View operational assets and inventory; the separate Equipment permission controls asset changes, meter corrections, maintenance rules, inventory movements, and install/takedown allocation. Category-wide maintenance rules also require all-location access.
• Pricing — View and edit service pricing configuration.
• Team — Invite and remove team members, change roles.
• Marketing — Create and manage marketing campaigns and promotions.
• Billing — View and manage the subscription, payment methods, and invoices.
• Settings — Edit company information, integrations, portal settings, and brands.

Default access: Owner has full access. Manager has access to everything except Billing and organization deletion. All other roles have no access.

How to Customize Permissions

1. Go to Team --> Permissions.
2. Select a role from the list on the left.
3. The permission groups for that role appear on the right.
4. Check or uncheck individual permissions within each group.
5. Changes save automatically.

Warning: Only Owners can modify permissions. Managers can view the Permissions page but cannot make changes.

>

Permission saves now reject malformed payloads before anything is written. In practice, that means CE Pro accepts only the built-in editable roles and known permission keys, instead of silently storing broken custom payloads.

>

Reset version safeguard: Resetting a teammate to the defaults also stamps the complete current permission-record version. This happens even when an older record's visible values already match the selected role defaults.

Reactivation safeguard: Deactivated teammates remain visible in Settings > Team > Members. An in-scope teammate with Manage team may reactivate an eligible non-owner; only an all-location owner may reactivate another inactive owner. Reactivation preserves the saved role, location, crew, and individual permissions. Clean Estimate confirms that the teammate still belongs to the company sign-in account before restoring local access. If that membership is missing, the teammate stays inactive; after provider removal reconciles, use Add member with the same verified email to reinvite the durable member. If the provider cannot be checked, Reactivation also stays safely off. A concurrent deactivation or other access change wins over the older request.

Default Permission Summary

Tips

• Start with the default permissions. Customize only when a team member needs more or less access than their role provides.
• Use Sales Rep for field estimators. They can do everything customer-facing without touching system settings.
• Treat Automations view/manage as retained V1 permission semantics, not

current V2 controls. They become relevant when the configurable engine is ported with server-enforced permissions.

• Remember that delete actions are narrower than simple page access. A role might be allowed to open a lead, estimate, client, or job detail page and still be blocked from deleting that record if the built-in ownership or manager-only rule does not allow it.
• The holiday lights Measure with AI action follows permissions too. A signed-in user needs Holiday Lights manage, Estimates create, or AI access before the estimator can call the measurement service.
• Crew Lead and Technician are designed for people who work in the field and usually only need schedule visibility. The web-only Manage calendar grant permits supported standalone creation, booking, and status updates; reordered truck dispatch remains V1 parity. No native mobile UI changed in this release.
• Review permissions quarterly. As your team grows, make sure access levels still match job responsibilities.