When you switch on Roles & Permissions, Fixably creates a small set of roles for you. This article explains what those roles can do and access. It then gives ready-to-build setups for common job roles that Fixably does not create automatically.

Permission names below are shown exactly as they appear in the role editor (System Settings → Security → Roles & Permissions). For what each permission does, see Roles & Permissions Definitions. If a role isn't behaving as expected, see Troubleshooting Roles & Permissions.

Roles only affect employees. Roles apply to users whose Access level is User (Employee access). Users set to Admin (Full access) can do everything regardless of their roles, so they don't need a role. The one exception is that admins only appear in the order Handler list and the user statistics report if one of their roles has Can be assigned as Order Handler or Visible in User Report.

The roles Fixably creates for you

When Roles & Permissions is first enabled:

• User and Full Access are always created.
• Reporting, Moderator and Invoicing are created only if some of your employees already had the older role of the same name. Those employees are moved to the new role automatically.
• Every employee who doesn't end up with a role is given User.
• User is the Default role for new users, so new employees get it automatically.

You may also see Technician and Shop assistant roles. These were created for accounts that used the older employee type setting (Technician / Shop) on the user settings page.

All of these roles can be edited. Every role except User can also be renamed or deleted. The descriptions below describe each role as Fixably creates it. If someone on your team has changed a role since, open it in the role editor to see what it has now.

User

Who it's for: a general employee such as a technician or front-desk colleague. The User role can run the whole order workflow from check-in to collection. It can't manage your team, your catalogue, invoicing or settings, and it can't edit customer cards.

Can't be renamed or deleted. If you want a different default role, create a new one and tick Default role for new users on it.

What the User role can do

Review the User role before rolling it out. It is deliberately broad so that turning on Roles & Permissions doesn't take anything away from your team. Most businesses tighten it. The usual candidates to remove are: Delete order, Force close, Undo dispatch, Delete confirmed order line, Edit order line prices, Reveal order task encrypted data (keep the "only on orders assigned to the user" version), Delete purchase order, Delete stock, the import permissions, and the settings pages listed under System Settings in the table above. Also add Can be assigned as Order Handler if this role does repairs. Without it, nobody holding only this role appears in the Handler list.

Full Access

What it has: every permission in Fixably, including all System Settings pages, invoicing, reports, users, products and vendors.

What it still can't do, because the user is an employee rather than an admin:

• Open System Settings → Security. This means they can't create or edit roles, switch Roles & Permissions on or off, or change the Security settings.
• Get around the Security settings described in Troubleshooting Roles & Permissions (for example product prices, deleting orders, customer email addresses).
• Remove an admin's login.

When to use it: for a trusted senior employee who needs nearly everything but shouldn't control security. If someone really needs everything, make them an admin instead. Full Access doesn't tick any Global settings, so the user sees prices, customers and all locations.

Reporting

Everything in the User role, plus: View reports, View stats for user's location, View stats for all the users in the default location.

Moderator

Everything in the User role, plus: View users, Create user, Edit user, View customers, View vendors, Transfer user's orders. A Moderator can create and edit employee accounts but can't assign roles to them. Add Edit role if they should.

Invoicing

Everything in the User role, plus every Invoices permission: Manage single invoices, Manage receipts, Manage voided invoices, Manage Apple invoices, Mark single invoice paid, Print invoices, Send single invoice, Void single invoice, Create credit invoice, Link credit invoice to debit invoice, Import Apple reimbursements, View Apple reimbursements, and, where enabled, the consolidated invoice and Samsung reimbursement permissions.

Technician and Shop assistant

Only present on some accounts (see above). Technician has Can be assigned as Order Handler and Visible in User Report. Shop assistant has Enable Idle Mode. These roles are meant to be held alongside another role such as User, which supplies the everyday permissions. On their own they give almost no access.

Suggested roles

The setups below cover common job roles. Each one starts from an existing role and lists exactly what to add and remove, so the finished role is fully defined.

How to build one: go to System Settings → Security → Roles & Permissions, open the starting role, choose Create new based on this role, give it a name, make the changes listed, and save. Use the Filter permissions box to find each permission quickly. Permissions marked * only appear when the related feature or integration is switched on. Skip them if you don't see them.

Give each person one role where you can. Permissions from several roles add up, and Global settings such as Hide product prices only apply if every role the person holds has them ticked. One role per person is the easiest setup to understand.

1. Technician

Repairs devices assigned to them. Can't change prices, delete records or administer stock.

Start from: User

Add:

• Can be assigned as Order Handler
• Visible in User Report

Remove:

• Orders: Delete order, Force close, Import orders, Export orders, Edit order price list, Edit order price list status, Edit owner, Charge order
• Batch edit: Batch close orders, Batch dispatch orders, Batch create new orders, Batch send email, Batch send SMS
• Order lines: Edit order line prices, Create discount for order line, Delete discount for order line, Create refund for order line, Delete confirmed order line, Undo dispatch
• Order tasks: Reveal order task encrypted data (keep …only on orders assigned to the user)
• Customers: Remove customer account, Manage customer specific accounting settings
• Devices: Delete devices, Import devices, Export devices
• Products: Import products, Export products
• Stocks: Delete stock, Import stock, Import stock transfers, Edit stock count, Create difference list, Edit stock quantity
• Purchase orders: Delete purchase order, Import purchase orders, Send purchase order to vendor
• Purchase invoices: Manage purchase invoices
• Repairs: Delete repair
• System settings: any settings permissions the role has

Global settings: optionally tick Hide product prices if technicians shouldn't see what customers pay. Tick Locked to default location and store if you have several locations.

2. Front desk / Customer service

Checks devices in and out, books appointments, keeps customer details up to date and takes payment.

Start from: User

Add:

• Customers: Edit customer, Reset customer password
• Appointments*: View appointments, Create appointment, Edit appointment, Cancel appointments, Set appointment visited
• GSPN appointments* (Samsung service centres): View GSPN appointments, Create GSPN appointment, Edit GSPN appointment, Cancel GSPN appointment, Set GSPN appointment visited

Remove:

• Orders: Delete order, Force close, Import orders
• Order lines: Delete confirmed order line, Undo dispatch
• Order tasks: Reveal order task encrypted data
• Devices: Delete devices, Import devices, Harvest device parts
• Repairs: Delete repair
• Stocks: Delete stock, Import stock, Import stock transfers, Edit stock count, Create difference list, Edit stock quantity
• Purchase orders: Delete purchase order, Import purchase orders
• Purchase invoices: Manage purchase invoices
• System settings: any settings permissions the role has

Security setting: turn on Employees are allowed to edit customer email addresses if front desk should correct customer emails.

Variant: sales desk. For a counter that mainly sells, tick Use simplified home screen as well.

3. Team lead / Location manager

Runs a location without being an admin: reassigns work, follows team performance and corrects customer records.

Start from: User

Add:

• Orders: Can be assigned as Order Handler, Create new order tags
• Customers: Edit customer, Archive customer, Unarchive customers, Export customers
• Users: View users, Transfer user's orders, View user's report, View user' tracking, Edit user's hour tracking
• User settings: Manage other users' settings
• Reports: View reports, View stats for user's location, View stats for all the users in the default location, View stats for users, View status duration statistics, Visible in User Report
• Products and vendors: View price lists, View vendors
• Order lines: Change to Pending Purchase, Mark allocated
• Repairs*: Override repair budget lock, Override repair threshold gate, Supervise repair codes with missing skills

Optional (to manage staff accounts): Create user, Edit user, Edit role.

Remove: nothing required. Consider removing Import orders and Import stock.

Global settings: tick Locked to default location and store so the lead only sees their own location.

4. Parts & stock coordinator

Maintains the catalogue, orders parts from vendors and manages stock.

Start from: User

Add:

• Products: Create product, Edit product, Undelete product
• Vendors: View vendors, Create vendor, Edit vendor, Export vendors
• Price lists: View price lists
• Stocks: Create stock
• Order lines: Change to Pending Purchase, Mark allocated, View unassigned request details, Print labels, Print label with QZ Tray*
• Warehouse*: Create warehouse positions
• Manifests*: Create manifest

Remove:

• Orders: Delete order, Force close, Charge order
• Order lines: Edit order line prices, Create discount for order line, Create refund for order line
• Order tasks: Reveal order task encrypted data, Reveal order task encrypted data only on orders assigned to the user

Security setting: if this person also maintains product prices, turn on Employees are allowed to edit product prices. This lets every employee with Edit product change prices, so only give Edit product to this role.

5. Finance / Accounting

Handles invoices, payments, credit notes and reimbursements, and pulls financial reports.

Start from: Invoicing (or User if you don't have an Invoicing role, then add every Invoices permission)

Add:

• Customers: Edit customer, Edit margin for customer, Export customers
• Vendors: View vendors, Export vendors
• Price lists: View price lists
• Reports: View reports, View advanced reports, View stats for all locations, Create, edit and delete saved reports
• Apple remittance advices*: View Apple remittance advices, Create Apple remittance advices, Edit Apple remittance advices, Delete Apple remittance advices, Send remittance advice EDI to Apple
• Samsung credit requests*: View Samsung credit requests, Export Samsung credit requests, Mark Samsung credit request handled, Add comment for Samsung credit request
• System settings (optional): Manage payment terms, Manage payment types, Manage tax rates, Manage ledger codes, and your accounting integration (for example Manage Fortnox, Manage Quickbooks Online integration)

Remove: the repair-floor permissions this person won't use. At a minimum: Delete order, Force close, Undo dispatch, Delete confirmed order line, and Reveal order task encrypted data (both versions).

Security setting: turn on Void paid invoices if finance needs to void invoices that already have payments.

6. Read-only (auditor, owner, external partner)

Can look at everything relevant but can't change anything.

Start from: a new, empty role (Create Role, then Unselect all)

Grant only:

• Orders: View orders, View order customer, View order device, View order timeline, View order shipments, View inbound tracking number, View TAT promise for order*, View proof of purchase*, View coverage type*
• Order lines: View order lines, View part request history*
• Order notes: View order note
• Order tasks: View order tasks
• Customers: View customers
• Devices: View devices, View device history, View device diagnostics, View GSX details*, View Blackbelt data for device*, View Phonecheck data for device*, View VMI for device*
• Device models: View device models
• Files: View files
• Products: View products, View purchase price
• Stocks*: View stocks, View stock quantities, View stock logs, View stock transfers, View stock difference lists
• Purchase orders: View purchase orders, View purchase order line prices, View purchase order line identifiers (serial, IMEI)
• Shipments: View shipments
• Repairs: View repair
• Messages: View emails, View SMS messages*, View WhatsApp messages*
• Alarms: View alarms
• Service contracts: View service contracts
• Internal transits*: View internal transits
• Manifests*: View manifests
• Reorder suggestions: View reorder suggestions
• Reports (optional): View reports, View stats for users, View stats for all locations, View status duration statistics

Global settings: for an external partner, consider Hide customer information, Hide product prices (and leave out View purchase price), and Locked to default location and store.

After you build a role

1. Assign it from the employee's user card and remove any roles they no longer need.
2. Log in as (or ask) someone with that role and walk through their normal day. Don't test as an admin, because admins skip role permissions.
3. Check the Security settings under System Settings → Security → General, which apply on top of every role.
4. If you want new employees to get this role automatically, tick Default role for new users on it.

Related: Using Roles & Permissions in Fixably · Roles & Permissions Definitions · Troubleshooting Roles & Permissions