User roles & permissions
Setting specific user role permissions is a major piece of customizing your entire Ontraccr experience. This is where you decide what each user role can and cannot do.
How roles and permissions work in Ontraccr
To start, all users are categorized into roles in Ontraccr, which could represent the specific job function or seniority the role has within the company account. By default, every Ontraccr account is pre-loaded with the following four roles (in order of highest privilege/permissions):
- Admin
- Manager
- Supervisor
- Worker
From here, you can easily create an unlimited number of custom roles and further organize your company's Ontraccr experience.
Each role contains a set of permissions, which defines exactly what each user role can do in Ontraccr and even which pages they are allowed to see. This enables you to restrict the data set and visibility of different users within Ontraccr. For example, you may not want your field team users to see detailed project financials and sensitive company information so you can simply disable the relevant permissions in order to do so. Alternatively, you may want to invite users to use Ontraccr that are external to your company, such as subcontractors or inspectors, so you can create a custom role and restrict the roles down to a very limited number of permissions.
Whenever a user is created or edited in Ontraccr, it must be assigned a user role. As soon as the user role is assigned to the user, that user will then inherit the set of permissions that are configured for the user role.
Managing roles and permissions
You can access your company's roles & permissions settings by navigating to the Settings > Roles & Permissions page. The Roles & Permissions page will always be divided by all the roles that exist. Therefore, you will always see the four default role types at the top.
Enabling/disabling permissions
For each role in the Roles & Permissions page, you will see a detailed list of permissions that you can configure. For a detailed breakdown of what each permission means and how it works, please refer to the 'Permissions Glossary' section of this article below.
When updating permissions, Ontraccr will apply the changes in real-time immediately and does not require users to do anything to receive the permissions changes. For example, in the recording shown below, the 'View Materials' permission can show/hide the 'Materials' page instantly.
Note: There are instances where permissions changes won't apply instantly (e.g. if the app goes out of sync momentarily). In that case, please refer to and follow the steps outlined in the following troubleshooting articles on how to re-sync data in the web app and in the mobile app.
There are two types of permissions: single-role and multi-role permissions.
Single-role permissions
A single-role permission is a permission which only applies to the role in question (as in, the role you are editing the permission for). This type of permission will only have a single checkbox next to it. To enable/disable the permission, simply check or uncheck the checkbox as shown in the example below.
Multi-role permissions
A multi-role permission is a permission related to the ability for the role in question (as in, the role you are editing the permission for) to control specific actions and abilities on behalf of other role types. This type of permission will show a set of checkboxes next to each role configured in the company account in addition to a 'Self' checkbox (where the role in question has the ability to control the function for themselves).
By checking the box next to any role type or 'Self', you are allowing the role in question to control or manage the function for the roles selected.
For example, in the 'Time Tracking' multi-role permission shown below, the role was given the permission to track time for themselves, admins, managers, supervisors, and workers, but not for inspectors or subcontractors.
Creating custom roles
To create a new custom role, simply click the 'Add Role' button. Give the new role profile a name and click 'Create' to create it. You will see the new role added to the list immediately. From here, you can click into the role to begin configuring the permissions for it. (All permissions are disabled by default for custom roles, until you enable them individually.)
Important Note: After adding a new custom role, the role will be deselected by default in any multi-role permissions, so you will need to go and explicitly select the new custom role within the relevant multi-role permission. For example, say you just added a custom role for a subcontractor and you want Admin roles to have the ability to add or edit subcontractor profiles to Ontraccr, then you will first need to give the Admin permission to manage user profiles for the new newly-added subcontractor role as shown below.
Renaming and deleting custom roles
If you ever want to rename a custom role, simply click into the custom role's 'Role Title' field to edit it.
To delete a custom role, click the 'Delete' button in the top right.
Permissions Glossary
The following glossary will outline what each permissions controls and the implications it has throughout Ontraccr.
Manage Projects
This permission controls whether the user is allowed to manage project profiles. Since projects are such an essential part of the workflows in Ontraccr and they may contain a lot of sensitive information for the company, this is a very important permission.
Users who have this permission will have full access to the Projects > Projects page. They will also be able to view, add, edit, and archive any project profiles freely.
Users without this permission will not be able to access the projects page at all but they will still be able to access and select projects across many other parts of Ontraccr, including during time tracking or form completion. This permission primarily controls the user's ability to create or edit any of the project details or progress, it will not completely hide the project list from the user altogether.
View Customers
This permission controls whether the user is able to access the Contacts > Customers page. Users with this permission will be able to see and access the company's customer list and profiles in this page, users without this permission will not be able to see or access this page at all.
Manage Customers
This permission controls whether the user is allowed to manage customer profiles. In order to activate this permission, the user must first have the 'View Customers' permission enabled.
Users who have this permission will have full access to the Contact > Customers page. They will also be able to view, add, edit, and archive any customer profiles freely.
Users without this permission will still be able to access and select customers across many other parts of Ontraccr, including during form or board card completion. This permission primarily controls the user's ability to create or edit any of the customer details, it will not completely hide the customer list from the user altogether.
Some users may have the 'View Customers' permission but not the 'Manage Customers' permission. In this case, they will still be able to view and access all customer profiles in the Contacts > Customers page, but they will not be able to see the Add, Edit, or Archive functions.
View Vendors
This permission controls whether the user is able to access the Contacts > Vendors page. Users with this permission will be able to see and access the company's vendor list and profiles in this page, users without this permission will not be able to see or access this page at all.
Manage Vendors
This permission controls whether the user is allowed to manage vendor profiles. In order to activate this permission, the user must first have the 'View Vendors' permission enabled.
Users who have this permission will have full access to the Contact > Vendors page. They will also be able to view, add, edit, and archive any vendor profiles freely.
Users without this permission will still be able to access and select vendors across many other parts of Ontraccr, including during form or board card completion. This permission primarily controls the user's ability to create or edit any of the vendor details, it will not completely hide the vendor list from the user altogether.
Some users may have the 'View Vendors' permission but not the 'Manage Vendors' permission. In this case, they will still be able to view and access all vendors profiles in the Contacts > Vendors page, but they will not be able to see the Add, Edit, or Archive functions.
Manage Cost Codes
This permission controls whether the user is allowed to manage cost codes.
Users who have this permission will have full access to the Cost Codes pages. They will also be able to view, add, edit, and archive any cost codes freely.
Users without this permission will not be able to access the Cost Codes pages at all but they will still be able to access and select cost codes across many other parts of Ontraccr, including during time tracking or form completion. This permission primarily controls the user's ability to create or edit any of the cost code details or progress, it will not completely hide the cost code list from the user altogether.
View Equipment
This permission controls whether the user is able to access the Equipment page. Users with this permission will be able to see and access the company's equipment list and profiles in this page, users without this permission will not be able to see or access this page at all.
Manage Equipment
This permission controls whether the user is allowed to manage equipment profiles. In order to activate this permission, the user must first have the 'View Equipment' permission enabled.
Users who have this permission will have full access to the Equipment page. They will also be able to view, add, edit, and archive any equipment profiles freely.
Users without this permission will still be able to access and select equipment across many other parts of Ontraccr, including during form or board card completion. This permission primarily controls the user's ability to create or edit any of the equipment details, it will not completely hide the equipment list from the user altogether.
Some users may have the 'View Equipment' permission but not the 'Manage Equipment' permission. In this case, they will still be able to view and access all equipment profiles in the Equipment page, but they will not be able to see the Add, Edit, or Archive functions.
View Materials
This permission controls whether the user is able to access the Materials page. Users with this permission will be able to see and access the company's material list and profiles in this page, users without this permission will not be able to see or access this page at all.
Manage Materials
This permission controls whether the user is allowed to manage material profiles. In order to activate this permission, the user must first have the 'View Materials' permission enabled.
Users who have this permission will have full access to the Materials page. They will also be able to view, add, edit, and archive any material profiles freely.
Users without this permission will still be able to access and select materials across many other parts of Ontraccr, including during form or board card completion. This permission primarily controls the user's ability to create or edit any of the material details, it will not completely hide the material list from the user altogether.
Some users may have the 'View Materials' permission but not the 'Manage Materials' permission. In this case, they will still be able to view and access all material profiles in the Materials page, but they will not be able to see the Add Folder, Add, Edit, or Archive functions.
Manage Settings
This permission controls whether the user is allowed to manage any company settings. Since company settings are such an essential part of the workflows in Ontraccr and they may contain a lot of sensitive information and configurations for the company, this is a very important permission.
Users who have this permission will have access to the main sub-pages in the Settings page.
Note: In order to prevent the accidental removal of the 'Manage Settings' permission from all user roles, in which case there would be no way to configure company settings at all, Ontraccr doesn't allow the toggling of this permission for the default 'Admin' role type, as shown below. This means that Admin profiles will always be able to manage company settings.
Manage Customizations
This permission controls whether the user is allowed to access and manage the Settings > Customizations sub-page. The Customization settings is where various company configurations can be set, including customizing the company's project and other profiles, managing job costing templates, and much more.
Manage Teams
This permission controls whether the user is allowed to manage team profiles. This permission is also required for any time card approvers in order to give them permission to approve time cards for any users.
Users who have this permission will have full access to the Staff > Manage Teams page. They will also be able to view, add, edit, and archive any team profiles freely.
View Own Schedule
This permission controls whether the user can access the Schedule page (in the mobile app only) and view their own shifts. It only allows them to view their own schedule (as in, any shifts assigned to them), but doesn't give them permission to add/edit/delete any shifts within the schedule.
Manage Schedule
This permission controls whether the user is allowed to manage the Field Schedule. In order to activate this permission, the user must first have the 'View Own Schedule' permission enabled.
Users who have this permission will have full access to the Scheduling > Field Schedule page. They will also be able to view, add, edit, and archive any shifts freely both for themselves or for any other users.
Some users may have the 'View Own Schedule' permission but not the 'Manage Schedule' permission. In this case, they will still be able to view and access only their own shifts in the Field Schedule page. They will not be able to see any other users' shifts or access the Add, Edit, or Delete functions.
Manage Notification Preferences
This permission controls whether the user is allowed to access and manage the Settings > Notifications sub-page. The Notifications settings is where the company's notification preferences can be set across various part of Ontraccr.
View Own Boards
This permission controls whether the user can access the Boards page and whether they can access boards which contain cards that they are assigned to. It only allows them to view boards that have cards assigned to them, they won't be able to access any boards they are not involved in. It also doesn't give them permission to add/edit/delete any cards within the board, as that is controlled by the board permissions.
Manage Boards
This permission controls whether the user is allowed to manage boards. In order to activate this permission, the user must first have the 'View Own Boards' permission enabled.
Users who have this permission will have full access to the Boards page. They will also be able to view, add, edit, and archive any boards freely and will also have access to the board settings.
Some users may have the 'View Own Boards' permission but not the 'Manage Boards' permission. In this case, they can view boards that have cards assigned to them, but won't see the Add Board button or access any of the board's settings as shown below. The rest of their permissions in the board will be determined by the board's permissions.
View Files
This permission controls whether the user is able to access the Documents > Files page. Users with this permission will be able to see and access the company's file directory in this page, users without this permission will not be able to see or access this page at all.
Manage Files
This permission controls whether the user is allowed to manage the company's file directory. In order to activate this permission, the user must first have the 'View Files' permission enabled.
Users who have this permission will have full access to the Documents > Files page. They will also be able to view, upload, edit, and archive any files or folders freely. Note that they will still not be able to access or view any folders or files that have not been shared with them.
Some users may have the 'View Files' permission but not the 'Manage Files' permission. In this case, they will still be able to view and access all shared folders/files in the Documents > Files page, but they will not be able to see the Add Folder, Add Files, or Permissions functions.
View Forms
This permission controls whether the user is able to access the Documents > Forms page. Users with this permission will be able to see and access the company's forms list and templates in this page, users without this permission will not be able to see or access this page at all.
This permission is also required for any users who are expected to complete or approve/reject any forms in Ontraccr, in order to give them permission to access, approve/reject, and complete forms.
View Log in Forms
This permission controls whether the user is able to access the Form Log within the Documents > Forms > Log page. Users with this permission will be able to see and access the company's active or completed forms in this page, users without this permission will not be able to see or access this page at all.
Manage Forms
This permission controls whether the user is allowed to manage form templates and workflows. In order to activate this permission, the user must first have the 'View Forms' permission enabled.
Users who have this permission will have full access to add, edit, or archive any form templates in the Documents > Forms > Templates page.
Some users may have the 'View Forms' permission but not the 'Manage Files' permission. In this case, they will still be able to view the form templates and workflows in the Documents > Forms > Templates page, but they will not be able to see the Add, Edit, or Archive functions.
View Material Cost Code Progress
This permission controls whether the user is allowed to view any of the progress or actual cost fields of cost codes within the Progress tab of project profiles. Users with this permission will be able to see cost code progress data in the Progress page (as long as they also have the 'View Progress' permission), users without this permission will not be able to see or access this cost code progress data at all.
Edit Material Cost Code Progress
This permission controls whether the user is allowed to update any of the progress or actual cost fields of cost codes within the Progress tab of project profiles. In order to activate this permission, the user must first have the 'View Material Cost Code Progress' permission enabled.
View Schedule of Values
This permission controls whether the user is able to view the Contract tab within project profiles. Users with this permission will be able to see and access this page, users without this permission will not be able to see or access this page at all.
Edit Schedule of Values
This permission controls whether the user is allowed to update any of the line items within the Contract tab of project profiles. In order to activate this permission, the user must first have the 'View Schedule of Values' permission enabled.
Some users may have the 'View Schedule of Values' permission but not the 'Edit Schedule of Values' permission. In this case, they will still be able to access the Contract tab, but will not be able to see the master controls at the top or edit any of the line items within the tab.
View Project Gantt Schedule
This permission controls whether the user is able to view the Gantt tab within project profiles. Users with this permission will be able to see and access this page, users without this permission will not be able to see or access this page at all.
Edit Project Gantt Schedule
This permission controls whether the user is allowed to update any of the schedule's line items within the Gantt tab of project profiles. In order to activate this permission, the user must first have the 'View Project Gantt Schedule' permission enabled.
Some users may have the 'View Project Gantt Schedule' permission but not the 'Edit Project Gantt Schedule' permission. In this case, they will still be able to access the Gantt tab, but will not be able to add or edit any of the line items within the tab.
View Progress
This permission controls whether the user is able to view and access the detailed updates of the Progress tab within project profiles. Users with this permission will be able to see and access the project's progress updates in this tab, users without this permission will not be able to see or access this page at all.
Edit Progress
This permission controls whether the user is allowed to add any updates within the Progress tab of project profiles, including updating cost code and activity progress or uploading invoices. In order to activate this permission, the user must first have the 'View Progress' permission enabled.
Some users may have the 'View Progress' permission but not the 'Edit Progress' permission. In this case, they will still be able to access the Progress tab, but will not be able to see/edit any of the progress or actual cost updates or upload invoices within the tab.
View Users
This multi-role permission controls whether the user is allowed to view user profiles. User profiles are an essential part of the workflows in Ontraccr and they may contain a lot of sensitive information.
Users who have this permission will have full access to the Staff > Manage Users page, but they will only be able to view profiles for any of the roles they have permission to view.
Some users may have the 'View Users' permission for specific roles but not the 'Manage Users' permission for the same roles. In this case, they will still be able to view the profiles for the role(s), but they will not be able to see the Edit or Delete buttons.
Manage Users
This multi-role permission controls whether the user is allowed to manage user profiles.
Users who have this permission will have full access to the Staff > Manage Users page, but they will only be able to add, edit, and archive profiles for any of the roles they have permission to manage. For example, in the screenshot below, the user has permission to manage Worker and Inspector user profiles, but not Manager user profiles, which is why they don't see the Edit/Archive buttons for the Manager profiles.
Users without this permission will not be able to access the Users page at all but they will still be able to access and select users across many other parts of Ontraccr, including during time tracking or form completion. This permission primarily controls the user's ability to create or edit any of the user profile details, it will not completely hide the user list from the user altogether.
Edit Invoices
This permission controls whether the user is allowed to manage the company's payable invoices. In order to activate this permission, the user must first have the 'View Invoices' permission enabled.
Users who have this permission will have full access to the Payables > Invoices page. They will also be able to view, upload, update, edit, and archive any payable invoices freely.
Some users may have the 'View Invoices' permission but not the 'Edit Invoices' permission. In this case, they will still be able to view and access all payable invoices in the invoice log in the Payables > Invoices page, but they will not be able to see the 'Upload Invoice' button at the top of the page or the 'Edit' button when viewing the payable invoice.
View Invoices
This permission controls whether the user is able to access the Payables > Invoices page. Users with this permission will be able to view the company's invoice log in this page, users without this permission will not be able to see or access this page at all.
Edit Purchase Orders
This permission controls whether the user is allowed to manage the company's purchase order. In order to activate this permission, the user must first have the 'View Purchase Orders' permission enabled.
Users who have this permission will have full access to the Payables > Purchase Order page. They will also be able to view, upload, update, edit, and archive any purchase orders freely.
Some users may have the 'View Purchase Order' permission but not the 'Edit Purchase Orders' permission. In this case, they will still be able to view and access all purchase orders in the purchase order log in the Payables > Purchase Order page, but they will not be able to see the 'Add PO' button at the top of the page.
View Purchase Orders
This permission controls whether the user is able to access the Payables > Purchase Order page. Users with this permission will be able to view the company's purchase order log in this page, users without this permission will not be able to see or access this page at all.
View & Send Messages in Custom Channels
This permission controls whether the user can access any custom channels created in the company's Live Feed found in the Dashboard page. Users with this permission will be able to view all channels in the the company's Live Feed, whereas users without this permission will only be able to access the Global and Project channels.
Manage Custom Channels
This permission controls whether the user has the ability to create or edit any custom channels in the company's Live Feed found in the Dashboard page. In order to activate this permission, the user must first have the 'View & Send Messages in Custom Channels' permission enabled.
Users who have this permission can add or edit any of the company's custom channels. Some users may have the 'View & Send Messages in Custom Channels' permission but not the 'Manage Custom Channels' permission. In this case, they will still be able to view and access all custom channels in the Live Feed, but they will not be able to see the Add, Edit, or Delete buttons in the channel menu.
Delete Posts
This permission controls whether the user has the ability to delete messages in the company's Live Feed. Users with this permission will be able to see the 'More' icon next to any posted messages where they can access the 'Delete' button.
Manage Profile Names
This permission controls whether the user is allowed to access and manage the Settings > Customizations > Profile Names sub-page. The Profile Names settings page is where the company's profile naming convention can be set across various part of Ontraccr.
Restrict Project Selection
This permission controls which projects users can select when tracking their time. With this permission enabled, the user will only be able to select from the projects they are directly assigned to (within their user profile) instead of all projects in the account.
Manage User Wage
This multi-role permission controls whether the user is allowed to view and manage a user's wage within the user profile. Users who have this permission will be able to view, add, and edit the wages for any of the roles they have permission to manage.
Working Hours
This permissions allows your team to set a schedule of 'working hours' when tracking time in Ontraccr. This will restrict/flag users from clocking in prior to their scheduled start time and will flag the time card if the user clocks out after their scheduled end time.
You can enable this per role by adding a start and end time to the role in the 'Working Hours' permission. If you want to restrict users from being able to clock in prior to their scheduled start time, simply uncheck/disable the 'Allowing clocking outside of working hours' checkbox for the permission (if enabled, it will still let them clock in prior to start time but will just flag the time card for admins to review).
Time cards which logged hours outside of working hours will display a badge in the top right corner as shown below.
Time Tracking
This multi-role permission controls whether the user can track time (in real-time) on behalf of other user roles.
Users who have this permission will only be able to clock in/out, switch tasks, and take/end breaks for any of the roles they have permission to track time for. For example, in the demo below, the user has permission to track time for Worker and Inspector user profiles, but not for Manager user profiles, which is why they can't open the clock shortcut for the Manager profiles.
Manual Entry
This multi-role permission controls whether the user can track time (via manual entry) on behalf of other user roles.
Users who have this permission will only be able to add manual entries for any of the roles they have permission to track time for. For example, in the demo below, the user has permission to add manual entries for Worker and Inspector user profiles, but not for Manager user profiles, which is why they can't see the 'Manual Entry' button for the Manager profiles.
View Time Cards
This multi-role permission can view the time cards of any other user roles.
Users who have this permission will have access to the Time Cards > Team Cards page, but they will only be able to view time cards for any of the roles they have permission to see under the 'All' list of users.
Edit Time Cards
This multi-role permission can edit the time cards (that are either completed or submitted) of any other user roles. In order to activate this permission for any specific role(s), the user must first have the 'View Time Cards' permission enabled for the same specific role(s).
Users who have this permission will have access to the Time Cards > Team Cards page, but they will only be able to edit time cards for any of the roles they have permission to edit.
Some users may have the 'View Time Cards' permission for specific roles but not the 'Edit Time Cards' permission for the same roles. In this case, they will still be able to view the time cards for the role, but they will not be able to see the Edit or Delete buttons.
Edit Approved Cards
This multi-role permission can edit the fully approved time cards of any other user roles.
Users who have this permission will have access to the Time Cards > Team Cards page, but they will only be able to edit fully approved time cards for any of the roles they have permission to edit.
Some users may have the 'Edit Time Cards' permission for specific roles but not the 'Edit Approved Cards' permission for the same roles. In this case, they will still be able to edit the completed/submitted time cards for the role, but they will not be able to see the Edit or Delete buttons on any of the user's fully approved time entries as shown below.
Enable Time Card Approve-All Button
This permission controls whether the user role is able to use the 'Approve All' button when approving time cards in the web or mobile app. Users with this permission will be able to see and use the 'Approve All' button when approving time cards in the Team Cards pages, users without this permission will not be able to see or access this button at all.
Reports
This permission controls which reports the user can access in the Reports > Reports page. Users will only be able to access the reports which are selected in this permission's list.
View Active Users Map
This permission controls whether the user is able to access the Staff > User Map page. Users with this permission will be able to view user locations in this page, users without this permission will not be able to see or access this page at all.
