Roles and permissions

An account has members, and each member holds a role.

The roles

• Owner — full access, including account configuration: custom fields, service catalogue, port access, session security, members and billing.
• Member — can read and change operational records: calls, plans, moves, checks, services, resources, incidents.
• Viewer — can read everything their membership allows, and change nothing.

Read-only means read-only

A viewer's restriction is enforced by the database, not by hiding buttons. Somebody with a read-only role cannot record a change by any route: not through the interface, not by calling the API directly, not from a device syncing work recorded offline.

That distinction is worth stating plainly because the weaker version is common. Hiding a control stops an honest mistake; it does not stop anything else.

Port access

Within an account, a member can be restricted to particular ports. Where no restriction is recorded, a member reaches every port in the account — the restriction is something you add, not something you have to remember to remove.

Configuration is separate from operations

Changing what a port asks for — its checks, its requirements, its custom fields, its session timeout — is an owner's decision rather than an operator's, because it changes what every future visit will be asked. Operators record what happened; owners decide what gets recorded.