# Updating Roles and Permissions

Source: https://docs.astalty.com.au/guide/roles-and-permissions

> How Admins and Account Owners change another user's role and fine-tune their individual permissions.

## Overview

A user's **role** sets the baseline of what they can see and do in Astalty, and you can fine-tune individual permissions on top of that role. Both are managed from a user's **Permissions** tab.

Not everyone can update other users. Who can do what depends on your own role:

- **Account Owner** - can update Admins, Managers, and Team Members, and can transfer account ownership. The Account Owner's own permissions can't be edited by anyone - they always have every Admin permission.
- **Admin** - can update Managers and Team Members by default. Updating another Admin requires the **Can manage permissions for admin users** permission (off by default).
- **Manager** - cannot change other users' roles or permissions.
- **Support Workers** - two permissions can be edited on their Permissions tab: **Can view all case notes** and **Can only view case notes written by users in their user groups**. Those are the only permissions available for the role - to give a Support Worker access beyond that, convert them to a Standard User (see [Converting User Types](https://docs.astalty.com.au/guide/users/converting-user-types)).
- **Auditors** - their permissions can't be edited; the role is fixed read-only.

> **Which Role Has Which Permissions?**
>
> For a full breakdown of what each role can and can't do by default, see the [Roles & Permissions](https://docs.astalty.com.au/guide/users/roles-permissions) reference.

> **Changing a Permission for a Whole Role**
>
> The toggles on this page apply to one user at a time. A small set of permissions can instead be switched for every user of a role at once under **Settings > Permissions** (Premium plan) - see [Role Permissions](https://docs.astalty.com.au/guide/settings/role-permissions). Module access (Scheduling, Finance, eSignatures, Direct Charges, SMS) is only ever per-user.
>
> Only that role-wide screen is Premium. The per-user toggles described on this page - including the two Support Worker case note permissions - work on **any plan**, so a Professional or Lite account can still restrict an individual user; it just can't make the change role-wide.
>
> Those role-wide settings also show, read-only, on this page - see [Role Settings Shown on This Tab](#role-settings-shown-on-this-tab) below.

> **Looking to Convert a User Instead?**
>
> Roles control what a user can do within their user type. If you need to switch a user between a **Standard User** and a **Support Worker**, see [Converting User Types](https://docs.astalty.com.au/guide/users/converting-user-types).

> **Setting a Role for a Brand New User**
>
> You don't need to invite someone first and change their role afterwards. The invite form lets you choose the role - and add user groups - as you invite them. See [Inviting Users](https://docs.astalty.com.au/guide/users/inviting-users#role).

## Open a User's Permissions

1. Go to the [**Users**](https://app.astalty.com.au/users) section (under **Manage** when your menu is grouped into sections) and select the user you want to update.
2. Open their **Permissions** tab. This is where you manage their role, status, and individual permissions.

![Sierra R.'s Permissions tab with Permissions highlighted in the user menu, the Actions and Edit Role buttons highlighted on the Details card, and the Actions and Edit buttons highlighted on the Permissions card.](https://docs.astalty.com.au/assets/pem.png)

## Change a User's Role

To move a user between roles - for example, promoting a Team Member to Manager, or stepping an Admin down to limit their access - click **Edit Role**, choose the new role, and save.

Astalty will not move an Admin who owns public API keys to Manager or Team Member. The Account Owner or an Admin with **Can manage API keys and webhooks** must delete those keys from the [API Dashboard](https://docs.astalty.com.au/developers/api) first, then change the role. Deleting a key stops any integration using it.

![A user's Permissions tab with the Role set to Admin and an arrow pointing to the Edit Role button on the Details card.](https://docs.astalty.com.au/assets/edit-rolw.png)

## Change a User's Status

From the **Actions** menu you can restrict, deactivate, or reactivate an account, for example when someone leaves your organisation. For the full process and what each status means, see [Deactivating and Reactivating Users](https://docs.astalty.com.au/guide/deactivating-and-reactivating-users).

![A user's Permissions tab with an arrow pointing to the Actions button on the Details card, next to Edit Role.](https://docs.astalty.com.au/assets/change-status.png)

## Fine-Tune Individual Permissions

To adjust what a user can do without changing their role, click **Edit** on the **Permissions** card and toggle the options on or off. The available toggles depend on the user's role and on which features your account has enabled.

> **Some Toggles Are Feature-Specific**
>
> Permissions tied to optional features - such as eSignatures, Scheduling, SMS, Direct Charges, User Records, Forms, and the Finance module - only appear when that feature is enabled for your account. If you don't see a toggle listed below, the related feature likely isn't switched on.

![A user's Permissions tab with an arrow pointing to the Edit button on the Permissions card, which lists what the user can and can not do.](https://docs.astalty.com.au/assets/edit-user-permsiions.png)

### Admin Permission Toggles

For Admin users you can toggle:

- Can access pages relating to Finance
- Can access Direct Charges
- Can invite users into Astalty
- Can manage User Records for all Users
- Can create and edit their own eSignature requests
- Can create and edit all eSignature requests
- Can manage HR details for users
- Can manage calendar events on behalf of other users
- Can manage Scheduling Costs
- Can manage permissions for admin users
- Can access the SMS inbox
- Can manage API keys and webhooks

![The Update User Permissions drawer with the Available Permission Changes list highlighted: access to Finance pages, Direct Charges and Scheduling Costs, inviting users, managing User Records for all Users, their own or all eSignature requests, HR details, calendar events for other users, permissions for admin users and the SMS inbox.](https://docs.astalty.com.au/assets/admin-user-permissions.png)

#### Giving an Admin Access Without Finance

To remove an Admin's access to the Finance module and the reports and actions that depend on it, open their **Permissions** tab, click **Edit**, and untick **Can access pages relating to Finance**, then update. This does not hide every money-related value elsewhere in Astalty, such as values on tasks or supports they can still access. Review their other permissions against the work they need to do.

![The Update User Permissions drawer with the Can access pages relating to Finance checkbox highlighted and ticked, above the other permission toggles and the Update User button.](https://docs.astalty.com.au/assets/adminfin.png)

#### Granting API Key and Webhook Access

**Can manage API keys and webhooks** opens the API Dashboard to that Admin and lets them create, view, update and delete this account's API keys and webhooks. It only appears when the API or Webhooks feature is enabled for your account, and only the **Account Owner** can grant or revoke it - the toggle is disabled for every other user, even an Admin holding **Manage Permissions for Admin Users**.

Turning it on reveals a warning about the broad access API keys can provide. A Full Access key can read and change supported account data without most of the key owner's other role restrictions. Finance endpoints still require the key owner to have Finance access. See [API Authentication and Permissions](https://docs.astalty.com.au/developers/api/authentication#access-levels-and-permissions) before granting access.

To confirm, tick both acknowledgement checkboxes and type the user's full name exactly as shown. **Update User** stays disabled until all three are satisfied. Revoking the permission needs no confirmation, but it only removes the Admin's access to manage keys and webhooks. Keys they already created keep working until someone with API Dashboard access deletes them.

![The Can manage API keys and webhooks checkbox ticked, revealing a broad-access warning, two acknowledgement checkboxes, and a Confirmation field for typing the user's full name, where pasting is disabled.](https://docs.astalty.com.au/assets/admin-api-access-warning-guide.png)

See [API Keys](https://docs.astalty.com.au/developers/api) and [Webhooks](https://docs.astalty.com.au/developers/webhooks) for what the permission unlocks, and [Restricting, Deactivating and Reactivating Users](https://docs.astalty.com.au/guide/deactivating-and-reactivating-users) for what happens to a user's API keys when their access is removed.

### Manager Permission Toggles

For Manager users you can toggle:

- Can access pages relating to Finance
- Can access Direct Charges
- Can create and manage eSignatures
- Can access Scheduling
- Can approve leave and unavailability for all staff
- Can edit Participant plans
- Can edit Participant plan services
- Can manage calendar events on behalf of other users
- Can access the SMS inbox
- Can edit form submissions they can view
- Can send form submission requests
- Can view all notes and tasks
- Can only view notes and tasks for users in their user groups

Enabling **Can access Scheduling** unlocks the full set of Manager scheduling permissions - shifts, supports, approvals, the shift board, and availability - as a group. They can't be enabled individually, and there is no whole-role scheduling toggle (see the [Scheduling matrix](https://docs.astalty.com.au/guide/users/roles-permissions#scheduling)).

**Can approve leave and unavailability for all staff** appears only when Scheduling is enabled for your account, and can be ticked only once **Can access Scheduling** is on. When it is off, the Manager can only see and review requests from members of the team they lead.

For note and task visibility, **Can view all notes and tasks** takes precedence. Untick it before using the user-group-only option.

![The Update User Permissions drawer with the Available Permission Changes list highlighted: Can access pages relating to Finance, Can edit Participant plans, Can edit Participant plan services and Can view all notes and tasks ticked, Can approve leave and unavailability for all staff greyed out while Can access Scheduling is unticked, and the other toggles unticked.](https://docs.astalty.com.au/assets/manager-permissions.png)

### Team Member Permission Toggles

For Team Member users you can toggle:

- Can delegate Tasks
- Can access all Participants
- Can edit Participant plans
- Can edit Participant plan services
- Can create and manage eSignatures
- Can access the My Billable Charges Report
- Can access the SMS inbox
- Can edit form submissions they can view
- Can send form submission requests
- Can view all notes and tasks
- Can only view notes and tasks for users in their user groups

![The Update User Permissions drawer with the Available Permission Changes list highlighted: Can access all Participants, Can edit Participant plans, Can edit Participant plan services and Can view all notes and tasks ticked, the user-group-only option greyed out, and Can delegate Tasks, eSignatures, the My Billable Charges Report, the SMS inbox and the two form submission permissions unticked.](https://docs.astalty.com.au/assets/team-member-user-permissions-guide.png)

For note and task visibility, **Can view all notes and tasks** takes precedence. Untick it before using the user-group-only option.

### Support Worker Permission Toggles

Support Workers have exactly two toggles, both covering case note visibility:

- Can view all case notes
- Can only view case notes written by users in their user groups

![The Update User Permissions drawer with Can view all case notes ticked, and Can only view case notes written by users in their user groups greyed out below it.](https://docs.astalty.com.au/assets/support-worker-case-note-permissions-guide.png)

**Can view all case notes** takes precedence. While it is ticked, the second option is ignored and greys out - untick the first to make the user-group option selectable.

For what each option covers, which User Groups count, and worked examples, see [Role Permissions](https://docs.astalty.com.au/guide/settings/role-permissions#notes--tasks-visibility).

> **Available on Every Plan**
>
> These two toggles aren't restricted to Premium. Setting them for an individual Support Worker works on any plan - it's only the role-wide version under **Settings > Permissions** that needs Premium.

## Role Settings Shown on This Tab

Below the per-user toggles, the **Permissions** card also shows a read-only role settings box named for the user's role - for example, **Team Member role settings** - listing every role-wide permission set for that role under [Role Permissions](https://docs.astalty.com.au/guide/settings/role-permissions). Each row shows **Yes** or **No**, matching what's switched on or off under **Settings > Permissions**; hover a row for a tooltip on where it's controlled.

A row where this user's own permission replaces the role setting carries an **Overridden for this user** chip. The **Yes** or **No** on that row is still the role setting. If you can view and update settings, the box's explanatory text links straight to **Settings > Permissions**; otherwise it's plain text.

![A Team Member's Permissions tab with the Team Member role settings box listing each role-wide permission with Yes or No, a Settings > Permissions link, and an Overridden for this user chip on Can view all notes and tasks.](https://docs.astalty.com.au/assets/user-permissions-role-wide-settings-guide.png)

**Admin** and **Auditor** have no role-wide settings, so the box doesn't appear on their Permissions tab. Nothing can be changed from this box - change a setting for the whole role under [Role Permissions](https://docs.astalty.com.au/guide/settings/role-permissions), or override it for just this user above.

## Transfer Account Ownership

The Account Owner can hand ownership to another **Admin** user. From that Admin's **Permissions** tab, click **Actions** on the **Permissions** card, choose **Transfer Account Ownership** and confirm.

![A user's Permissions tab with the Actions menu on the Permissions card open and an arrow pointing to Transfer Account Ownership.](https://docs.astalty.com.au/assets/account-ownership.png)

## Video Walkthrough

Video walkthrough: updating roles and permissions walkthrough.