# Role Permissions

Source: https://docs.astalty.com.au/guide/settings/role-permissions

> Control which permissions each role has across your whole organisation.

Astalty Premium - This feature is part of the Astalty Premium plan. See What Premium includes.

## Overview

The **Role Permissions** page (**Settings > Permissions**) lets you control which permissions each role, such as **Manager** or **Team Member**, has across your whole organisation. Turning a permission on or off here applies to **every user with that role**, so you can tailor what a role can do without editing each user one by one.

For the full default permissions matrix across all roles, including permissions that are not toggled on this page, see [Roles & Permissions](https://docs.astalty.com.au/guide/users/roles-permissions).

Every permission on this page also shows as read-only on each user's own Permissions tab in a role settings box. See [Role Settings Shown on This Tab](https://docs.astalty.com.au/guide/roles-and-permissions#role-settings-shown-on-this-tab).

> **Role-Level vs Per-User Permissions**
>
> The overrides on this page apply to **all** users of a role. If you instead want to change permissions for a single person, see [Updating Roles and Permissions](https://docs.astalty.com.au/guide/roles-and-permissions).

> **Looking for the full permissions breakdown?**
>
> This page only covers the permissions you can change for a whole role under **Settings > Permissions**. To confirm what each role can do by default (Admin, Manager, Team Member, and Support Worker), see the [Roles & Permissions](https://docs.astalty.com.au/guide/users/roles-permissions) reference.

> **Module Access Isn't Configured Here**
>
> Access to the **Scheduling**, **Finance**, **eSignatures**, **Direct Charges** and **SMS** modules is granted **per user** on each user's Permissions tab (**Users > \[user] > Permissions**). See [Updating Roles and Permissions](https://docs.astalty.com.au/guide/roles-and-permissions). There is no whole-role toggle for these modules. For example, to give every Manager scheduling access, enable **Can access Scheduling** on each Manager individually. The tables below are the complete set of role-wide toggles.

## Who Can Manage Role Permissions

Opening **Settings > Permissions** requires **Can view Settings**. Editing the overrides also requires **Can update Settings**. These permissions are enabled for Admins by default, including the Account Owner, and can differ if an individual Admin's permissions have been changed.

## Editing Role Permissions

1. Go to **Settings > Permissions**.
2. On the **Role Permissions** card, click **Edit**.
3. Tick or untick the permissions you want to enable or disable for each role.
4. Save your changes. The new permissions apply to all users with that role straight away.

![The Permissions settings page, with an arrow pointing to Permissions in the settings menu and the Role Permissions card highlighted, listing tickable permissions for the Manager, Support Worker and Team Member roles below an Edit button.](https://docs.astalty.com.au/assets/settings-role-permissions-overview-guide.png)

## Available Role Permissions

The permissions you can configure depend on the role. The tables below show each configurable permission and whether it is enabled by default. The two form submission permissions appear only when Forms is enabled for your account.

### Manager

| **Permission**                                               | **Default** |
| ------------------------------------------------------------ | ----------- |
| Can create document categories                               | On          |
| Can update document categories                               | Off         |
| Can create Participant tags                                  | On          |
| Can update Participant tags                                  | On          |
| Can view Participant invoices without finance module access  | Off         |
| Can view all notes and tasks                                 | On          |
| Can only view notes and tasks for users in their user groups | On          |
| Can approve leave and unavailability for all staff           | On          |
| Can edit form submissions they can view                      | Off         |
| Can send form submission requests                            | Off         |
| Can edit Participant plans                                   | On          |
| Can edit Participant plan services                           | On          |

### Team Member

| **Permission**                                               | **Default** |
| ------------------------------------------------------------ | ----------- |
| Can view all contacts                                        | On          |
| Can view all organisations                                   | On          |
| Can create Participant plan services                         | On          |
| Can delete Participant plan services                         | On          |
| Can create document categories                               | On          |
| Can update document categories                               | Off         |
| Can create Participant tags                                  | On          |
| Can update Participant tags                                  | On          |
| Can view Participant invoices                                | Off         |
| Can view other team members' calendars                       | Off         |
| Can view all notes and tasks                                 | On          |
| Can only view notes and tasks for users in their user groups | On          |
| Can edit form submissions they can view                      | Off         |
| Can send form submission requests                            | Off         |

### Support Worker

| **Permission**                                                 | **Default** |
| -------------------------------------------------------------- | ----------- |
| Can view all case notes                                        | On          |
| Can only view case notes written by users in their user groups | On          |

## Notes & Tasks Visibility

Two permissions work together to control which **Participant notes and tasks** a user can see. They exist for **Manager**, **Team Member** and **Support Worker**. The Support Worker versions are labelled *case notes*, but they gate exactly the same records as the other roles' *notes and tasks* controls.

> **Notes written on a shift behave differently**
>
> These two controls govern Participant notes and tasks, and they also affect which support and Group Support notes appear in a Participant's note history on the web and in the Support Worker app.
>
> When **Can view all notes and tasks** is off, a support or Group Support note is visible when its author passes the rules below, or when the viewer worked a shift on that support or Group Support. Internal event notes in the Participant history remain visible. For a Team Member, the separate **Hide support notes on Participant pages** scheduling setting can hide support and Group Support notes altogether.

Because the limited option is based on shared [User Groups](https://docs.astalty.com.au/guide/settings/users-settings/user-groups), it helps to know which groups count.

Admins always see every note and task; the pair isn't configurable for them.

### Which User Groups Count

Astalty has four kinds of User Groups (see the [User Groups guide](https://docs.astalty.com.au/guide/settings/users-settings/user-groups) for how to create and manage them):

- **All Users**: everyone in your organisation, kept up to date automatically. **This is ignored for notes and task visibility.** Being in All Users with someone does not let you see their notes, otherwise everyone would see everything.
- **Role-based groups**: **Admin**, **Manager**, **Team Member** and **Support Worker**. Every user is automatically added to the group matching their role, and it updates whenever their role changes. **These are ignored for notes and task visibility.** Sharing the Team Member group with someone does not let you see their notes.
- **Team groups**: if you use [Teams](https://docs.astalty.com.au/guide/settings/users-settings/teams), Astalty creates a reserved group for each team and adds members automatically. A user can belong to only one team. **These count.**
- **Custom groups**: groups you create yourself, for example, "Support Coordinators" or "Finance". **These count.**

So for visibility, what matters is whether two people share at least one **Team** or **Custom** User Group. All Users and role-based groups are excluded.

### How the Two Settings Work Together

**"Can view all notes and tasks" always takes precedence** over the more limited user-group option:

- **Can view all notes and tasks - On (default):** the user sees every note and task across the organisation. The user-group permission is ignored while this is on.
- **Can view all notes and tasks - Off, user-group option - On:** the user sees notes and tasks they created, plus those created by anyone who shares a Team or Custom User Group with them.
- **Both Off:** the user sees only the notes and tasks they created themselves.

On an **individual** user's Permissions tab this precedence is enforced in the form itself: while **Can view all notes and tasks** is ticked, the user-group option below it greys out and can't be changed. Untick the first option to make the second selectable. The role-wide screen on this page doesn't grey the options out, but the precedence still applies.

> **A single user can be overridden**
>
> These are role-wide settings, but either one can also be set for an **individual** user on their Permissions tab. The per-user setting wins over the role-wide one. When it does, that user's Permissions tab marks the row **Overridden for this user**. Unlike this page, the per-user setting is available on every plan. See [Updating Roles and Permissions](https://docs.astalty.com.au/guide/roles-and-permissions).

### A Quick Example

Alice is in the **Support Coordination** custom group. Bob is in **Support Coordination** and **Finance**. Charlie is only in **Finance**.

With "Can view all notes and tasks" off and the user-group setting on, Alice sees her own notes and tasks plus Bob's because they share **Support Coordination**. She cannot see Charlie's because they have no Team or Custom User Group in common.

> **A Couple of Things Worth Knowing**
>
> Visibility is based on **who created** the note or task, not the Participant it relates to.

## Related Role-Wide Settings

Chat messaging between roles, meaning which roles a Manager, Team Member or Support Worker can start conversations with, is also configured role-wide. These controls are under **Settings > Chat** rather than on this page.

## Related Guides

- [Roles & Permissions](https://docs.astalty.com.au/guide/users/roles-permissions): default permissions matrix for every role
- [Updating Roles and Permissions](https://docs.astalty.com.au/guide/roles-and-permissions): change permissions for one user
- [User Groups](https://docs.astalty.com.au/guide/settings/users-settings/user-groups): groups used by notes and tasks visibility