Astalty has four user roles: Administrator, Manager, Team Member, and Support Worker. Each role has a default set of permissions, and two markers show where a default can be changed:
⚙ Per-user - toggled for an individual user on their profile's Permissions tab (Users > [user] > Permissions). See Updating Roles and Permissions.
👥 Whole role - toggled for every user with that role at once under Settings > Permissions on the Premium plan. See Role Permissions.
There is also an Auditor role - a strictly read-only role based on Team Member. Auditors gain visibility of user records, user documents and HR details for compliance review, plus, where the provider is subscribed to Premium, read-only access to every Form and the document and note templates under Settings. They still lose the Calendar, Tasks and Directory modules, and can never create, update or delete anything. Auditors also do not see the on-call phone number or the mobile number of the worker on call. See Inviting NDIA Auditors to your Account for the full detail.
† Admins and Managers see Participant invoices when they have Finance module access (⚙). The 👥 role toggle grants invoices to Managers or Team Members without Finance access.
† Included with the Astalty Premium plan - there's nothing to switch on. See Participant Retention Report.
‡ Team Members see all Participants unless View all Participants (⚙) is turned off for them. They then see only their own Participants.
§ Requires the Scheduling add-on. Managers need Access Scheduling Module turned on, which is off by default.
† Requires the Scheduling add-on. Managers need Access Scheduling Module turned on, which is off by default.
‡ Requires Scheduling and the per-user Manage HR Details permission (off by default). The Account Owner always has it. The same permission lets you edit employment details from the report.
§ Unlocked by the per-user User Records - Manage for Others permission (off by default). The Account Owner always has it.
‖ Currently in beta and enabled per account - contact Astalty Support to switch it on. See Staff Retention Report.
Except on Pay Groups, an Admin or Manager ⚙ here is the per-user Access Finance Module permission, which is on by default. Team Members get My Billable Charges through the per-user My Billable Charges permission, which is off by default.
† The Account Owner always has it. Other Admins need the per-user Manage HR Details permission, which is off by default. On the Reports page it sits under the Finance heading, which is hidden from Admins without Access Finance Module.
† Managers only when Access Scheduling Module is enabled for them - a per-user toggle that is off by default. Scheduling access unlocks these permissions as a group; they can't be toggled individually, and there is no whole-role scheduling toggle.
† Managers only when Access Scheduling Module is enabled for them (per-user toggle, off by default) - unlocked together with the Scheduling permissions above.
† Controlled by a single account-level security setting that only the Account Owner can change; it is unavailable while 2FA is enforced for the account. Account Owners can always disable their own 2FA.
‡ Off by default and, unlike the other ⚙ toggles here, only the Account Owner can grant or revoke it for an Admin - holding Manage Permissions for Admin Users doesn't unlock it. The Account Owner always has it. See Granting API Key and Webhook Access.
† Requires the Scheduling feature.
‡ Regions is included with the Astalty Premium plan. Assigning Regions to a staff member is Admin only; assigning them to Participants and sites uses the Participant and site update permissions.
§ Every admin can manage Participant record types - there is no toggle for it. User record types are different: admins can always view them, but creating, updating and deleting them is unlocked by the per-user User Records - Manage for Others permission, which is off by default.
The following section explains what each configurable permission does when enabled, including what additional features it unlocks. There are two types:
Per-user permissions (⚙) - toggled individually for a specific user on their profile's Permissions tab (see Updating Roles and Permissions)
Whole-role permissions (👥) - toggled for all users of a given role under Settings > Permissions on the Premium plan (see Role Permissions). A user's own Permissions tab also shows their role's 👥 settings, read-only - see Role Settings Shown on This Tab.
These permissions can be toggled on or off for individual Admin users.
Permission
Default
What It Does
Create Users
ON
Allows creating and inviting new users to the account. Also allows reactivating deactivated users. When disabled, the admin cannot add new team members. ↑ Matrix
User Records - Manage for Others
OFF
Allows viewing and managing user records across all users, not just their own. Also unlocks: the User Records and Qualifications Compliance reports, and the ability to create, update, and delete User Record Types in Settings. ↑ Matrix
Access eSignatures Module
ON
Grants access to the eSignatures module. Also unlocks: creating, updating, and deleting signature requests; managing owned signatures; creating signatures for team members; and deleting signed requests. ↑ Matrix
Manage Signature Requests for Others
OFF
Allows viewing and managing signature requests created by other users. Requires: eSignatures access must also be enabled. ↑ Matrix
Access Finance Module
ON
Grants access to the Finance module. Also unlocks: Finance Dashboard, Staff Payments module, View Participant Invoices, Update Bank Details, the Billable Charges, My Billable Charges, Aged Receivables, NDIA Errors and Voided Charges reports, Staff Payment Batches and Settings, and Timesheet Batches. ↑ Matrix
Direct Charges
OFF
Allows creating and managing direct charges and recurring direct charges. Requires: Access Finance Module must also be enabled. ↑ Matrix
Manage HR Details
OFF
Allows viewing and managing HR details for users. Also unlocks: User Documents & Generated Docs, User Notes, the Pay Groups report, and the Employment Details report (when that feature is enabled). ↑ Matrix
Manage Calendar Events for Other Users
OFF
Allows creating and managing calendar events on behalf of other users. ↑ Matrix
Manage Scheduling Costs
OFF
Allows managing scheduling cost items and site cost items. ↑ Matrix
Manage Permissions for Admin Users
OFF
Allows editing the roles and permissions of other Admin users. The Account Owner's permissions can never be edited. ↑ Matrix
SMS Inbox Access
ON
Grants access to the two-way SMS inbox, including any photos or files received on inbound messages - general document permissions don't reach these. Requires: the SMS feature, which is included with the Premium plan. ↑ Matrix
Manage API Keys & Webhooks
OFF
Allows the user to open the API Dashboard and create, view, update and delete this account's API keys and webhooks. Bypasses every other permission on the account: a Full Access key reads and changes Participant, worker and finance data regardless of what else is ticked for that user. Only the Account Owner can grant or revoke it, and granting it needs a double confirmation. Requires: the API or Webhooks feature. See Granting API Key and Webhook Access. ↑ Matrix
These permissions can be toggled on or off for individual Manager users.
Permission
Default
What It Does
Access Finance Module
ON
Grants access to the Finance module. Also unlocks: Finance Dashboard, the Billable Charges, Aged Receivables, NDIA Errors and Voided Charges reports, and viewing Participant invoices. ↑ Matrix
Access eSignatures Module
OFF
Grants access to the eSignatures module and the ability to create and manage their own signature requests. ↑ Matrix
Access Scheduling Module
OFF
Grants access to the Scheduling module. Also unlocks (as a group): View All Shifts, Create/Update/Delete Shifts, Manage Shift Status, Shift Approvals, Shift Board, Supports and Group Supports (full CRUD), Support Notes - All, Support Charges, Cancellation Reasons (view), Public Holidays (view), Activities, Participant Preferences (full), View All Availability, Manage Others' Availability, and the Scheduling, Support History, Record Acknowledgements and User Unavailability reports. These can't be toggled individually, and there is no whole-role scheduling toggle. Requires the Scheduling feature to be enabled for your account. ↑ Matrix
Direct Charges
OFF
Allows creating and managing direct charges and recurring direct charges. Requires: Access Finance Module must also be enabled. ↑ Matrix
Manage Calendar Events for Other Users
OFF
Allows creating and managing calendar events on behalf of other users. ↑ Matrix
SMS Inbox Access
OFF
Grants access to the two-way SMS inbox, including any photos or files received on inbound messages - general document permissions don't reach these. Requires: the SMS feature, which is included with the Premium plan. ↑ Matrix
View All Notes and Tasks
ON
Lets the user see every Participant note and task across the organisation. Set for the whole role under Settings > Permissions, and overridable for an individual user here - the per-user setting wins. Does not affect support or group support notes. ↑ Matrix
View Notes and Tasks for Their User Group
ON
When "View all notes and tasks" is off, also lets the user see notes and tasks owned by others in their user group. ↑ Matrix
These permissions apply to all Manager users and can be toggled under Settings > Permissions. This is the complete list for Managers on that page - the only other role-wide toggles are the chat messaging permissions under Settings > Chat.
Permission
Default
What It Does
Document Categories - Create
ON
Allows all Managers to create new document categories. ↑ Matrix
Document Categories - Update
OFF
Allows all Managers to update existing document categories. ↑ Matrix
Participant Tags - Create
ON
Allows all Managers to create new Participant tags. ↑ Matrix
Participant Tags - Update
ON
Allows all Managers to update existing Participant tags. ↑ Matrix
View Participant Invoices
OFF
Allows all Managers to view invoices on Participant profiles even without Finance module access. Managers with Finance access already see them. ↑ Matrix
View All Notes and Tasks
ON
Allows all Managers to see every Participant note and task across the organisation. When off, visibility falls back to the user-group option below. Does not affect support or group support notes. ↑ Matrix
View Notes and Tasks for Their User Group
ON
When "View all notes and tasks" is off, also lets Managers see notes and tasks owned by others in their user group. ↑ Matrix
These permissions can be toggled on or off for individual Team Member users.
Permission
Default
What It Does
View all Participants
ON
When enabled, the user can see all Participants. When disabled, they can only see Participants assigned to them. Also affects: the Utilisation, Participant Alerts, Participant Goals, Participants Without Goals, Participant Risks, Participants Without Risks and Participants by Diagnosis reports for all Participants; Plan Manager Participant visibility; organisation Participant visibility; and contact Participant visibility. ↑ Matrix
Delegate Tasks
OFF
Allows the user to delegate tasks to other users. ↑ Matrix
Access eSignatures Module
OFF
Grants access to the eSignatures module and the ability to create and manage their own signature requests. ↑ Matrix
Update Plans
ON
Allows the user to update Participant NDIS plans. ↑ Matrix
Update Services
ON
Allows the user to update Participant plan services. Note: creating and deleting services can also be restricted at the role level for all Team Members. ↑ Matrix
My Billable Charges
OFF
Allows the user to view the My Billable Charges report under Reports. ↑ Matrix
SMS Inbox Access
OFF
Grants access to the two-way SMS inbox, including any photos or files received on inbound messages - general document permissions don't reach these. Requires: the SMS feature, which is included with the Premium plan. ↑ Matrix
View All Notes and Tasks
ON
Lets the user see every Participant note and task across the organisation. Set for the whole role under Settings > Permissions, and overridable for an individual user here - the per-user setting wins. Does not affect support or group support notes. ↑ Matrix
View Notes and Tasks for Their User Group
ON
When "View all notes and tasks" is off, also lets the user see notes and tasks owned by others in their user group. ↑ Matrix
These permissions apply to all Team Member users and can be toggled under Settings > Permissions. This is the complete list for Team Members on that page - the only other role-wide toggles are the chat messaging permissions under Settings > Chat.
Permission
Default
What It Does
View All Contacts
ON
Allows all Team Members to view all contacts in the directory. When disabled, they cannot browse the contacts list. ↑ Matrix
View All Organisations
ON
Allows all Team Members to view all organisations in the directory. When disabled, they cannot browse the organisations list. ↑ Matrix
Create Services
ON
Allows all Team Members to create new services under Participant NDIS plans. ↑ Matrix
Delete Services
ON
Allows all Team Members to delete services from Participant NDIS plans. ↑ Matrix
Document Categories - Create
ON
Allows all Team Members to create new document categories. ↑ Matrix
Document Categories - Update
OFF
Allows all Team Members to update existing document categories. ↑ Matrix
Participant Tags - Create
ON
Allows all Team Members to create new Participant tags. ↑ Matrix
Participant Tags - Update
ON
Allows all Team Members to update existing Participant tags. ↑ Matrix
View Participant Invoices
OFF
Allows all Team Members to view invoices on Participant profiles. ↑ Matrix
View Other Team Members' Calendars
OFF
Allows all Team Members to view other team members' calendars. ↑ Matrix
View All Notes and Tasks
ON
Allows all Team Members to see every Participant note and task across the organisation. When off, visibility falls back to the user-group option below. Does not affect support or group support notes. ↑ Matrix
View Notes and Tasks for Their User Group
ON
When "View all notes and tasks" is off, also lets Team Members see notes and tasks owned by others in their user group. ↑ Matrix
Support Workers have two permissions that can be toggled for an individual user.
Permission
Default
What It Does
View All Case Notes
ON
Lets the Support Worker see every Participant note across the organisation. Set for the whole role under Settings > Permissions, and overridable for an individual user here - the per-user setting wins. Doesn't affect support or group support notes on the web platform; in the app those are filtered too. ↑ Matrix
View Case Notes for Their User Group
ON
When "View all case notes" is off, also lets the Support Worker see case notes written by others in their user group. ↑ Matrix
These apply to all Support Workers and are toggled under Settings > Permissions. This is the complete list for Support Workers on that page.
Permission
Default
What It Does
View All Case Notes
ON
Allows all Support Workers to see every Participant note across the organisation. When off, visibility falls back to the user-group option below. Doesn't affect support or group support notes on the web platform; in the app those are filtered too. ↑ Matrix
View Case Notes for Their User Group
ON
When "View all case notes" is off, also lets Support Workers see case notes written by others in their user group. ↑ Matrix
Controlled by a single account-level security setting, not per-user or per-role. Only the Account Owner can change it, and it is unavailable while 2FA is enforced for the account. Account Owners can always disable their own 2FA. ↑ Matrix
Message Admins / Managers / Team Members / Support Workers
ON
Whole-role settings controlling which roles each of Manager, Team Member, and Support Worker can start conversations with (Admins, Managers, Team Members, and/or Support Workers). All default to ON. Configured under Settings > Chat, not the Role Permissions page. ↑ Matrix