# Roles & Permissions

Source: https://docs.astalty.com.au/guide/users/roles-permissions

> The four Astalty user roles and the default permissions for each.

Astalty has four user roles: **Administrator**, **Manager**, **Team Member**, and **Support Worker**. Each role has a default set of permissions, and two markers show where a default can be changed:

- **⚙ Per-user** - toggled for an individual user on their profile's **Permissions** tab (**Users > \[user] > Permissions**). See [Updating Roles and Permissions](https://docs.astalty.com.au/guide/roles-and-permissions).
- **👥 Whole role** - toggled for every user with that role at once under **Settings > Permissions** on the **Premium** plan. See [Role Permissions](https://docs.astalty.com.au/guide/settings/role-permissions).

There is also an **Auditor** role - a strictly read-only role based on Team Member. Auditors gain visibility of user records, user documents and HR details for compliance review, plus, where the provider is subscribed to Premium, read-only access to every Form and the document and note templates under Settings. They still lose the Calendar, Tasks and Directory modules, and can never create, update or delete anything. Auditors also do not see the on-call phone number or the mobile number of the worker on call. See [Inviting NDIA Auditors to your Account](https://docs.astalty.com.au/guide/users/inviting-ndia-auditors-to-your-account) for the full detail.

> **Looking to Convert a User Instead?**
>
> Roles set what a user can do within their user type. If you need to switch a user between a **Standard User** and a **Support Worker**, see [Converting User Types](https://docs.astalty.com.au/guide/users/converting-user-types).

> **Module Access Is Set Per User, Not Per Role**
>
> Access to the **Scheduling**, **Finance**, **eSignatures**, **Direct Charges** and **SMS** modules is granted per-user (⚙) on each user's Permissions tab. There is no whole-role toggle for these - the **Settings > Permissions** page only covers the permissions marked 👥 below. For example, to give all Managers scheduling access you must enable **Can access Scheduling** on each Manager individually.

## Dashboard & Home

| **Permission**    | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ----------------- | --------- | ----------- | --------------- | ------------------ |
| Team Dashboard    | ✅         | ✅           | ✕               | ✕                  |
| Finance Dashboard | ✅ ⚙       | ✅ ⚙         | ✕               | ✕                  |
| Home Page         | ✅         | ✅           | ✅               | ✕                  |

## Tasks

| **Permission**                            | **Admin** | **Manager** | **Team Member**     | **Support Worker** |
| ----------------------------------------- | --------- | ----------- | ------------------- | ------------------ |
| Task Board                                | ✅         | ✅           | ✅                   | ✕                  |
| View, Create, Update & Delete Tasks       | ✅         | ✅           | ✅                   | ✕                  |
| Delegate Tasks                            | ✅         | ✅           | ✕ ⚙                 | ✕                  |
| Update Tasks Owned by Others              | ✅         | ✅           | ✕                   | ✕                  |
| Reassign Tasks                            | ✅         | ✅           | ✕                   | ✕                  |
| View Task Invoices                        | ✅         | ✅           | ✕                   | ✕                  |
| Override Charge Price                     | ✅         | ✅           | ✅ (non-contractors) | ✕                  |
| View All Notes and Tasks                  | ✅         | ✅ ⚙ 👥      | ✅ ⚙ 👥              | ✅ ⚙ 👥             |
| View Notes and Tasks for Their User Group | ✅         | ✅ ⚙ 👥      | ✅ ⚙ 👥              | ✅ ⚙ 👥             |

## Calendar

| **Permission**                         | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| -------------------------------------- | --------- | ----------- | --------------- | ------------------ |
| View & Manage Events                   | ✅         | ✅           | ✅               | ✕                  |
| Manage Calendar Events for Other Users | ✕ ⚙       | ✕ ⚙         | ✕               | ✕                  |
| View Other Team Members' Calendars     | ✅         | ✅           | ✕ 👥            | ✕                  |
| External Calendar Integration          | ✅         | ✅           | ✅               | ✕                  |

## Participants

| **Permission**                               | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| -------------------------------------------- | --------- | ----------- | --------------- | ------------------ |
| View All Participants                        | ✅         | ✅           | ✅ ⚙             | ✕                  |
| View Assigned Participants (My Participants) | ✅         | ✅           | ✅               | ✕                  |
| View Limited Participant Detail              | ✅         | ✅           | ✅               | ✅                  |
| Create Participants                          | ✅         | ✅           | ✅               | ✕                  |
| Create Participants for Other Users          | ✅         | ✅           | ✕               | ✕                  |
| Update Participants                          | ✅         | ✅           | ✅               | ✕                  |
| Delete Participants                          | ✅         | ✅           | ✅               | ✕                  |
| Archive Participants                         | ✅         | ✕           | ✕               | ✕                  |
| Update Coordinator                           | ✅         | ✅           | ✅               | ✕                  |
| Update Information Items                     | ✅         | ✅           | ✅               | ✕                  |
| View Participant Invoices †                  | ✅ ⚙       | ✅ ⚙ 👥      | ✕ 👥            | ✕                  |

† Admins and Managers see Participant invoices when they have **Finance module** access (⚙). The 👥 role toggle grants invoices to Managers or Team Members **without** Finance access.

## NDIS Plans & Services

| **Permission**                | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ----------------------------- | --------- | ----------- | --------------- | ------------------ |
| View Plans & Services         | ✅         | ✅           | ✅               | ✕                  |
| Create Plans                  | ✅         | ✅           | ✅               | ✕                  |
| Update Plans                  | ✅         | ✅           | ✅ ⚙             | ✕                  |
| Delete Plans                  | ✅         | ✅           | ✅               | ✕                  |
| Create Services               | ✅         | ✅           | ✅ 👥            | ✕                  |
| Update Services               | ✅         | ✅           | ✅ ⚙             | ✕                  |
| Delete Services               | ✅         | ✅           | ✅ 👥            | ✕                  |
| Implementations (full access) | ✅         | ✅           | ✅               | ✕                  |
| Budgets (full access)         | ✅         | ✅           | ✅               | ✕                  |

## Participant - Goals, Alerts, Risks & Records

| **Permission**             | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| -------------------------- | --------- | ----------- | --------------- | ------------------ |
| Goals (full access)        | ✅         | ✅           | ✅               | ✕                  |
| Alerts (full access)       | ✅         | ✅           | ✅               | View only          |
| Risks (full access)        | ✅         | ✅           | ✅               | ✕                  |
| Records (full access)      | ✅         | ✅           | ✅               | ✕                  |
| Documents (full access)    | ✅         | ✅           | ✅               | ✕                  |
| Participant Tags - Create  | ✅         | ✅ 👥        | ✅ 👥            | ✕                  |
| Participant Tags - Update  | ✅         | ✅ 👥        | ✅ 👥            | ✕                  |
| Tags - Delete              | ✅         | ✅           | ✕               | ✕                  |
| Preferences †              | ✅         | View only   | View only       | View only          |
| Compatibility              | ✅         | ✅           | ✅               | ✕                  |
| Generate Templates         | ✅         | ✅           | ✅               | ✕                  |
| Sensitive Invoice Settings | ✅         | ✅           | ✕               | ✕                  |

† Managers get full Preferences access together with **Access Scheduling Module** (see [Scheduling](#scheduling)).

## eSignatures

| **Permission**                       | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ------------------------------------ | --------- | ----------- | --------------- | ------------------ |
| Access eSignatures Module            | ✅ ⚙       | ✕ ⚙         | ✕ ⚙             | ✕                  |
| Create Signature Requests            | ✅ †       | ✅ †         | ✅ †             | ✕                  |
| Create for Team Members              | ✅ †       | ✕           | ✕               | ✕                  |
| Manage Signature Requests for Others | ✕ ⚙       | ✕           | ✕               | ✕                  |
| Delete Signed Requests               | ✅ †       | ✕           | ✕               | ✕                  |

† Comes with **Access eSignatures Module** for that user - not a separate toggle.

## Incidents

| **Permission**                         | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| -------------------------------------- | --------- | ----------- | --------------- | ------------------ |
| View All Participant Incidents         | ✅         | ✅           | ✕               | ✕                  |
| View Scoped Participant Incidents      | ✅         | ✅           | ✅               | ✕                  |
| Create Participant Incidents           | ✅         | ✅           | ✅               | ✕                  |
| Update & Archive Participant Incidents | ✅         | ✅           | ✕               | ✕                  |
| View Staff Incidents                   | ✅         | ✕           | ✕               | ✕                  |
| Create Staff Incidents                 | ✅         | ✅           | ✅               | ✕                  |
| Update & Archive Staff Incidents       | ✅         | ✕           | ✕               | ✕                  |
| Manage Incident Categories             | ✅         | View only   | View only       | View only          |

## Referrals

| **Permission**           | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ------------------------ | --------- | ----------- | --------------- | ------------------ |
| View All Referrals       | ✅         | ✅           | ✕               | ✕                  |
| View Assigned Referrals  | ✅         | ✅           | ✅               | ✕                  |
| Create, Update & Archive | ✅         | ✅           | ✕               | ✕                  |

## Feedback

| **Permission**           | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ------------------------ | --------- | ----------- | --------------- | ------------------ |
| View All Feedback        | ✅         | ✅           | ✕               | ✕                  |
| View Assigned Feedback   | ✅         | ✅           | ✅               | ✕                  |
| Create, Update & Archive | ✅         | ✅           | ✕               | ✕                  |
| Permanently Delete       | ✅         | ✕           | ✕               | ✕                  |

## Reports - Participants

| **Permission**                    | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| --------------------------------- | --------- | ----------- | --------------- | ------------------ |
| Utilisation                       | ✅         | ✅           | ✅ ‡             | ✕                  |
| Plans                             | ✅         | ✅           | My only         | ✕                  |
| Participant Birthdays             | ✅         | ✅           | My only         | ✕                  |
| Participants Without Plan Manager | ✅         | ✅           | My only         | ✕                  |
| Participants With Plan Manager    | ✅         | ✅           | My only         | ✕                  |
| Participant Alerts                | ✅         | ✅           | ✅ ‡             | ✕                  |
| Participant Goals                 | ✅         | ✅           | ✅ ‡             | ✕                  |
| Participants Without Goals        | ✅         | ✅           | ✅ ‡             | ✕                  |
| Participant Records               | ✅         | ✅           | My only         | ✕                  |
| Participant Risks                 | ✅         | ✅           | ✅ ‡             | ✕                  |
| Participants Without Risks        | ✅         | ✅           | ✅ ‡             | ✕                  |
| Participants by Diagnosis         | ✅         | ✅           | ✅ ‡             | ✕                  |
| Participant Documents             | ✅         | ✕           | ✕               | ✕                  |
| Support History §                 | ✅         | ✕ ⚙         | ✕               | ✕                  |
| Participant Retention †           | ✅         | ✅           | ✕               | ✕                  |
| Participant Reminder Status       | ✅         | ✕           | ✕               | ✕                  |
| Participant Incompatibilities     | ✅         | ✅           | ✕               | ✕                  |
| Address Map                       | ✅         | ✕           | ✕               | ✕                  |

† Included with the [Astalty Premium](https://docs.astalty.com.au/guide/getting-started/astalty-premium) plan - there's nothing to switch on. See [Participant Retention Report](https://docs.astalty.com.au/guide/reports/participant-retention-report).
‡ Team Members see all Participants unless **View all Participants** (⚙) is turned off for them. They then see only their own Participants.
§ Requires the Scheduling add-on. Managers need **Access Scheduling Module** turned on, which is off by default.

## Reports - Team

| **Permission**              | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| --------------------------- | --------- | ----------- | --------------- | ------------------ |
| My Billable Hours           | ✅         | ✅           | ✅               | ✕                  |
| My Billables                | ✅         | ✅           | ✅               | ✕                  |
| Team Billable Hours         | ✅         | ✅           | ✕               | ✕                  |
| Team Billables              | ✅         | ✅           | ✕               | ✕                  |
| User Records §              | ✕ ⚙       | ✕           | ✕               | ✕                  |
| Qualifications Compliance § | ✕ ⚙       | ✕           | ✕               | ✕                  |
| Worker Skills               | ✅         | ✕           | ✕               | ✕                  |
| Years of Experience         | ✅         | ✕           | ✕               | ✕                  |
| Capacity Report             | ✅         | ✕           | ✕               | ✕                  |
| My Capacity                 | ✅         | ✅           | ✅               | ✕                  |
| Staff Birthdays             | ✅         | ✕           | ✕               | ✕                  |
| User Unavailability †       | ✅         | ✕ ⚙         | ✕               | ✕                  |
| Employment Details ‡        | ✕ ⚙       | ✕           | ✕               | ✕                  |
| Staff Retention ‖           | ✅         | ✅           | ✕               | ✕                  |
| Address Map                 | ✅         | ✕           | ✕               | ✕                  |

† Requires the Scheduling add-on. Managers need **Access Scheduling Module** turned on, which is off by default.
‡ Requires Scheduling and the per-user **Manage HR Details** permission (off by default). The Account Owner always has it. The same permission lets you edit employment details from the report.
§ Unlocked by the per-user **User Records - Manage for Others** permission (off by default). The Account Owner always has it.
‖ Currently in beta and enabled per account - contact Astalty Support to switch it on. See [Staff Retention Report](https://docs.astalty.com.au/guide/reports/staff-retention-report).

## Reports - Finance

| **Permission**          | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ----------------------- | --------- | ----------- | --------------- | ------------------ |
| Billable Charges Report | ✅ ⚙       | ✅ ⚙         | ✕               | ✕                  |
| My Billable Charges     | ✅ ⚙       | ✕           | ✕ ⚙             | ✕                  |
| Aged Receivables        | ✅ ⚙       | ✅ ⚙         | ✕               | ✕                  |
| NDIA Errors             | ✅ ⚙       | ✅ ⚙         | ✕               | ✕                  |
| Voided Charges          | ✅ ⚙       | ✅ ⚙         | ✕               | ✕                  |
| Staff Payments Report   | ✅ ⚙       | ✕           | ✕               | ✕                  |
| Pay Groups Report †     | ✕ ⚙       | ✕           | ✕               | ✕                  |

Except on Pay Groups, an Admin or Manager ⚙ here is the per-user **Access Finance Module** permission, which is on by default. Team Members get My Billable Charges through the per-user **My Billable Charges** permission, which is off by default.

† The Account Owner always has it. Other Admins need the per-user **Manage HR Details** permission, which is off by default. On the Reports page it sits under the **Finance** heading, which is hidden from Admins without **Access Finance Module**.

## Reports - Tasks

| **Permission**      | **Admin** | **Manager**   | **Team Member** | **Support Worker** |
| ------------------- | --------- | ------------- | --------------- | ------------------ |
| All Tasks Report    | ✅         | ✅             | ✕               | ✕                  |
| My Tasks Report     | ✅         | ✅             | ✅               | ✕                  |
| Tasks without Notes | ✅         | ✅             | My only         | ✕                  |
| Flagged Notes †     | ✅         | Assigned only | ✕               | ✕                  |

† Included with the [Astalty Premium](https://docs.astalty.com.au/guide/getting-started/astalty-premium) plan. Admins see all flagged notes; Managers see those assigned to them.

## Reports - Sites

| **Permission**           | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ------------------------ | --------- | ----------- | --------------- | ------------------ |
| All Sites Records Report | ✅         | ✕           | ✕               | ✕                  |
| My Sites Records Report  | ✅         | ✅           | ✕               | ✕                  |

## Reports - Referrals

| **Permission**        | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| --------------------- | --------- | ----------- | --------------- | ------------------ |
| Referral Conversion † | ✅         | ✕           | ✕               | ✕                  |

† Included with the [Astalty Premium](https://docs.astalty.com.au/guide/getting-started/astalty-premium) plan, and also needs Referrals. See [Referral Conversion Report](https://docs.astalty.com.au/guide/reports/referral-conversion-report).

## Directory

| **Permission**                      | **Admin** | **Manager** | **Team Member**      | **Support Worker** |
| ----------------------------------- | --------- | ----------- | -------------------- | ------------------ |
| View, Create & Update Plan Managers | ✅         | ✅           | ✅                    | ✕                  |
| Archive Plan Managers               | ✅         | ✕           | ✕                    | ✕                  |
| Bulk Reassign Plan Managers         | ✅         | ✕           | ✕                    | ✕                  |
| Plan Manager Tags                   | ✅         | ✅           | View only            | ✕                  |
| View, Create & Update Organisations | ✅         | ✅           | ✅                    | ✕                  |
| View All Organisations              | ✅         | ✅           | ✅ 👥                 | ✕                  |
| Organisation Tags                   | ✅         | ✅           | Create & Update only | ✕                  |
| View All Contacts                   | ✅         | ✅           | ✅ 👥                 | ✕                  |
| Create, Update & Delete Contacts    | ✅         | ✅           | ✅                    | ✕                  |

## Resources

| **Permission**            | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ------------------------- | --------- | ----------- | --------------- | ------------------ |
| View All Resources        | ✅         | ✅           | ✅               | ✅                  |
| Create & Update Resources | ✅         | ✕           | ✕               | ✕                  |
| Resource Tags             | ✅         | ✅           | View only       | View only          |

> **Support Workers and Resources**
>
> Support Workers can view Resources in the [Astalty mobile app](https://docs.astalty.com.au/guide/resources/resources-overview#resources-in-the-app). They only see resources marked **Visible to Support Workers**.

## Finance

| **Permission**           | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ------------------------ | --------- | ----------- | --------------- | ------------------ |
| Access Finance Module    | ✅ ⚙       | ✅ ⚙         | ✕               | ✕                  |
| Direct Charges           | ✕ ⚙       | ✕ ⚙         | ✕               | ✕                  |
| Recurring Direct Charges | ✕ ⚙       | ✕ ⚙         | ✕               | ✕                  |
| Staff Payment Batches    | ✅ ⚙       | ✕           | ✕               | ✕                  |
| Staff Payment Settings   | ✅ ⚙       | ✕           | ✕               | ✕                  |
| Cost Codes               | ✅         | ✕           | ✕               | ✕                  |
| Timesheet Batches        | ✅ ⚙       | ✕           | ✕               | ✕                  |

## Scheduling

| **Permission**                                                                                   | **Admin** | **Manager**              | **Team Member**  | **Support Worker** |
| ------------------------------------------------------------------------------------------------ | --------- | ------------------------ | ---------------- | ------------------ |
| Access Scheduling Module                                                                         | ✅         | ✕ ⚙                      | ✕                | ✕                  |
| View All Shifts                                                                                  | ✅         | ✅ †                      | ✕                | ✕                  |
| View Own Shifts                                                                                  | ✅         | ✅                        | ✅                | ✅                  |
| Clock In/Out (if rosterable)                                                                     | ✅         | ✅                        | ✅                | ✅                  |
| Report Unscheduled Travel                                                                        | ✅         | ✅                        | ✅                | ✅                  |
| Create, Update & Delete Shifts                                                                   | ✅         | ✅ †                      | ✕                | ✕                  |
| Manage Shift Status                                                                              | ✅         | ✅ †                      | ✕                | ✕                  |
| Shift Approvals                                                                                  | ✅         | ✅ †                      | ✕                | ✕                  |
| Shift Board                                                                                      | ✅         | ✅ †                      | ✕                | ✕                  |
| Supports (full access)                                                                           | ✅         | ✅ †                      | ✕                | ✕                  |
| Group Supports                                                                                   | ✅         | ✅ †                      | ✕                | ✕                  |
| Support Notes - Own                                                                              | ✅         | ✅                        | ✅                | ✅                  |
| Support Notes - All                                                                              | ✅         | ✅ †                      | ✕                | ✕                  |
| Support Charges                                                                                  | ✅         | ✅ †                      | ✕                | ✕                  |
| Scheduling Costs                                                                                 | ✕ ⚙       | ✕                        | ✕                | ✕                  |
| Cancellation Reasons                                                                             | ✅         | View only †              | ✕                | ✕                  |
| Charge Item Sets                                                                                 | ✅         | View only                | ✕                | ✕                  |
| Public Holidays                                                                                  | ✅         | View only †              | ✕                | ✕                  |
| Activities                                                                                       | ✅         | ✅ †                      | ✕                | ✕                  |
| Pay Groups                                                                                       | ✅         | ✕                        | ✕                | ✕                  |
| [Custom Allowances](https://docs.astalty.com.au/guide/scheduling/setup/custom-allowances) (beta) | ✅         | View and add to shifts † | ✕                | ✕                  |
| [On-Call Roster](https://docs.astalty.com.au/guide/scheduling/on-call-roster) (beta)             | ✅         | ✅ †                      | Own on-call only | Own on-call only   |

† Managers only when **Access Scheduling Module** is enabled for them - a per-user toggle that is **off by default**. Scheduling access unlocks these permissions as a group; they can't be toggled individually, and there is no whole-role scheduling toggle.

## Availability

| **Permission**              | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| --------------------------- | --------- | ----------- | --------------- | ------------------ |
| View All Availability       | ✅         | ✅ †         | ✕               | ✕                  |
| Manage Others' Availability | ✅         | ✅ †         | ✕               | ✕                  |
| View Own Availability       | ✅         | ✅           | ✅               | ✅                  |
| Create Own Availability     | ✅         | ✅           | ✅               | ✅                  |

† Managers only when **Access Scheduling Module** is enabled for them (per-user toggle, off by default) - unlocked together with the [Scheduling](#scheduling) permissions above.

## Forms

| **Permission**           | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ------------------------ | --------- | ----------- | --------------- | ------------------ |
| Manage Forms             | ✅         | ✕           | ✕               | ✕                  |
| Form Submissions         | ✅         | ✕           | ✕               | ✕                  |
| Form Submission Requests | ✅         | ✕           | ✕               | ✕                  |

## Notes

| **Permission**                            | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ----------------------------------------- | --------- | ----------- | --------------- | ------------------ |
| View Note Revisions                       | ✅         | ✅           | ✕               | ✕                  |
| Edit Notes Created by Others              | ✅         | ✕           | ✕               | ✕                  |
| View All Notes and Tasks                  | ✅         | ✅ ⚙ 👥      | ✅ ⚙ 👥          | ✅ ⚙ 👥             |
| View Notes and Tasks for Their User Group | ✅         | ✅ ⚙ 👥      | ✅ ⚙ 👥          | ✅ ⚙ 👥             |

## Documents & Templates

| **Permission**                        | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ------------------------------------- | --------- | ----------- | --------------- | ------------------ |
| Document Categories - Create          | ✅         | ✅ 👥        | ✅ 👥            | ✕                  |
| Document Categories - Update          | ✅         | ✕ 👥        | ✕ 👥            | ✕                  |
| Document Categories - Archive/Restore | ✅         | ✕           | ✕               | ✕                  |
| Provider Document Templates           | ✅         | ✕           | ✕               | ✕                  |
| Note Templates                        | ✅         | View only   | View only       | ✕                  |

## Notifications (Create & Manage)

| **Permission**            | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ------------------------- | --------- | ----------- | --------------- | ------------------ |
| All Notification Types    | ✅         | ✕           | ✕               | ✕                  |
| User Record Notifications | ✅         | ✕           | ✕               | ✕                  |

## Exports

| **Permission**        | **Admin**      | **Manager** | **Team Member** | **Support Worker** |
| --------------------- | -------------- | ----------- | --------------- | ------------------ |
| Access Exports Module | ✅              | ✕           | ✕               | ✕                  |
| Login History Export  | **Owner only** | ✕           | ✕               | ✕                  |

## Chat

| **Permission**             | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| -------------------------- | --------- | ----------- | --------------- | ------------------ |
| Create & Manage Channels   | ✅         | ✕           | ✕               | ✕                  |
| View Any Conversation      | ✅         | ✕           | ✕               | ✕                  |
| Export Conversations       | ✅         | ✕           | ✕               | ✕                  |
| Send Messages              | ✅         | ✅           | ✅               | ✅                  |
| Edit & Delete Own Messages | ✅         | ✅           | ✅               | ✅                  |
| Delete Others' Messages    | ✅         | ✕           | ✕               | ✕                  |
| Message Admins             | ✅         | ✅ ‡         | ✅ ‡             | ✅ ‡                |
| Message Managers           | ✅         | ✅ ‡         | ✅ ‡             | ✅ ‡                |
| Message Team Members       | ✅         | ✅ ‡         | ✅ ‡             | ✅ ‡                |
| Message Support Workers    | ✅         | ✅ ‡         | ✅ ‡             | ✅ ‡                |

‡ Configurable role-wide via the who-can-message-who matrix under **Settings > Chat** - not on the Role Permissions page.

## SMS

| **Permission**   | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ---------------- | --------- | ----------- | --------------- | ------------------ |
| SMS Inbox Access | ✅ ⚙       | ✕ ⚙         | ✕ ⚙             | ✕                  |

## Sites

| **Permission**                    | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| --------------------------------- | --------- | ----------- | --------------- | ------------------ |
| View All Sites                    | ✅         | ✕           | ✕               | ✕                  |
| View Managed Sites                | ✅         | ✅           | ✕               | ✕                  |
| Create & Delete Sites             | ✅         | ✕           | ✕               | ✕                  |
| Update Sites                      | ✅         | ✅           | ✕               | ✕                  |
| Site Tags                         | ✅         | View only   | ✕               | ✕                  |
| Site Records                      | ✅         | ✅           | ✕               | ✕                  |
| Site Record Types & Notifications | ✅         | View only   | ✕               | ✕                  |
| Site Forms & Participants         | ✅         | ✅           | ✕               | ✕                  |

## Users & User Management

| **Permission**                     | **Admin** | **Manager**   | **Team Member** | **Support Worker** |
| ---------------------------------- | --------- | ------------- | --------------- | ------------------ |
| View All Users                     | ✅         | ✅             | ✕               | ✕                  |
| View Admin Detail                  | ✅         | ✕             | ✕               | ✕                  |
| View Manager Detail                | ✅         | ✕             | ✕               | ✕                  |
| View Team Member Detail            | ✅         | ✅             | ✕               | ✕                  |
| View Support Worker Detail         | ✅         | ✕             | ✕               | ✕                  |
| Create Users                       | ✅ ⚙       | ✕             | ✕               | ✕                  |
| Update Users                       | ✅         | ✕             | ✕               | ✕                  |
| Delete Users                       | ✅         | ✕             | ✕               | ✕                  |
| Restrict / Deactivate / Reactivate | ✅         | ✕             | ✕               | ✕                  |
| Reassign Participants              | ✅         | ✕             | ✕               | ✕                  |
| Update Roles & Permissions         | ✅         | ✕             | ✕               | ✕                  |
| Manage Permissions for Admin Users | ✕ ⚙       | ✕             | ✕               | ✕                  |
| Update User Groups                 | ✅         | ✕             | ✕               | ✕                  |
| Update Own Details on Web          | ✅         | ✅             | ✅               | ✕                  |
| Update Bank Details                | ✅ ⚙       | ✕             | ✕               | ✕                  |
| Update Financial Details           | ✅         | ✕             | ✕               | ✕                  |
| Manage HR Details                  | ✕ ⚙       | ✕             | ✕               | ✕                  |
| User Documents & Generated Docs    | ✕ ⚙       | ✕             | ✕               | ✕                  |
| User Notes                         | ✕ ⚙       | ✕             | ✕               | ✕                  |
| User Records - Own                 | ✅         | View & create | View & create   | View & create      |
| User Records - Manage for Others   | ✕ ⚙       | ✕             | ✕               | ✕                  |
| Manage API Keys & Webhooks ‡       | ✕ ⚙       | ✕             | ✕               | ✕                  |
| Auditor Assignment                 | ✅         | ✕             | ✕               | ✕                  |
| Disable Own 2FA †                  | †         | †             | †               | †                  |

† Controlled by a single account-level security setting that only the Account Owner can change; it is unavailable while 2FA is enforced for the account. Account Owners can always disable their own 2FA.
‡ Off by default and, unlike the other ⚙ toggles here, only the Account Owner can grant or revoke it for an Admin - holding **Manage Permissions for Admin Users** doesn't unlock it. The Account Owner always has it. See [Granting API Key and Webhook Access](https://docs.astalty.com.au/guide/roles-and-permissions#granting-api-key-and-webhook-access).

## Settings

| **Permission**                                                                                                        | **Admin**           | **Manager**              | **Team Member** | **Support Worker** |
| --------------------------------------------------------------------------------------------------------------------- | ------------------- | ------------------------ | --------------- | ------------------ |
| View & Update Settings                                                                                                | ✅                   | ✕                        | ✕               | ✕                  |
| Charge Items                                                                                                          | ✅                   | View only                | View list only  | ✕                  |
| Information Items                                                                                                     | ✅                   | View only                | View only       | ✕                  |
| User Groups                                                                                                           | ✅                   | View list only           | View list only  | ✕                  |
| Teams                                                                                                                 | ✅                   | View only, can be leader | ✕               | ✕                  |
| [Participant Record Types](https://docs.astalty.com.au/guide/settings/participants-settings/participant-record-types) | ✅                   | View only                | View only       | ✕                  |
| [User Record Types](https://docs.astalty.com.au/guide/settings/users-settings/user-records) §                         | View only, manage ⚙ | View only                | View only       | ✕                  |
| [Exit Reasons](https://docs.astalty.com.au/guide/settings/users-settings#exit-reasons)                                | ✅                   | View only                | View only       | ✕                  |
| Leave Types †                                                                                                         | ✅                   | View only                | View only       | ✕                  |
| [Regions](https://docs.astalty.com.au/guide/settings/regions) ‡                                                       | ✅                   | View only                | View only       | ✕                  |
| Imports                                                                                                               | ✅                   | ✕                        | ✕               | ✕                  |

† Requires the Scheduling feature.
‡ [Regions](https://docs.astalty.com.au/guide/settings/regions) is included with the [Astalty Premium](https://docs.astalty.com.au/guide/getting-started/astalty-premium) plan. Assigning Regions to a staff member is Admin only; assigning them to Participants and sites uses the Participant and site update permissions.
§ Every admin can manage **Participant** record types - there is no toggle for it. **User** record types are different: admins can always view them, but creating, updating and deleting them is unlocked by the per-user **User Records - Manage for Others** permission, which is **off by default**.

## Account Owner Only

| **Permission**             | **Admin**      | **Manager** | **Team Member** | **Support Worker** |
| -------------------------- | -------------- | ----------- | --------------- | ------------------ |
| Billing & Subscription     | **Owner only** | ✕           | ✕               | ✕                  |
| Self-Serviceable Features  | **Owner only** | ✕           | ✕               | ✕                  |
| Update Account Ownership   | **Owner only** | ✕           | ✕               | ✕                  |
| Manage 2FA for Other Users | **Owner only** | ✕           | ✕               | ✕                  |
| Bulk Delete Documents      | **Owner only** | ✕           | ✕               | ✕                  |
| Note Deletion Setting      | **Owner only** | ✕           | ✕               | ✕                  |

## Other

| **Permission**           | **Admin** | **Manager** | **Team Member** | **Support Worker** |
| ------------------------ | --------- | ----------- | --------------- | ------------------ |
| My Billable Hours Widget | ✅         | ✅           | ✅               | ✕                  |

## Legend

- **✅** = Access granted by default
- **✕** = No access by default
- **⚙** = Configurable per-user - toggled for an individual on their profile's Permissions tab (Users > \[user] > Permissions)
- **👥** = Configurable for the whole role - toggled under Settings > Permissions (Premium plan)
- **Owner only** = Restricted to the Account Owner

## Configurable Permissions Reference

The following section explains what each configurable permission does when enabled, including what additional features it unlocks. There are two types:

- **Per-user permissions (⚙)** - toggled individually for a specific user on their profile's Permissions tab (see [Updating Roles and Permissions](https://docs.astalty.com.au/guide/roles-and-permissions))
- **Whole-role permissions (👥)** - toggled for all users of a given role under Settings > Permissions on the Premium plan (see [Role Permissions](https://docs.astalty.com.au/guide/settings/role-permissions)). A user's own Permissions tab also shows their role's 👥 settings, read-only - see [Role Settings Shown on This Tab](https://docs.astalty.com.au/guide/roles-and-permissions#role-settings-shown-on-this-tab).

> **Shift notes are treated differently**
>
> The **View All Notes and Tasks** / **View All Case Notes** pair governs notes and tasks recorded against a **Participant**. Support notes, group support notes and internal event notes follow shift-based visibility instead - and that isn't the same on both platforms. On the **web platform** they're excluded from these permissions for every role, so a restricted user still sees all of them. In the **Support Worker app** they are filtered, down to the worker's own user groups plus the shifts they personally worked. See [Notes & Tasks Visibility](https://docs.astalty.com.au/guide/settings/role-permissions#notes--tasks-visibility).

### Administrator - Per-User Permissions

These permissions can be toggled on or off for individual Admin users.

| **Permission**                             | **Default** | **What It Does**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| ------------------------------------------ | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Create Users**                           | **ON**      | Allows creating and inviting new users to the account. Also allows reactivating deactivated users. When disabled, the admin cannot add new team members. [↑ Matrix](#users--user-management)                                                                                                                                                                                                                                                                                                                                                                                                                         |
| **User Records - Manage for Others**       | **OFF**     | Allows viewing and managing user records across all users, not just their own. **Also unlocks:** the User Records and Qualifications Compliance reports, and the ability to create, update, and delete User Record Types in Settings. [↑ Matrix](#users--user-management)                                                                                                                                                                                                                                                                                                                                            |
| **Access eSignatures Module**              | **ON**      | Grants access to the eSignatures module. **Also unlocks:** creating, updating, and deleting signature requests; managing owned signatures; creating signatures for team members; and deleting signed requests. [↑ Matrix](#esignatures)                                                                                                                                                                                                                                                                                                                                                                              |
| **Manage Signature Requests for Others**   | **OFF**     | Allows viewing and managing signature requests created by other users. **Requires:** eSignatures access must also be enabled. [↑ Matrix](#esignatures)                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| **Access Finance Module**                  | **ON**      | Grants access to the Finance module. **Also unlocks:** Finance Dashboard, Staff Payments module, View Participant Invoices, Update Bank Details, the Billable Charges, My Billable Charges, Aged Receivables, NDIA Errors and Voided Charges reports, Staff Payment Batches and Settings, and Timesheet Batches. [↑ Matrix](#finance)                                                                                                                                                                                                                                                                                |
| **Direct Charges**                         | **OFF**     | Allows creating and managing direct charges and recurring direct charges. **Requires:** Access Finance Module must also be enabled. [↑ Matrix](#finance)                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| **Manage HR Details**                      | **OFF**     | Allows viewing and managing HR details for users. **Also unlocks:** User Documents & Generated Docs, User Notes, the Pay Groups report, and the Employment Details report (when that feature is enabled). [↑ Matrix](#users--user-management)                                                                                                                                                                                                                                                                                                                                                                        |
| **Manage Calendar Events for Other Users** | **OFF**     | Allows creating and managing calendar events on behalf of other users. [↑ Matrix](#calendar)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| **Manage Scheduling Costs**                | **OFF**     | Allows managing scheduling cost items and site cost items. [↑ Matrix](#scheduling)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| **Manage Permissions for Admin Users**     | **OFF**     | Allows editing the roles and permissions of other Admin users. The Account Owner's permissions can never be edited. [↑ Matrix](#users--user-management)                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| **SMS Inbox Access**                       | **ON**      | Grants access to the two-way SMS inbox, including any photos or files received on inbound messages - general document permissions don't reach these. **Requires:** the SMS feature, which is included with the Premium plan. [↑ Matrix](#sms)                                                                                                                                                                                                                                                                                                                                                                        |
| **Manage API Keys & Webhooks**             | **OFF**     | Allows the user to open the API Dashboard and create, view, update and delete this account's API keys and webhooks. Bypasses every other permission on the account: a Full Access key reads and changes Participant, worker and finance data regardless of what else is ticked for that user. **Only the Account Owner can grant or revoke it**, and granting it needs a double confirmation. **Requires:** the API or Webhooks feature. See [Granting API Key and Webhook Access](https://docs.astalty.com.au/guide/roles-and-permissions#granting-api-key-and-webhook-access). [↑ Matrix](#users--user-management) |

### Manager - Per-User Permissions

These permissions can be toggled on or off for individual Manager users.

| **Permission**                                | **Default** | **What It Does**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| --------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Access Finance Module**                     | **ON**      | Grants access to the Finance module. **Also unlocks:** Finance Dashboard, the Billable Charges, Aged Receivables, NDIA Errors and Voided Charges reports, and viewing Participant invoices. [↑ Matrix](#finance)                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| **Access eSignatures Module**                 | **OFF**     | Grants access to the eSignatures module and the ability to create and manage their own signature requests. [↑ Matrix](#esignatures)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| **Access Scheduling Module**                  | **OFF**     | Grants access to the Scheduling module. **Also unlocks (as a group):** View All Shifts, Create/Update/Delete Shifts, Manage Shift Status, Shift Approvals, Shift Board, Supports and Group Supports (full CRUD), Support Notes - All, Support Charges, Cancellation Reasons (view), Public Holidays (view), Activities, Participant Preferences (full), View All Availability, Manage Others' Availability, and the Scheduling, Support History, Record Acknowledgements and User Unavailability reports. These can't be toggled individually, and there is no whole-role scheduling toggle. Requires the Scheduling feature to be enabled for your account. [↑ Matrix](#scheduling) |
| **Direct Charges**                            | **OFF**     | Allows creating and managing direct charges and recurring direct charges. **Requires:** Access Finance Module must also be enabled. [↑ Matrix](#finance)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| **Manage Calendar Events for Other Users**    | **OFF**     | Allows creating and managing calendar events on behalf of other users. [↑ Matrix](#calendar)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| **SMS Inbox Access**                          | **OFF**     | Grants access to the two-way SMS inbox, including any photos or files received on inbound messages - general document permissions don't reach these. **Requires:** the SMS feature, which is included with the Premium plan. [↑ Matrix](#sms)                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| **View All Notes and Tasks**                  | **ON**      | Lets the user see every **Participant** note and task across the organisation. Set for the whole role under Settings > Permissions, and overridable for an individual user here - the per-user setting wins. Does not affect support or group support notes. [↑ Matrix](#tasks)                                                                                                                                                                                                                                                                                                                                                                                                      |
| **View Notes and Tasks for Their User Group** | **ON**      | When "View all notes and tasks" is off, also lets the user see notes and tasks owned by others in their [user group](https://docs.astalty.com.au/guide/settings/users-settings/user-groups). [↑ Matrix](#tasks)                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |

### Manager - Whole-Role Permissions (👥)

These permissions apply to all Manager users and can be toggled under Settings > Permissions. This is the complete list for Managers on that page - the only other role-wide toggles are the chat messaging permissions under Settings > Chat.

| **Permission**                                | **Default** | **What It Does**                                                                                                                                                                                                           |
| --------------------------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Document Categories - Create**              | **ON**      | Allows all Managers to create new document categories. [↑ Matrix](#documents--templates)                                                                                                                                   |
| **Document Categories - Update**              | **OFF**     | Allows all Managers to update existing document categories. [↑ Matrix](#documents--templates)                                                                                                                              |
| **Participant Tags - Create**                 | **ON**      | Allows all Managers to create new Participant tags. [↑ Matrix](#participant---goals-alerts-risks--records)                                                                                                                 |
| **Participant Tags - Update**                 | **ON**      | Allows all Managers to update existing Participant tags. [↑ Matrix](#participant---goals-alerts-risks--records)                                                                                                            |
| **View Participant Invoices**                 | **OFF**     | Allows all Managers to view invoices on Participant profiles even without Finance module access. Managers with Finance access already see them. [↑ Matrix](#participants)                                                  |
| **View All Notes and Tasks**                  | **ON**      | Allows all Managers to see every **Participant** note and task across the organisation. When off, visibility falls back to the user-group option below. Does not affect support or group support notes. [↑ Matrix](#tasks) |
| **View Notes and Tasks for Their User Group** | **ON**      | When "View all notes and tasks" is off, also lets Managers see notes and tasks owned by others in their [user group](https://docs.astalty.com.au/guide/settings/users-settings/user-groups). [↑ Matrix](#tasks)            |

### Team Member - Per-User Permissions

These permissions can be toggled on or off for individual Team Member users.

| **Permission**                                | **Default** | **What It Does**                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| --------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **View all Participants**                     | **ON**      | When enabled, the user can see all Participants. When disabled, they can only see Participants assigned to them. **Also affects:** the Utilisation, Participant Alerts, Participant Goals, Participants Without Goals, Participant Risks, Participants Without Risks and Participants by Diagnosis reports for all Participants; Plan Manager Participant visibility; organisation Participant visibility; and contact Participant visibility. [↑ Matrix](#participants) |
| **Delegate Tasks**                            | **OFF**     | Allows the user to delegate tasks to other users. [↑ Matrix](#tasks)                                                                                                                                                                                                                                                                                                                                                                                                     |
| **Access eSignatures Module**                 | **OFF**     | Grants access to the eSignatures module and the ability to create and manage their own signature requests. [↑ Matrix](#esignatures)                                                                                                                                                                                                                                                                                                                                      |
| **Update Plans**                              | **ON**      | Allows the user to update Participant NDIS plans. [↑ Matrix](#ndis-plans--services)                                                                                                                                                                                                                                                                                                                                                                                      |
| **Update Services**                           | **ON**      | Allows the user to update Participant plan services. Note: creating and deleting services can also be restricted at the role level for all Team Members. [↑ Matrix](#ndis-plans--services)                                                                                                                                                                                                                                                                               |
| **My Billable Charges**                       | **OFF**     | Allows the user to view the My Billable Charges report under Reports. [↑ Matrix](#reports---finance)                                                                                                                                                                                                                                                                                                                                                                     |
| **SMS Inbox Access**                          | **OFF**     | Grants access to the two-way SMS inbox, including any photos or files received on inbound messages - general document permissions don't reach these. **Requires:** the SMS feature, which is included with the Premium plan. [↑ Matrix](#sms)                                                                                                                                                                                                                            |
| **View All Notes and Tasks**                  | **ON**      | Lets the user see every **Participant** note and task across the organisation. Set for the whole role under Settings > Permissions, and overridable for an individual user here - the per-user setting wins. Does not affect support or group support notes. [↑ Matrix](#tasks)                                                                                                                                                                                          |
| **View Notes and Tasks for Their User Group** | **ON**      | When "View all notes and tasks" is off, also lets the user see notes and tasks owned by others in their [user group](https://docs.astalty.com.au/guide/settings/users-settings/user-groups). [↑ Matrix](#tasks)                                                                                                                                                                                                                                                          |

### Team Member - Whole-Role Permissions (👥)

These permissions apply to all Team Member users and can be toggled under Settings > Permissions. This is the complete list for Team Members on that page - the only other role-wide toggles are the chat messaging permissions under Settings > Chat.

| **Permission**                                | **Default** | **What It Does**                                                                                                                                                                                                               |
| --------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **View All Contacts**                         | **ON**      | Allows all Team Members to view all contacts in the directory. When disabled, they cannot browse the contacts list. [↑ Matrix](#directory)                                                                                     |
| **View All Organisations**                    | **ON**      | Allows all Team Members to view all organisations in the directory. When disabled, they cannot browse the organisations list. [↑ Matrix](#directory)                                                                           |
| **Create Services**                           | **ON**      | Allows all Team Members to create new services under Participant NDIS plans. [↑ Matrix](#ndis-plans--services)                                                                                                                 |
| **Delete Services**                           | **ON**      | Allows all Team Members to delete services from Participant NDIS plans. [↑ Matrix](#ndis-plans--services)                                                                                                                      |
| **Document Categories - Create**              | **ON**      | Allows all Team Members to create new document categories. [↑ Matrix](#documents--templates)                                                                                                                                   |
| **Document Categories - Update**              | **OFF**     | Allows all Team Members to update existing document categories. [↑ Matrix](#documents--templates)                                                                                                                              |
| **Participant Tags - Create**                 | **ON**      | Allows all Team Members to create new Participant tags. [↑ Matrix](#participant---goals-alerts-risks--records)                                                                                                                 |
| **Participant Tags - Update**                 | **ON**      | Allows all Team Members to update existing Participant tags. [↑ Matrix](#participant---goals-alerts-risks--records)                                                                                                            |
| **View Participant Invoices**                 | **OFF**     | Allows all Team Members to view invoices on Participant profiles. [↑ Matrix](#participants)                                                                                                                                    |
| **View Other Team Members' Calendars**        | **OFF**     | Allows all Team Members to view other team members' calendars. [↑ Matrix](#calendar)                                                                                                                                           |
| **View All Notes and Tasks**                  | **ON**      | Allows all Team Members to see every **Participant** note and task across the organisation. When off, visibility falls back to the user-group option below. Does not affect support or group support notes. [↑ Matrix](#tasks) |
| **View Notes and Tasks for Their User Group** | **ON**      | When "View all notes and tasks" is off, also lets Team Members see notes and tasks owned by others in their [user group](https://docs.astalty.com.au/guide/settings/users-settings/user-groups). [↑ Matrix](#tasks)            |

### Support Worker - Per-User Permissions

Support Workers have two permissions that can be toggled for an individual user.

| **Permission**                           | **Default** | **What It Does**                                                                                                                                                                                                                                                                                                                       |
| ---------------------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **View All Case Notes**                  | **ON**      | Lets the Support Worker see every **Participant** note across the organisation. Set for the whole role under Settings > Permissions, and overridable for an individual user here - the per-user setting wins. Doesn't affect support or group support notes on the web platform; in the app those are filtered too. [↑ Matrix](#notes) |
| **View Case Notes for Their User Group** | **ON**      | When "View all case notes" is off, also lets the Support Worker see case notes written by others in their [user group](https://docs.astalty.com.au/guide/settings/users-settings/user-groups). [↑ Matrix](#notes)                                                                                                                      |

### Support Worker - Whole-Role Permissions (👥)

These apply to all Support Workers and are toggled under Settings > Permissions. This is the complete list for Support Workers on that page.

| **Permission**                           | **Default** | **What It Does**                                                                                                                                                                                                                                                               |
| ---------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **View All Case Notes**                  | **ON**      | Allows all Support Workers to see every **Participant** note across the organisation. When off, visibility falls back to the user-group option below. Doesn't affect support or group support notes on the web platform; in the app those are filtered too. [↑ Matrix](#notes) |
| **View Case Notes for Their User Group** | **ON**      | When "View all case notes" is off, also lets Support Workers see case notes written by others in their [user group](https://docs.astalty.com.au/guide/settings/users-settings/user-groups). [↑ Matrix](#notes)                                                                 |

### Other Configurable Permissions

| **Permission**                                                 | **Default** | **What It Does**                                                                                                                                                                                                                                                                              |
| -------------------------------------------------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Disable Own 2FA** (all roles)                                | -           | Controlled by a single account-level security setting, not per-user or per-role. Only the Account Owner can change it, and it is unavailable while 2FA is enforced for the account. Account Owners can always disable their own 2FA. [↑ Matrix](#users--user-management)                      |
| **Message Admins / Managers / Team Members / Support Workers** | **ON**      | Whole-role settings controlling which roles each of Manager, Team Member, and Support Worker can start conversations with (Admins, Managers, Team Members, and/or Support Workers). All default to ON. Configured under **Settings > Chat**, not the Role Permissions page. [↑ Matrix](#chat) |