Roles and permissions
Seven roles, one rule: nobody gets a menu item they cannot use, and nothing a role cannot do is reachable by typing a URL. Here is who holds what.
Every person holds exactly one role in a community. A role is per community: the same person can be an admin of their estate and an ordinary resident of a stokvel without the two leaking into each other. Platform staff are a separate system entirely — tenants never see them.
The seven roles
A role is a name for a bundle of permissions. The app rarely checks the role name itself; it checks a permission, and the role is how you grant a sensible bundle of them in one step.
| Role | What it is for | Typically |
|---|---|---|
| resident | The default. Read the directory, the ledger and the proposals; pay dues, vote, post in chat, list something to sell, pre-authorise a visitor. | Everyone who lives in the community |
| moderator | A resident who can also run the community's day-to-day: invite and remove people, manage rooms and announcements, open and close proposals, curate listings and places. | Committee member, communications lead |
| treasurer | Owns the money: dues schedules, payments, expenses, budgets, reports, rental tariffs. Cannot void a posted ledger entry. | The person who keeps the books |
| protection_lead | Owns safety: broadcasts, incidents, panic follow-up, patrols and patrol payroll, and the guardhouse board. | Security portfolio holder |
| property_manager | Runs rentals: properties, leases, tariffs, meter readings and fault triage. Can see the directory to place a lease, but cannot invite or remove anyone. | Managing agent |
| gate | Guardhouse only. Four permissions, one purpose: check visitors in and out. | Security staff at the gate |
| admin | Everything, including the settings nobody else can reach: roles, billing, integrations, the audit trail. | Chairperson, trustees, whoever set it up |
An admin passes every check regardless of what the permission lists say. The other side of that: an admin can only assign roles ranked below their own, so no admin can quietly promote someone else to admin. Adding a second admin is a deliberate act by an existing one.
The permission matrix
The app checks forty-eight named permissions. Grouped into the things a person actually wants to do, this is what each role holds.
| What it lets you do | Permission | Held by |
|---|---|---|
| See the member directory | VIEW_MEMBERS | Everyone except gate |
| Invite a member | INVITE_MEMBERS | moderator, treasurer, protection_lead, admin |
| Remove or suspend a member | REMOVE_MEMBERS, SUSPEND_MEMBERS | moderator, admin |
| Manage members / change roles | MANAGE_MEMBERS / MANAGE_ROLES | moderator / admin |
| Read the money | VIEW_FINANCES | Every role, including gate |
| Record and approve money | MANAGE_FINANCES, APPROVE_EXPENSES | treasurer, admin |
| Void a posted ledger entry | VOID_TRANSACTIONS | admin only |
| Financial reports | VIEW_REPORTS | treasurer, admin |
| Read, open and vote on proposals | VIEW_PROPOSALS, CREATE_PROPOSALS, VOTE_PROPOSALS | Everyone except gate |
| Manage and close proposals | MANAGE_PROPOSALS, CLOSE_PROPOSALS | moderator, admin |
| See safety and incidents | VIEW_SAFETY | Everyone except gate |
| Broadcast an alert, run safety | CREATE_ALERTS, MANAGE_SAFETY, MANAGE_PROTOCOLS | protection_lead, admin |
| Pre-authorise a visitor | INVITE_VISITORS | Every role, including gate |
| Work the guardhouse board | VIEW_GATE, MANAGE_GATE | protection_lead, gate, admin |
| Post in chat / send an announcement | POST_MESSAGES / SEND_ANNOUNCEMENTS | Everyone except gate / moderator, treasurer, protection_lead, property_manager, admin |
| Delete messages, manage rooms | DELETE_MESSAGES, MANAGE_ROOMS | moderator, admin |
| Buy, sell, manage listings | VIEW_MARKETPLACE, POST_LISTINGS / MANAGE_LISTINGS | Everyone except gate / moderator, admin |
| Projects: view, create, approve, manage | VIEW_PROJECTS, CREATE_PROJECTS / APPROVE_PROJECTS / MANAGE_PROJECTS | Everyone except gate / admin / moderator |
| Rental: view, run properties and leases | VIEW_RENTAL / MANAGE_RENTAL_PROPERTIES, MANAGE_RENTAL_LEASES | Everyone except gate / property_manager, admin |
| Tariffs, meter readings, fault triage | MANAGE_RENTAL_TARIFFS, VERIFY_METER_READINGS, TRIAGE_RENTAL_FAULTS | property_manager, admin; tariffs also treasurer |
| Analytics | VIEW_ANALYTICS | moderator, treasurer, protection_lead, property_manager, admin |
| Community settings, billing, integrations | MANAGE_TENANT, MANAGE_SETTINGS, MANAGE_BILLING | admin only |
What each role sees
The menu is built from one config and filtered per person: a group disappears entirely when every entry in it is filtered out. A resident opens the app to a short list; an admin opens it to a long one. There is no in-between state where a menu item leads to a refusal.
- gate lands on the guardhouse. They can also reach their own profile, security and appearance settings, chat, their inbox and their visitors — nothing else. This is enforced in the request path, not just the menu, so typing a treasury URL sends them back to the gate.
- resident sees the community side: dashboard, calendar, chat, inbox, announcements, members, proposals and voting, meetings, documents, treasury read-only, my dues, safety, visitors, work orders and projects.
- moderator adds analytics and the moderation surfaces: member requests, listings, places, rooms and announcements.
- treasurer gains the whole Finance group — arrears by parcel, bank reconciliation, owner statements, reports, notices — plus payments settings.
- protection_lead adds the guardhouse board and patrol payroll to the safety group.
- property_manager adds rental management and analytics.
- admin sees everything the plan and the community type allow, including community settings, the unit register, integrations and billing.
Changing someone's role
- Open the member. Members → the person. Their page shows the role they hold and when they joined.
- Change the role. Only an admin can. The options offered are the roles ranked below them, so a promotion to admin is never one careless click.
- They are told. The affected person gets a notification, and the change is written to the audit log with the old and the new value.
Suspending someone is not the same as removing them. A suspended member keeps their history and their statement; a removed member is deactivated. If they were the resident of a house, the move-out flow is what stops future member-based levies — see arrears for why the owner's levy survives a tenant leaving.
Modules and community types
Two gates sit on top of roles. A plan decides which modules are switched on; a community type decides which modules make sense at all. A stokvel is a wallet, not a place, so no plan can sell it a guardhouse. The portfolio console is the one module that sits outside this: it belongs to the customer, not to a community.
| Module | Available to |
|---|---|
| Marketplace, Safety & patrols, Community places, Residential rental, Parcels & assets | Estate, HOA and neighbourhood communities only |
| Everything else | Any community type whose plan includes it |
| Portfolio console | Not a community module at all — it belongs to an organisation that runs several communities, on the Enterprise plan. No tenant role grants it; see Portfolio and enterprise |
If a module is not in your plan the menu entry is absent and the route is refused server-side, rather than rendered as an empty page. Switching a module on is a billing change — see Settings, billing and access.
What is always recorded
Every write an action performs produces an audit row in the community's own log: who did it, what they did, which record it touched, and the values before and after. The log is append-only — entries cannot be edited or deleted, by anyone, including an admin. Votes, ledger postings, panic events, patrol logs and reviews go further and are immutable at the database level: they can be corrected only by posting a counter-entry, never by rewriting history.