Roles & permissions

In Agenda, a role decides what a person can see and do. This page explains the core concepts, walks you through the standard steps, and gives recommendations for distributing rights safely.

What this is about

Every employee has a role. Through the role they receive a set of permissions. Permissions are not automatically derived from a title like “Administrator” — they are always listed explicitly. That is by design: you always know exactly what everyone is allowed to do.

How the logic works

When an employee triggers an action (create an appointment, release an order, view inventory), Agenda checks their current permission list. If the entry is there, the action goes through. If it is missing, the button either does not appear at all, or the employee sees a “no permission” notice.

Creating a role

Open the Roles & permissions page in the admin area.
Click New role and give it a meaningful name (e.g. “Accounting”, “Cleaning team lead”). Avoid cryptic short codes.
Select the role from the list. The permission matrix appears on the right, grouped by area (calendar, accounting, warehouse …).
Tick the actions that the role is allowed to perform.
Click Save.

The new role is immediately available and can be assigned to employees.

Assigning a role to an employee

Open the employee profile (in Team or Employees).
In the “Role” field, pick the desired role.
Save. The permissions take effect on the employee’s next login.

Security levels

Every permission in Agenda carries one of three security levels. The level helps you judge how critical the grant is.

Low

Passive permissions. Read, view, open. Low risk. Grant generously — e.g. “view calendar”, “open warehouse list”.

Medium

Active changes. Create, edit, export, import. Affects company data. Grant deliberately — e.g. “create appointment” to dispatchers, “edit price list” to sales managers.

High

Destructive or trusted. Delete, approve, change roles, physical access, accounting edits. Grant only to a few, explicitly trusted people.

Areas at a glance

Without diving into every single permission, here is a rough overview of what you can grant or restrict per area:

View, create, edit, delete appointments. Additional fields for field work, show external calendar events, next service date.

Best practices

Principle of least privilege. Grant only what the person actually needs. No “just in case one day” stockpiling.
Four-eyes principle. At least 2 people per company should have the Administrator role. That way you catch abuse early, and someone is always responsible during vacation.
High-level with caution. Red (high) permissions touch money, identity, or physical access. Only grant to people with a written agreement.
Quarterly review. Once a quarter walk through every role — who still needs what? Revoke immediately if not.
Use the logs actively. Spot-check, do not wait for an incident.
Clean offboarding. When someone leaves the company, revoke the role immediately or remove the user from the company.

FAQ

Why don’t I see all permissions even though I’m an administrator?

Permissions are explicit. When new features are added to the system, the corresponding permissions also need to be ticked for your role. On your next login Agenda automatically syncs newly added permissions into your Administrator role.

What happens if I remove a permission a user is currently relying on?

The change applies on the next login. Active sessions keep the old permissions. For security-critical revocations, sign the user out manually.

Can I grant permissions to customers?

Yes. Customers invited into Agenda can have restricted rights — e.g. view their own orders, download their own documents.

Role vs. package — what is the difference?

A role is assigned to people directly. A package is a reusable template that lets you build or update roles faster. Packages are not assigned to people directly.