← Back to docs
Reference For: admins, managers

Roles & Permissions

Subgrade controls what each person can see and do through permissions, bundled together into a role. This page explains how that works — and answers the common question, "why can I see a page my workmate can't?"

The basics

  • Every person in a workspace has one role.
  • A role is a bundle of permissions, and each permission unlocks a capability — like running a pay run, approving timesheets, or viewing budgets.
  • You only see the sidebar entries you have permission for. That's why two people in the same workspace can see different menus.
  • Roles are per workspace. The same person can be a manager in one workspace and a worker in another.

Behind the scenes there are well over a hundred granular permissions covering payroll, assets, safety, projects, HR, and more — but you work with roles, which package the right permissions together for a job.

The standard roles

Every workspace starts with a set of ready-made roles:

  • admin — full control of the workspace.
  • management — broad office and operations access across payroll, HR, documents, and compliance.
  • payroll — pay runs, compensation, finance, leave, and workers compensation.
  • human resources — people and profiles, training, and inductions.
  • supervisor — site supervision: timesheets, toolbox talks, inductions, shift reports, and approvals.
  • employee — the default for a new team member: their own timesheets, prestarts, leave, and shift reports.
  • subcontractor — an on-site subbie: sign SWMS and risk assessments, file prestarts and dockets, and log their own work.
  • maintenance — asset servicing plus day-to-day site actions.
  • trade pack admin / trade pack worker — for workspaces using the Trade Pack add-on.

A new person you invite starts as employee unless whoever invites them has permission to assign a different role.

Managing roles

Roles are managed from the People page (under Workforce & HR), which has three tabs:

  • Team Directory — change a member's role from the dropdown next to their name.
  • Invite People — set a person's role when you invite them.
  • Roles — create custom roles, if your workspace has that turned on (below).

A couple of rules to know:

  • Changing someone's role needs the right permission, and you can't change your own role.
  • Each person has exactly one role — assigning a new one replaces the old one, and the change is recorded in the audit log.

See People for the full walkthrough.

Custom roles (if enabled)

Some workspaces can build their own roles when the standard set isn't a perfect fit. This is off by default and is enabled for your workspace by Subgrade — ask your Subgrade contact if you need it. Once enabled, you create and edit custom roles from People → Roles. Custom roles draw on the same permission catalogue and can't reuse the standard role names.

Subcontractors

An account-holding subcontractor gets a strictly own-scoped view — they can log and track only their own work, and see only their own finalised invoices and rate cards, never another subcontractor's and never the office-wide view. That self-service area is My Subcontractor Work.

"Why can't I see that page?"

Almost always one of two things:

  1. Your role doesn't include that permission — ask a workspace admin to adjust your role or add the permission.
  2. Your workspace doesn't have that feature — for example, the Trade Pack add-on. See What is Subgrade.