Roles and Permissions

Summary

Torqueflow uses a capability-based permission system. Each staff member is assigned a role, and each role grants a set of capabilities that control what the user can see and do. Owners can view all roles, create custom roles, edit capabilities on custom roles, and delete unused custom roles. System roles (Owner, Manager, Service Advisor, Technician, Kiosk Device) cannot be renamed, deleted, or have their capabilities edited - their capability lists are managed by Torqueflow and stay in sync with the product as new features ship. If you need a system-role-like profile with a tweak, Copy from the system role when creating a new custom role.

Prerequisites

• You are signed in with the settings.roles.manage capability. By default, only the Owner role has this.
• Navigate to Settings in the sidebar.

Permissions

This page requires the settings.roles.manage capability. Users without it are redirected to /settings.

Steps

1. Open the Roles page

Go to Settings > Roles. The page is at /settings/roles.

The page header shows a shield icon, the title Roles, and the subtitle “Manage staff roles and permissions”.

2. Review existing roles

The role list displays all roles for your organisation. Each role card shows:

• Shield icon and role name.
• A System badge (if the role is a built-in system role).
• User count - how many staff members are assigned to this role (e.g. “3 users”).
• Capability count - how many capabilities are granted (e.g. “12 capabilities”). Roles with the wildcard * show “(Full access)”.
• Description - a short summary of the role’s purpose (if set).

System roles are sorted first by their sort order, then custom roles appear alphabetically.

Click any role card to open its edit dialog.

3. Create a custom role

1. Click the Create Role button (top right of the role list).
2. The Create Role dialog opens.
3. Optionally, select a role from the Copy from existing role dropdown to pre-fill capabilities from that role.
4. Enter a Name (required, max 50 characters). For example: “Senior Technician”.
5. Enter a Description (optional, max 200 characters).
6. Select capabilities using the capability selector (see step 5 below).
7. Click Create Role.

A success toast confirms “Role created successfully”. The role appears in the list.

Role names must be unique within your organisation. If a duplicate name is entered, an error message appears: “A role with this name already exists”.

4. Edit an existing role

1. Click the pencil icon on a role card, or click the card itself.
2. The Edit Role dialog opens. For system roles, the dialog shows a System badge and an explanation that the name and capabilities are both managed in code and cannot be edited in the UI. The capability checkboxes are visible but disabled, so you can see what the role grants - they just cannot be ticked or unticked.
3. For custom roles: edit the Name and Description fields as needed.
4. For custom roles only: modify capabilities using the capability selector.
5. Click Save Changes.

When Torqueflow ships a new feature, system roles automatically pick up any new capabilities that belong to them - you do not need to revisit this page after an update. The capability list shown on a system role always reflects what the role grants today, not a stale snapshot from when you signed up.

A success toast confirms “Role updated successfully”.

5. Use the capability selector

Capabilities are grouped by category. The available categories are:

• Finance - invoice, payment, and financial report access.
• Scheduling - appointment and diary management.
• Vehicles - vehicle record access and editing.
• Parts - parts catalogue and ordering.
• Time Tracking - clock-in/out and timesheet features.
• Settings - organisation settings and configuration.
• Audit - audit log viewing.
• AI Assistant - AI chat and analytics access.
• Kiosk - kiosk mode features.

Each category has a collapsible section. To use the selector:

1. Click a category header to expand or collapse it.
2. Tick the All checkbox on the right of a category header to grant all capabilities in that category (this sets a wildcard, e.g. finance.*). Individual checkboxes become disabled when the category wildcard is active.
3. Alternatively, tick individual capabilities. Each has a name and a code (e.g. finance.invoices.create). Hover over the info icon next to a capability name to see its description.

Roles with the global wildcard * (such as Owner) show a message: “Full Access: This role has all capabilities (wildcard *). Individual capabilities cannot be modified.”

6. Delete a custom role

1. Click the bin icon on a custom role card. System roles do not show a delete button.
2. A confirmation dialog appears: “Are you sure you want to delete the role [name]? This action cannot be undone.”
3. Click Delete to confirm.

A success toast confirms “Role deleted successfully”.

Deletion is blocked when:

• The role has users assigned. The dialog shows: “Cannot delete role with assigned users. Reassign X user(s) first.” The Delete button is hidden.
• The role is a system role. No delete button is shown.

7. Assign a role to a staff member

Role assignment is done from the staff member’s record, not from this page. Go to Settings > Staff Management, select Edit on the person, and choose their role.

8. Custom roles and the Can work as Technician box

The Can work as Technician box on a staff record decides whether that person can be booked as the technician on a job. It is separate from their role.

1. When you give someone the Technician system role, the box is ticked and locked. Technicians are always bookable.
2. When you give someone a custom role, the box starts unticked and you choose. A bookkeeper or a diary-only “Calendar Viewer” stays unticked and never appears as a technician.
3. Tick the box only for people who work on vehicles. Ticked staff appear in the technician lists on the scheduler, a bay’s default technician, work order assignment and the finance technician filters. Unticked staff do not.
4. Ticking the box also gives that person My Jobs access and the Sign Off Jobs permission, whatever their role.

Check older custom-role staff. Before September 2026, giving someone a custom role ticked this box automatically and it could not be unticked. If you set up custom roles before then, open each custom-role staff member in Settings > Staff Management and untick Can work as Technician for anyone who does not work on vehicles.

9. Control who can sign off jobs

Any technician in your garage can work on any job in your garage, whoever it is assigned to. Signing off is the one step with its own permission, Sign Off Jobs (my_jobs.sign_off), so you can keep it to qualified staff.

1. The Technician system role has Sign Off Jobs, and anyone with Can work as Technician ticked gets it automatically. Nobody lost sign-off when this permission was introduced.
2. To let someone work on jobs without signing them off, such as an apprentice, create a custom role that includes Access My Jobs but not Sign Off Jobs, give it to them, and leave Can work as Technician unticked.
3. Their job card then shows why they cannot sign off, and a colleague who holds the permission signs the job off instead.

This has a catch. Because Can work as Technician always brings sign-off with it, someone restricted this way cannot also be booked as the technician on an appointment. They can still pick up and work on jobs from the board.

Capabilities worth knowing about

my_jobs.sign_off (Sign Off Jobs) lets someone sign off a job from the technician job card. Signing off moves the job to your job-finished status and hands it to the office to invoice. It does not message the customer. See step 9 above.

vehicles.haynespro.identify (Identify vehicles for HaynesPro) lets someone pick a vehicle’s exact manufacturer type, so service schedules, repair times and diagrams can be pulled. Identifying never costs credits. Owners, managers, service advisors and technicians have it by default. When it arrived in September 2026, existing custom roles that could manage work orders or open My Jobs were given it too.

• A wrong pick is silent, so you may want only experienced staff to identify. Create a custom role without this capability for anyone who should not. Bear in mind that a custom role copied from a system role does not pick up later changes to that system role.
• Staff without it see Ask a technician to identify it wherever a vehicle is not identified, beside a line saying they cannot pick the type themselves. They can add a note and send the request to the technicians. There is no separate permission for asking. See Asking a technician to identify a vehicle.
• It also decides who sees the Open requests strip on the My Jobs Jobs board when Haynes Pro data is switched on, and so who can take, identify or turn down those requests.
• It lets someone capture a VIN from a phone with Capture from phone, even without Manage Vehicles. Either permission is enough. See Capturing a VIN from your phone.
• It does not stop someone who can edit vehicles from clearing an identity by changing the make or model.
• A custom role whose only route to the job card is the Can work as Technician box, with neither work-order nor My Jobs permissions of its own, does not get it automatically. Tick it on that role.

my_jobs.access (Access My Jobs) now also lets someone change a vehicle’s presence in both directions: check it in, and undo a mistaken check-in, from the job card, the My Jobs board, the work order page and the On site screen. Anyone who can work jobs can also flag and clear “parts on order” on their job card. Grant My Jobs access with that in mind. Claim buttons still need my_jobs.claim.

health_checks.comment_settings.manage (Manage health check comment settings) lets someone set the heading and the ready-made phrases for the comment at the foot of every vehicle health check, on the Check comments card in Settings > Health checks. Managers have it by default and Owners have everything. Custom roles that could already manage health check templates were given it automatically when it arrived; untick it on those roles if you do not want them changing the phrases. A custom role also needs Settings access to see the Health checks tile. See Health check templates.

A few capabilities are deliberately narrower than the role they sit near, because of what they let someone do.

finance.purchases.vat_evidence_manage lets someone attach a VAT invoice to a purchase recorded from a till receipt, stamp the chase, and close a purchase out as “no VAT invoice will come”. Owners and managers have it. Service advisors deliberately do not. Re-splitting a posted invoice into net and VAT, deciding which quarter a reclaim lands in, and knowingly giving up a reclaim are bookkeeping acts on a statutory return, not counter work. A service advisor can still see the chase list, which is the part that helps them do their job. See Purchases where the VAT invoice has not arrived yet.

voice.escalations.view is not granted to service advisors by default either, and the escalation queue now receives callback requests from your online booking page as well as calls. If you want advisors handling those, grant it. See Escalation queue.

Expected Outcome

Your organisation has a set of roles - both system and custom - each with a defined set of capabilities. Staff members are assigned roles that control their access throughout Torqueflow. Changes to role capabilities take effect on the next page load for affected users.

Troubleshooting

Problem	Cause	Fix
Roles page redirects to /settings	Your account lacks the settings.roles.manage capability	Ask the Owner to grant you this capability or sign in as Owner
”A role with this name already exists” error	Another role in your organisation has the same name	Choose a different name
Cannot delete a role	The role has users assigned to it	Reassign those users to a different role first, then delete
Delete button missing on a role	It is a system role	System roles cannot be deleted. You can only edit their capabilities
Cannot change the name of a role	It is a system role	System role names are fixed. Create a custom role (with Copy from to pre-fill its capabilities) and edit that instead
Cannot tick or untick capabilities on a system role	System role capabilities are managed in code	Use Copy from when creating a custom role to pre-fill the system role’s capabilities, then adjust them on the new custom role
”Failed to load roles” error	A server error occurred loading role data	Refresh the page. If the problem persists, check your connection
A bookkeeper or other office user shows up as a technician on the scheduler	Their Can work as Technician box is ticked, often left over from before September 2026	Edit them in Settings > Staff Management and untick the box
”The Kiosk Device role cannot be given to a person” or “Kiosk devices are managed in Settings > Kiosk Devices, not here”	Kiosk devices are not staff. A staff member cannot be moved onto or off the Kiosk Device role	Add and manage kiosks in Settings > Kiosk Devices
Someone says a button vanished after they pressed it, with a message that they do not have permission	Their role changed while they had the page open. The page refreshes and removes the control	Expected after a role edit. If they should have it, add the capability back to their role
”Select a role for this staff member before saving.”	The staff member has no role assigned, which would leave them with no permissions	Choose a role in the dialog, then save
”You cannot change your own role” when you only changed your own name or pay rate	A known problem. Staff who were invited and have never had their record edited by someone else have no saved role assignment, and saving any change to your own record is then refused	Ask another owner or manager to make the change for you
Staff on a custom role are not covered by the organisation 2FA policy	The 2FA policy can only require 2FA for the system roles (Owner, Manager, Service Advisor, Technician). Custom-role staff cannot be included, and they are left out of the per-role counts on the security page	This is a gap, not a hidden setting. Ask custom-role staff to turn on 2FA for their own account in Settings > Security. See Two-Factor Authentication

Notes

• Capabilities are seeded automatically. If no capabilities exist in the database, Torqueflow seeds them on first access to this page.
• The wildcard capability * grants unrestricted access to all features. Only assign it to fully trusted roles.
• Changes to a role’s capabilities apply to all users assigned to that role.
• Assigning a custom role never makes someone a bookable technician on its own. Only the Can work as Technician box does that.