Role reference

The twelve default roles and what each one can actually do.

Every new organisation starts with twelve roles. They are a starting point — you can change what each includes, and add your own.

The roles

Role	For	In short
System Administrator	The person who owns the system	Everything
Maintenance Administrator	A senior maintenance lead	Everything maintenance, plus most configuration
Maintenance Manager	Running the department	All maintenance and reliability; inventory and tools read-only; may approve requisitions
Maintenance Planner	Planning the work	Full control of work and maintenance plans; reads assets, inventory and vendors
Maintenance Supervisor	Running the shop floor	Assigns, edits and closes jobs; moves rounds; records failures
Technician	Doing the work	Own jobs, meter readings, stock movements, tools, failures, photographs
Storekeeper	The stores	Full inventory and tools; reads jobs; raises requisitions
Procurement User	Buying	Full procurement; reads vendors and inventory
Vendor	An external contractor	Only the jobs given to them, and the assets those concern
Requester	Anyone who reports faults	Raise and see their own requests; view assets
Auditor	Compliance	Read and export everything; full audit access. Changes nothing
Executive	Leadership	Read everything; full analytics

Where the boundaries sit

Supervisor against Planner

A supervisor moves a preventive round; only a planner decides it stops happening. The supervisor owns today; the planner owns the schedule.

Technician against Supervisor

A technician may add a photograph or a comment to a job; they may not remove one. A supervisor may. The photograph of the thing you were sent to fix is evidence, and evidence should not be removable by the person it concerns.

Technicians and meter readings

Technicians can create and edit meter readings. Taking a reading is the most ordinary thing a technician does — a role that could fit a new meter and then not write a number on it would be an inversion.

Manager against Storekeeper

A maintenance manager reads inventory but does not move stock; a storekeeper moves stock but does not plan maintenance. A manager can approve a requisition.

Vendor

Deliberately narrow. A vendor sees the jobs given to them and the assets those concern — not your asset register, not your other vendors, not your costs.

Asking the copilot against accepting its suggestions

A technician may ask the copilot and read what comes back — somebody standing at the machine wanting to know how to repair it is the whole point of the feature. They may not accept a suggestion, because accepting writes to a record, and that stays with the roles that already edit one.

Agreeing to switch the copilot on at all is a configuration permission, not a maintenance one.

Auditor against Executive

Both read everything and change nothing. An auditor additionally gets the audit trail — field-level history of who changed what. An executive gets analytics instead.

Combining roles

Give somebody several and they get the union. A working combination is Planner + Supervisor for a small plant where one person does both.

Making your own

Add a role and choose its permissions. Permissions are grouped by area — assets, work, maintenance, inventory, tools, workforce, vendors, procurement, reliability, analytics, documents, admin — and each has view, create, edit and delete where those make sense.

The twelve defaults are marked as system roles. You can change what they contain, but the codes stay, so the dashboards keep knowing which board to offer whom.

Which dashboard each role gets

Role	Boards
System Administrator, Maintenance Administrator, Maintenance Manager	My work · Operations · Executive
Planner, Supervisor	My work · Operations
Executive, Auditor	My work · Executive
Everyone else	My work

Roles are not scope

A role says what somebody may do. It does not say where. Site and asset access do that, and they are set per user — see people and access.