Access control that does not rely on a hidden button
Your customer list, your pricing and your job history are the business. The server checks who can reach them, and this page also says which rules are only applied on screen.
The server decides who can see what
An engineer who opens another engineer’s job by editing the address gets “not found”. The invoice list, the payment records and deliveries are closed to an engineer’s login even when the API is called directly. The one exception is collecting payment on a site visit they went on. The check is made by the server, so hiding a button is never the only thing in the way.
One organisation cannot see another
Every customer, asset, job and visit belongs to an organisation, and every request is scoped to the one the person signing in belongs to.
Pricing is need-to-know
What the shop charges is commercially sensitive inside the business as well as outside it. Quotation figures go to the owner and managers, and an engineer’s login gets an empty answer.
An invite is not a transferable ticket
An invite code only works for the email address it was issued to. Forwarding the link to somebody else does not let them in, and repeated attempts are locked out.
Money is added up by the server, not typed in
An invoice total, what has been paid and what is outstanding are computed from the line items, adjustments and payments. A browser never submits a figure of its own. A payment larger than the balance is refused, and two people collecting at the same moment cannot both succeed.
Corrections leave a trail
A discount is an adjustment with a reason attached. A payment taken in error is voided with a reason, not deleted. What was charged, what changed it and why can all still be read a year later.
Nothing is silently rewritten
Quotations keep every version. Approvals record the version they relate to. The purchase-order number and notes on an approval can be corrected afterwards, and the correction is stamped with who made it and when.
Some rules are screen rules, and we say which
Hiding customers’ phone numbers from engineers, and removing delete buttons from managers, are applied on screen. The server enforces access to jobs, quotations, invoices and payments. Knowing which is which tells you what each rule is really protecting.
What each person can actually reach
The same job looks different depending on who opens it.
Owner
Runs the business
- Sees every job, visit, customer and figure
- Sets organisation details, branding and quotation terms
- Invites the team
- Deletes records
- Can do everything a manager can
Manager
Runs the floor
- Books jobs and visits in and assigns engineers
- Prices quotations and records approvals and deliveries
- Raises invoices and takes payments
- Sees every job, visit and customer
- Has no delete buttons and cannot change organisation settings
Engineer
Does the work
- Sees the jobs assigned to them, work nobody has picked up yet, and their own visits
- Records inspections and work notes, and moves their own job to repair and to ready for delivery
- Starts and completes visits, asks for a price and collects the payment
- Does not see quotation figures, the invoice list or customers’ phone numbers
- Cannot reach another engineer’s job
Run your workshop on records, not recollection
Every job carries its own history: who inspected it, the quotation, who approved it and when it went out. Try it free for 1 month.