Permission System

6 min read Account, permissions and billing
On this page
  1. Permission levels in enrutar
  2. Permissions and boards
  3. Permission table
  4. General permission rules
  5. Permission tables by entity
  6. Work Orders
  7. Appointments
  8. Documents
  9. Customers
  10. Routes
  11. Checklist templates
  12. Tags
  13. Work order statuses
  14. Time entries
  15. Absences
  16. Internal Chat
  17. Work reports
  18. Reports
  19. Users
  20. Customer context in sidebar
  21. Key concepts

The permission system in enrutar is designed to be simple to understand and easy to maintain, avoiding complex configurations with dozens of combinations. For this reason, each employee must have exactly one of these three levels: Restricted Access, Management Access or Full Access.

Permission levels in enrutar

Full Access

Gives complete access to the entire application within the organization, including permission management.

  • Full access to all entities.
  • Can manage roles and access levels (with one exception: cannot change their own access level).

Management Access

Gives access to all daily operations, but limits sensitive actions related to account administration.

  • Full access to almost the entire application.
  • Cannot manage the subscription and payments section.
  • Cannot change roles or access levels of users.

Restricted Access

This is the most limited level and is designed for field staff. It is built around the work order as the central piece.

The logic is:

  • If an employee is added as an assignee of a work order, or as an operator in an appointment of a work order, then they gain access to everything related to that work order.
  • This includes, for example:

This philosophy allows a person with restricted access to have everything they need to carry out the appointment (for example, calling the customer), without opening access to information that doesn't concern them.

The exception is comments marked as Management only: a user with restricted access does not see them or their files, even if the work order or customer is assigned to them.

Permissions and boards

Boards separate work orders, statuses, appointments and members. Management users administer boards they can access. Restricted Access users cannot create or edit work orders from general screens or move a work order between boards. Employee and team assignments must belong to the work order's board; agents can be assigned on any board.

Permission table

General permission rules

Permission Level Read Access Write Access Special Rules
RESTRICTED Only assigned entities (via calculated assignment) Very limited (see rules per entity) Designed for field staff with minimal editing permissions
MANAGEMENT All entities in the organization Full on most entities Cannot change user roles or access levels
FULL All entities in the organization Full Can change roles and access levels (except their own access level)

Permission tables by entity

Work Orders

Permission Read Create Update Delete Bulk Operations Special
RESTRICTED Only where calculated assignment applies ❌ ❌ ❌ ❌ ✅ Can update status of assigned work orders
MANAGEMENT All ✅ ✅ ✅ ✅ -
FULL All ✅ ✅ ✅ ✅ -

Notes:

  • Calculated assignment includes: assignment to the work order OR assignment to an appointment of the work order
  • RESTRICTED can access archived work orders if they were assigned before archiving

Appointments

Permission Read Create Update Delete Update Status Generate Reports
RESTRICTED Only for assigned work orders OR assigned to the appointment ❌ ❌ ❌ ✅ For accessible appointments ✅ Only for themselves
MANAGEMENT All ✅ ✅ ✅ ✅ ✅ For all users
FULL All ✅ ✅ ✅ ✅ ✅ For all users

From the Calendar, Restricted Access users open an accessible appointment read-only: they cannot create, reschedule, edit, delete or bulk-edit it. Updating status remains available through the operational flow.

Documents

Permission Read Create Edit / archive
RESTRICTED Documents from accessible work orders or customers and own independent uploads ✅ Own uploads Metadata and archive state of own independent uploads only; linked documents are read-only
MANAGEMENT All ✅ ✅
FULL All ✅ ✅

An upload stops being independent when linked to a comment, chat, report, material, signature or logo.

Customers

Permission Read Create Update Delete Access to phones/emails
RESTRICTED Only with assigned work orders ❌ ❌ ❌ ✅ For accessible customers
MANAGEMENT All ✅ ✅ ✅ ✅
FULL All ✅ ✅ ✅ ✅

Notes:

  • RESTRICTED can access customers with archived work orders if they were assigned before archiving

Routes

Permission Read Create Update Delete Assign / Unassign
RESTRICTED ✅ All ❌ ❌ ❌ ❌
MANAGEMENT ✅ All ✅ ✅ ✅ ✅
FULL ✅ All ✅ ✅ ✅ ✅

Checklist templates

Permission Read Create Update Delete Complete / Uncomplete items
RESTRICTED ✅ All ❌ ❌ ❌ ✅ If assigned to the appointment
MANAGEMENT ✅ All ✅ ✅ ✅ ✅
FULL ✅ All ✅ ✅ ✅ ✅

Tags

Permission Read Create Update Delete
RESTRICTED ✅ All ❌ ❌ ❌
MANAGEMENT ✅ All ✅ ✅ ✅
FULL ✅ All ✅ ✅ ✅

Work order statuses

Permission Read Create Update Delete
RESTRICTED ✅ All ❌ ❌ ❌
MANAGEMENT ✅ All ✅ ✅ ✅
FULL ✅ All ✅ ✅ ✅

Time entries

Permission Read Create Update Delete
RESTRICTED ✅ Own only ❌ ❌ ❌
MANAGEMENT ✅ All ✅ ✅ ✅
FULL ✅ All ✅ ✅ ✅

Absences

Permission Read Request / create Approve or reject Edit / delete Configure types
RESTRICTED Own only ✅ Own requests ❌ ✅ Own while pending ❌
MANAGEMENT All ✅ For any employee; automatically approved ✅ ✅ ❌
FULL All ✅ For any employee; automatically approved ✅ ✅ ✅

See Absences for the complete flow.

Internal Chat

Internal Chat requires an Enterprise organization but is available to all three access levels. Each conversation is readable only by its members. A channel owner manages members; adding a team grants access to its members.

Work reports

Permission Read Create Update Delete
RESTRICTED ✅ For assigned work orders OR created by themselves ✅ Only for assigned work orders ✅ Only reports created by themselves ✅ Only reports created by themselves
MANAGEMENT ✅ All ✅ ✅ ✅
FULL ✅ All ✅ ✅ ✅

Notes:

  • RESTRICTED can access reports from archived work orders if they were assigned before archiving

Reports

Permission General statistics Time entry report Time Tracking
RESTRICTED ❌ ❌ ✅ Own records only
MANAGEMENT ✅ ✅ All records ✅ All records
FULL ✅ ✅ All records ✅ All records

Users

Permission Read Update self Update others Change role Change access level Change status
RESTRICTED ✅ All ✅ (own name only) ❌ ❌ (not own) ❌ (not own) ❌ (not own)
MANAGEMENT ✅ All ✅ ✅ (except role/access) ❌ ❌ ✅
FULL ✅ All ✅ ✅ ✅ ✅ (not own) ✅

Notes:

  • Email, phone and password belong to each person's account. Only that person can change them from My account; no access level can modify them from another employee's record.
  • A user with management access can invite employees, but not with Full Access.

Customer context in sidebar

Permission Work Orders Appointments Reports Threads
RESTRICTED ✅ Only for customers with assigned work orders ✅ Only for customers with assigned work orders ✅ Only for customers with assigned work orders ❌ No access
MANAGEMENT ✅ All ✅ All ✅ All ✅ All
FULL ✅ All ✅ All ✅ All ✅ All

Key concepts

Calculated assignment: a user is considered assigned by calculation to a work order if:

  • They are directly assigned to the work order, OR
  • They are assigned to at least one appointment of that work order

Archived work orders: RESTRICTED users maintain access to archived work orders/customers/reports if they were assigned before archiving.

WhatsApp threads: users with RESTRICTED access only see the threads assigned to them directly or through one of their teams. Having work orders or appointments for a customer does not give access to that customer's conversations. See WhatsApp Chat.

EVA: when a user with RESTRICTED access asks EVA for something in Internal Chat or mentions her in a comment, EVA respects their permissions: she only checks the work orders they can access and does not create work orders or appointments on their behalf.

Was this article helpful?

Thanks, this helps us improve.

What was missing? Tell us and we’ll add it. Tell us
Work Orders Work orders are the foundational block of enrutar. They are the structure upon which the entire system is built and the most important piece. In this… Assignees Assignees are the Employees responsible for a work order. They are the people who oversee or manage the work order throughout its lifecycle. Appointments Appointments (also called visits) are scheduled events within a work order where one or more field operators perform the actual work for a customer.… Comments Comments are a fundamental unit in enrutar. They are the place where all additional information that cannot be captured in the structure of Work…