Roles, permissions, and sensitive actions

Use Business owner only for the accountable business owner. Ownership, subscription changes, unrestricted export, business erasure, and access-role assignment stay owner-only.

Use Administrator for trusted operational leaders who need team, settings, private service records, finance, reporting, marketing, and integration workflows without a personal calendar or ownership controls.

Use Admin + Service Provider when the same operational administrator also delivers services and needs their own calendar.

Use Service provider for the person’s own schedule and clients assigned to them through bookings. This access does not include other providers’ records or business administration.

Changing a role updates calendar ownership and service assignment controls together. Plan limits are enforced before a calendar-enabled invite or role change is saved.

Viewing Team > Time off requires appointment and notification visibility. Creating, cancelling, or resolving an absence also requires appointment, roster, and notification management permissions.

Your authenticated workspace session and role permissions protect day-to-day actions without repeatedly asking for a password or verification code.

Destructive actions such as deletion, cancellation, reversal, and erasure use an explicit confirmation prompt that describes what will happen before anything changes.

Role and access-status changes are recorded in the business audit log with the actor and before-and-after state.

If a person changes duties, update their role immediately. Turn off their access promptly when they leave, while retaining historical appointment attribution.

Review access quarterly and after staff, contractor, finance-provider, or business-owner changes.