User roles and permissions in a service company: who sees what, with an example matrix

Why “everyone sees everything” does not work for long

In many small companies it starts with one login for the whole office. That works until you want to check something. Without agreements on roles and permissions, things go wrong in a few familiar places:

• Shared accounts. Who changed that invoice, who moved that intervention? With one login for three people, nobody knows.
• Too much visibility. A new employee sees the turnover, the margins and the hours of all their colleagues, when all they have to do is plan.
• Too little visibility. A planner has to call accounting about a question they could look up themselves.
• Leavers with access. A technician has left, but their account still works, on a mobile phone you no longer have.

The principle: everyone sees what they need for their work

In IT this is called the principle of least privilege. In plain language: you start from the task someone carries out. A planner has to plan and see which technicians are available, so they get those permissions. They do not need the margins for that.

For each task, ask three questions:

1. View, change or approve? Whoever checks invoices does not need to be able to post them. Whoever enters hours does not need to approve them themselves.
2. What scope? Their own work, their team’s, or the whole company’s.
3. Is it sensitive? Amounts and margins, invoices, colleagues’ hours and personal data, and the settings and roles themselves call for a deliberate choice.

Drawing up a roles and permissions matrix

A matrix is a table: the jobs in the rows, the sensitive data and actions in the columns, and in each cell what that job is allowed to do. Anyone who changes jobs then simply changes rows.

An example for a service company, to adapt to the way you work:

Two rules of thumb. Give the management of roles to as few people as possible, but to at least two, so that an absence does not block anything. And test the matrix with one person per job before you assign it to everyone.

Three questions that come up in every service company

Does a technician see the prices? On site, they need the parts and the work to be done, rarely the sales price or the margin. If they invoice on site, you give them that permission deliberately, for that task.

Who approves the hours? Whoever oversees the work: the manager or the owner. Everyone sees their own hours; colleagues’ hours are seen by whoever has to approve or process them.

Who sees the turnover? The owner and accounting. A manager who steers by the figures can view them without being able to change invoices.

When someone joins, changes jobs or leaves

• New colleague: a personal account in their name, with the role from the matrix, ready on their first working day.
• Different job: remove the old role and give the new one. Someone who only ever gains roles ends up with every permission after a few years.
• Leaving: close the access on the last working day. Deactivate the account rather than deleting it, so the history remains. Change shared codes the person knew and ask for the company mobile phone or tablet back.
• Review at a fixed moment: for example twice a year, you go through the accounts and their roles. Who no longer uses their account, who has more than their job requires?

An example: a handover at a water treatment company

At a water treatment company, the planner is retiring. She also did the invoicing, and her account could do almost everything. The owner splits her tasks. The new planner gets the schedule, with customers and sites, but no invoices. Invoicing goes to the accountant, who cannot move interventions. An experienced technician takes on the warehouse as well and gets a second role for it. On the planner’s last working day, her account is deactivated; her interventions stay in the history.

How it works in Digitalnatie Service Suite

In Digitalnatie Service Suite, everyone has their own account. What a person sees and is allowed to do depends on the roles the administrator gives them in the settings.

• Role templates: you start with templates grouped in families: administrator, manager, planner, technician, accounting, warehouse, sales, read-only and mailbox. You can adapt them, duplicate them or create a new role.
• A level and a scope per module: the level goes from no access and view up to manage; the scope goes from their own items through team to the whole company, with steps in between. Leave and working time have an extra approval permission. An icon marks the modules with sensitive data: finance, staff, integrations, settings and roles. Someone with several roles gets the sum of their permissions.
• The server checks every action: a hidden button is only a matter of display. Anyone without the permission is refused, even through a direct link. Everyone can read their own permissions in their profile.
• Amounts and hours: a figure a role may not see is shown on the dashboard as not available for that role. In the templates, the administrator and accounting create and post invoices; the manager views them. The administrator and the manager approve the team’s hours; without that team permission, everyone sees only their own hours.
• Technicians: a technician without any other role works in the technician app, with their own interventions, their van and their tasks. They can only invoice on site if the office gives them that permission.
• Leaving: deactivation closes all of the person’s sessions, including in the technician app. The interventions and the history are kept, and reactivating gives the access back. Work not yet sent from the app stays on the device: have a technician send everything first.
• Log: every change to roles and accounts, with the date, the author and the situation before and after.

A new role applies on the server from the next action; the menus change at the next login. Users can turn on two-factor authentication with an authenticator app, and administrator access is logged.

Customers get separate access: from the customer file, the administrator gives a contact person access to the customer portal. That person sees only their own company’s file, without other customers, internal notes or costs. There are no permissions per contact person: every invited contact person sees their company’s full file.

Introducing a new tool? Set the roles before the first invitation: see rolling out new software. More about accounts and your data in nine questions about your data in the cloud and in the frequently asked questions.

Frequently asked questions

What is the difference between a role and a permission?

A permission is a single authorisation, for example viewing invoices or approving hours. A role bundles the permissions that belong to a job, such as planner or accounting. You assign roles to people; someone who changes jobs gets a different role instead of separate permissions.

Does a technician see the prices and the turnover?

You decide that with their role. In Service Suite, a technician without any other role works in the technician app, with their own interventions, their van and their tasks. They do not open the office application, with the dashboard and the invoices. They can only invoice on site if the office gives them that permission.

What do I do when an employee leaves?

Close their access on their last working day. In Service Suite, the administrator deactivates their account: all sessions are closed, including in the technician app, and their interventions and the history are kept. Also change shared codes the person knew and ask for the company equipment back.

Can colleagues share an account?

Better not: with a personal account for each person, you know who did what, and you can close someone’s access without getting in the way of the others. At Digitalnatie it is also part of the agreement: you make sure your users keep their login details confidential and do not share accounts.

Can a customer see their own file?

Yes, with separate access to the customer portal, which the administrator grants from the customer file. The contact person sees only their own company’s file, without other customers, internal notes or costs. An employee or technician cannot log in there.