Not Everyone Needs the Whole Company.
Everyone you add holds exactly one role, and that role answers two questions: which records they reach, and what they may do with them. Five roles come with Shiftavo — Owner, Admin, Manager, Employee, and the Kiosk service role for a shared tablet. They fit most teams on day one. When they don't, you add your own: copy a built-in role, name it what your company calls it, and tick exactly what it does. That's the Plus plan.
Two Halves, Kept Apart.
Widening what someone may do never widens what they can see. That separation is the whole design.
Which records they reach.
The whole company, only the locations they're assigned to, only their own records, or nothing personal at all for a shared tablet. Scope is set once, comes from the role you copied, and can't be edited afterwards.
What they may do with them.
View, create, edit and delete, grouped by the kind of record — shifts, people, leave, demand, reports — plus the named actions that matter: approve hours, publish a schedule, decide a leave request, review a marketplace offer. Pages follow them: without the right to delete there's no Delete button, and a record someone may only view opens read-only.
Who may hand it out.
Roles are ranked. You can only give someone a role at or below your own that grants nothing you don't hold yourself, and only change a role at or below your own. A manager can't promote themselves, and nobody can mint a role that outranks them.
Ready Before You Read This.
Seeded into every company at signup. Nothing to configure, and nothing to switch on.
The whole company.
Everything in the product. Owner is the person who signed the company up and also holds billing — one per company, and it can't be handed over. Admin is the same reach inside the app without the account.
Their own locations.
Plans and publishes the schedule, approves hours, decides leave requests, runs the shift marketplace, adds, edits and removes people, keeps areas, skills and demand corrections up to date — at the sites they're assigned to, and nowhere else.
Their own data — or none.
An employee sees their own schedule, hours, availability and absences, and takes part in the marketplace. Kiosk is not a person: it's the login behind a shared punch tablet, and it never reaches personal data.
A Shift Lead Is Not a Manager.
On Plus and Pro, copy a built-in role and adjust it. Three steps, no support ticket.
Start from one that works.
Pick the built-in role whose reach is right — Manager if it should see the site, Employee if it should only see itself. The new role starts with that role's permissions and inherits its data scope.
Tick what it does.
A grouped matrix, one section per kind of record, with a count on each so you can see at a glance what you've granted. A shift lead who publishes the schedule but never touches leave takes about a minute.
Use it like any other.
Your role shows up in the role dropdown on every surface — the browser, the mobile manager view, the API. Change it later and it applies to everyone on it immediately, or reset it back to the role you copied.
Things You Can't Do to Yourself.
A permission editor that can edit the permission editor needs a floor under it. This is the floor.
You can't grant what you don't hold.
Permissions you don't have yourself can't be ticked on a role you're editing — or taken off it — and you can't take away your own permission to change roles. Neither is a setting — both hold on every plan.
Location access isn't a checkbox.
Which sites a role reaches follows from its data scope, not from a box in the matrix — so a manager-shaped role can never be widened to every location by accident. The kiosk terminal permissions are locked the same way, and a role that only sees its own records can't approve hours, review marketplace offers or add kiosk tablets — those take a management role.
A downgrade takes nothing away.
Drop below Plus and your roles keep working, everyone on them keeps their access, and you can still read what each one grants. You just can't add or change roles until you're back.
The Middle of Your Team Is Real.
Most scheduling tools ship three roles and expect your company to fit. Real teams have a middle: the shift lead who publishes the week but has no business in leave balances, the payroll clerk who reads every report and edits nothing, the trainer who maintains skills at two sites. Force them into 'Manager' and you've handed out more than you meant to; force them into 'Employee' and someone else does their job for them.
So the roles are yours to shape — but the shape is bounded. What a role can see is fixed when you copy it, nobody can hand out more than they hold, and every change to a role lands in the change history with a name and a timestamp. See the audit trail →
Where to Go Next.
The pages that sit next to this one — and the documentation when you want the detail.
Schedule & Coverage
Plan shifts on a calendar, apply templates, and watch the coverage grid go green. Compliance flags surface as you plan.
Schedule & Coverage