Overview

The Roles and Permissions framework controls what users can see and do within the system

• Each user must have at least one system role, which determines access to features, financial functionality, and settings
• Roles reflect typical positions in a law firm: Accountants, Lawyers, Partners, Paralegals, Finance staff
• Users can hold multiple roles if additional access is required

Example:
A user with the Accountant role has full banking access, while a Lawyer does not.

Quick Flow: How Roles & Permissions Work 

The following boxed flow explains how access is determined for each user.

System Roles (Overview & Descriptions)

Each role defines who a user is, while permission bands define what they can do.

Special Roles

The system also includes additional roles that complement primary roles.

These roles provide extra privileges without replacing the user’s main role.

Special roles should be assigned carefully, as they provide firm-wide authority.

Permission Bands 

Each role contains predefined permission levels, called bands, that determine the level of access to each feature area.

Permission Hierarchy

Permissions follow the hierarchy:

Basic → Standard → Unrestricted

Permissions excluded at a higher band are automatically excluded from lower bands.

Key Behaviour:

• Exclusions, not inclusions, control permissions
• Example: Cannot post transactions at Standard → also cannot post at Basic
• Special roles can override exclusions, use cautiously

Permission Access by Band

Permission Exclusions by Feature

This section provides a summary of permission exclusions. For a full breakdown by feature and permission band, see Appendix: Detailed Permission Exclusions

This appendix provides a detailed breakdown of permission exclusions across all system features and permission bands. It explains, at a granular level, which actions are restricted for each access level (Basic, Standard, and Unrestricted) within key areas of the system such as Banking, Billing, Client/Trust Accounts, Matters, Reporting, and Settings. 

It is intended as a technical reference to support troubleshooting, access validation, and advanced configuration checks. Most users will not need to refer to this document as part of their day-to-day work.  

Most access issues are due to exclusions, not system errors. Always check the user's role and permission band first.

Role Assignment: Step-by-Step

Add Role to New Employee

1. Navigate to Directory → Employees
2. Open employee record → Update → Employee → Update Employee
3. Select Actions → View Permissions
4. Choose the system role(s)
5. Click Save (which will take you back to the Employee Details screen)
6. Select Save & Close
   

Users cannot access the system until a role is assigned.

Remove Role from User

1. Navigate to Settings → Firm Settings → Roles
2. Hover over the role → Edit Users (group of people icon to the right of the Users column)
3. Hover over the user → Remove User (select trash bin icon on last column)
4. Click Save

Move Users Between Roles

Method 1 – Employee Record

1. Directory → Employees → Employee card → Update → Employee → Update Employee
2. Actions → View Permissions → select/deselect roles
3. Click Save (which will take you back to the Employee Details screen)
4. Select Save & Close

Method 2 – Roles Section in Firm Settings

1. Settings → Firm Settings → Roles
2. Remove user from existing role (following steps from "Remove Role from User" above) → Add to new role (hover over new role → Edit Users → Add User)
3. Click Save

Common Role Assignment Mistakes

• Assigning Lawyer role to finance staff
• Giving Global Administrator unnecessarily
• Missing Access All Matters when required
• Users with conflicting roles

Recommendation: Assign the minimum permissions needed for the role.

Best Practices

• Assign roles based on job responsibilities
• Avoid giving Unrestricted permissions unnecessarily
• Use Special Roles only when required
• Review user access regularly
• Limit Global Administrator roles to system administrators
• Perform quarterly audits to ensure permissions remain appropriate