Who can see and do what
Roles decide it. Put them on the role that fits and grant the one or two extras they actually need.
Every screen and every document checks a permission. Somebody without it does not see a locked button — the page is simply not there for them.
The ones that matter most
| Permission | What it controls |
|---|---|
| See cost and profit | What things cost, margins, and most reports |
| See customer contact details | Addresses and telephone numbers. Names are always visible — a mechanic needs to know whose car is on the lift |
| Take payments | Receipts and refunds |
| Void documents | Cancelling a processed document, and deleting a stray one |
| Change workshop settings | Tax, company details, the hand-off, and the full data export |
Contact details are removed on the server for anybody without that permission, before the page is built — not hidden in the markup. They are not in the page for somebody to find in the developer tools, and they are stripped from the exports too, so a download is never the way around a permission.
Adding somebody
Settings → Team, invite by email. The link lasts seven days and works once. MOTION will not let the last owner be removed or demoted, and only an owner can make another owner.