Managing user roles and permissions

How roles work

Rather than everyone sharing one login (never do that), each person who needs access gets their own user account with a role. The role decides what they can see and do. Typical roles are: Administrator, who can manage users and all settings; Finance user, who can view balances, make payments and manage the facility; and Viewer, who can see statements and activity but change nothing. Separate logins mean actions are attributable and access can be removed for one person without disrupting anyone else.

Apply least privilege

Give each colleague the least access they need to do their job, and no more. A bookkeeper who only reconciles statements needs a Viewer role, not administrator rights. Fewer people with high access means fewer ways for the account to be misused, and a smaller blast radius if any one login is compromised. You can always raise someone's access later if their role changes.

Add, change or remove access

From Users in your account settings you can invite a new user, change someone's role, or remove access entirely. To add someone, see adding a user; to remove them, see removing a user. Removal takes effect immediately and ends any active session that user has.

Review the list regularly

People change roles and leave. Review your user list every quarter: remove anyone who has left, downgrade anyone whose job no longer needs high access, and confirm there is a second administrator so you are never locked out if one person is unavailable. Pair this with alerts on user changes.