The default capability-by-role table - what Administrator, Manager, Staff, and Requester can each do out of the box.
What each role can do. Roles are hierarchical - every ✓ for Staff is implicitly a ✓ for Manager and Administrator. Capabilities are fixed per role; user groups scope which sites and work a person handles, never what they can do.
Everyday operations
Capability
Requester
Staff
Manager
Admin
Submit a work request (portal)
✓
✓
✓
✓
Track own requests (portal)
✓
✓
✓
✓
View assets, sites, buildings
-
✓
✓
✓
Create / edit assets
-
✓
✓
✓
Create / complete work orders
-
✓
✓
✓
Execute PM work & fill forms
-
✓
✓
✓
Consume parts, record costs
-
✓
✓
✓
Triage & convert work requests
-
✓
✓
✓
See organization members (for assignment)
-
✓
✓
✓
Planning & oversight
Capability
Requester
Staff
Manager
Admin
Projects (view, create, manage)
-
-
✓
✓
Reporting & report builder
-
-
✓
✓
Replacement planner
-
-
✓
✓
Vendors & contracts management
-
-
✓
✓
Budgets & financial views
-
-
✓
✓
Compliance management
-
✓
✓
✓
Administration
Capability
Requester
Staff
Manager
Admin
Invite / deactivate users
-
-
-
✓
Change user roles
-
-
-
✓
Manage user groups
-
-
-
✓
Organization settings (currency, categories…)
-
-
-
✓
Custom field definitions
-
-
-
✓
API keys & webhooks
-
-
-
✓
Import / export (organization-scale)
-
-
-
✓
Reading the matrix
Requester isolation is structural - the portal boundary can't be widened; requester groups organize requesters without expanding their access.
Need something between two roles? Pick the higher role and use user groups to keep the person's work scoped to their sites and trades.
API keys don't use this table. Machine access is governed by scopes - a deliberate separation.