# Roles capability matrix

> The default capability-by-role table - what Administrator, Manager, Staff, and Requester can each do out of the box.

Source: https://app.assetlab.ca/docs/reference/roles-matrix

What each role can do. Roles are hierarchical - every ✓ for Staff is implicitly a ✓ for Manager and Administrator. Capabilities are fixed per role; [user groups](/docs/manage/roles-and-permissions) scope *which* sites and work a person handles, never *what* they can do.

## Everyday operations

| Capability | Requester | Staff | Manager | Admin |
|---|---|---|---|---|
| Submit a work request (portal) | ✓ | ✓ | ✓ | ✓ |
| Track own requests (portal) | ✓ | ✓ | ✓ | ✓ |
| View assets, sites, buildings | - | ✓ | ✓ | ✓ |
| Create / edit assets | - | ✓ | ✓ | ✓ |
| Create / complete work orders | - | ✓ | ✓ | ✓ |
| Execute PM work & fill forms | - | ✓ | ✓ | ✓ |
| Consume parts, record costs | - | ✓ | ✓ | ✓ |
| Triage & convert work requests | - | ✓ | ✓ | ✓ |
| See organization members (for assignment) | - | ✓ | ✓ | ✓ |

## Planning & oversight

| Capability | Requester | Staff | Manager | Admin |
|---|---|---|---|---|
| Projects (view, create, manage) | - | - | ✓ | ✓ |
| Reporting & report builder | - | - | ✓ | ✓ |
| Replacement planner | - | - | ✓ | ✓ |
| Vendors & contracts management | - | - | ✓ | ✓ |
| Budgets & financial views | - | - | ✓ | ✓ |
| Compliance management | - | ✓ | ✓ | ✓ |

## Administration

| Capability | Requester | Staff | Manager | Admin |
|---|---|---|---|---|
| Invite / deactivate users | - | - | - | ✓ |
| Change user roles | - | - | - | ✓ |
| Manage user groups | - | - | - | ✓ |
| Organization settings (currency, categories…) | - | - | - | ✓ |
| Custom field definitions | - | - | - | ✓ |
| API keys & webhooks | - | - | - | ✓ |
| Import / export (organization-scale) | - | - | - | ✓ |

## Reading the matrix

- **Requester isolation is structural** - the portal boundary can't be widened; requester [groups](/docs/manage/roles-and-permissions) organize requesters without expanding their access.
- **Need something between two roles?** Pick the higher role and use [user groups](/docs/manage/roles-and-permissions) to keep the person's work scoped to their sites and trades.
- **API keys don't use this table.** Machine access is governed by [scopes](/docs/reference/scopes) - a deliberate separation.

## Related

- [Roles & access](/docs/start/roles-and-access) - the narrative version
- [Roles & user groups](/docs/manage/roles-and-permissions) - group setup and routing