Roles and permissions
What owners, admins, staff and viewers can open and change, how limits to one business work, and how the Activity log shows who did what.
Every person on a workspace has one of four roles: owner, admin, staff or viewer. The role decides which pages open and what you can change. Each higher role can do everything the one below it can. A role belongs to one workspace, so you can be an owner in one and a viewer in another.
Note: The console hides pages your role cannot use, but hiding is not what stops you. The server and the database rules refuse the action too, even if someone finds the address.
What each role can open and change
| What | Viewer | Staff | Admin | Owner |
|---|---|---|---|---|
| Read invoices, estimates, recurring invoices, clients, payments, jobs, bills and reports | Yes | Yes | Yes | Yes |
| Create and change invoices, estimates, clients and bills; send; record a payment | No | Yes | Yes | Yes |
| Time, Expenses, Mileage, Rebill and Import | Not shown | Yes | Yes | Yes |
| Approvals | Not shown | Requests to send, attach files, add contacts or delete their own entries | Yes | Yes |
| Make payment links; void or refund a payment; void an invoice; credit notes and write-offs | No | No | Yes | Yes |
| Open Settings, Team, Connections, Webhooks, Activity, Businesses, Merchant accounts and AI agent | Not shown | Not shown | Yes | Yes |
| Change Messaging and Payments in Settings: the sender name and reply address, text messages, and payment gateway credentials | No | No | Yes | Yes |
| Change the General, Branding and Security tabs of Settings; change the plan; buy AI credits; delete the workspace | No | No | No | Yes |
An admin can open Settings. On General, Branding and Security the fields are switched off for an admin, and a note says only the owner can change them. An admin can change Messaging and Payments. Entering gateway credentials there also needs the second settings password, and going live is refused until the credentials pass the self-test. See Get your merchant account approved.
Everyone, viewers included, can open Your account, Notifications, Pay page, Templates and Plan & usage. On Pay page, Templates and Plan & usage a viewer changes nothing. On Your account and Notifications a viewer changes only their own settings. A viewer cannot open Settings, Team, Connections or Activity.
For a staff member, Approvals shows what they may decide: requests to send or resend documents and messages, attach files, add contacts, renew or revoke a payment link, and delete time, expense and mileage entries. Voids, merges, publishing, anything that moves money and any change to settings need an admin or owner. See Approve requests on your phone. Voids and refunds are covered in Refund or void a payment.
Limit someone to some businesses
An owner or admin can limit a person to some of the workspace's businesses with Limit to businesses on the Team page. A limited person works only in those businesses. The rules apply to every role. The Export tab and statements under Reports are not narrowed by this limit: they cover the whole workspace, so do not rely on the limit to hide figures from someone who can open Reports. A limited admin cannot void, refund, credit or write off in another business. They also cannot add a business, because a business they create would be one they could not see. See Invite your team and set roles.
Who did what: the Activity page
Activity is open to owners and admins. It lists the changes BillingMart records that a person, an API key, a connected app or BillingMart itself made in the workspace, newest first. Some small changes are not recorded, such as drafts of templates and pay pages and the onboarding checklist. Nothing on it can be edited. Filter by People, Connected apps, API keys or BillingMart, and open a row to see what changed.
- The person comes from their sign-in. The server records who acted from the verified sign-in, never from anything typed into the request. For an approved Agent request, the person who approved it is shown.
- Edits made straight from a device. When a team member changes time, expenses, mileage, bills, invoice notes or estimates this way, a background step records who changed it and which fields. It records the field names, not the values.
- Export CSV downloads the history, up to 50,000 events, on any plan. On some plans the page itself shows only recent history, and a banner says how far back it goes.
Changing and removing roles
A role change reaches a person's sign-in within the hour. Refresh my access on Your account applies it at once. Lowering a role, or removing someone, signs them out of every device. A workspace always keeps at least one owner. Customers are never members. They reach their own records through the customer portal. See Verified contacts and why a send is blocked.
Related articles
- Invite your team and set rolesHow to invite someone to your workspace, what each role can do, and how to change a role, limit access to one business, or remove them.
- Turn on two-step verificationAdd an authenticator app as a second sign-in step on the web, iPhone or Android, and learn when BillingMart asks for the code.
- Sign-in sessions and devicesStay signed in for 30 days on a device you choose, see and forget remembered devices, sign out of every device, and choose how long Confirm it's you waits.
- Approve requests on your phoneHow an Agent or assistant request reaches your phone, what the app shows, what it asks you to confirm, and which links open the app.
- Refund or void a paymentWhen to void and when to refund a card payment, who can do it, what you are asked to confirm, and what happens to the invoice and your customer.
- Get your merchant account approvedHow to apply for your BillingMart Merchant Account, what you need, what the statuses mean, and how it goes live once approved.