Put the right people on the right work.

Use role definitions that match real field and office responsibilities so permissions reflect how work actually gets done.

• Owner — company-wide access, billing, team management
• Admin — org operations and settings control
• Manager — project management, financials, cross-team coordination
• Sales — client pipeline, cost database, estimates, takeoffs, proposals
• Crew Leader — dispatch, time approval, field operations
• Laborer — clock-in, assigned tasks, limited write
• Viewer — read-only access where permitted

Keep tenant boundaries strong with multiple safeguards so data integrity does not depend on a single protection point.

• Application safeguards enforce organization scoping
• Request checks keep users in the correct tenant context
• Database protections add another isolation layer
• Sensitive operations are protected by multiple checks
• Data remains separated across organizations
• Isolation protections are enforced in production

Keep AI assistance useful and safe by matching available actions to each user’s permission scope.

• Tool availability follows role permissions by work type
• Write actions require human confirmation before committing
• Hank never silently modifies data — every change is reviewed
• Permission scope updates are reflected quickly for AI tool access
• Org-scoped data access for assistant workflows

Protect high-stakes records during team collaboration with lock behavior and visibility into concurrent activity.

• Estimate locks automatically on proposal send
• Lock protections enforced across critical write paths
• Realtime presence on estimate detail pages
• Self-approval blocked on time entries (compliance win)
• Audit trails on every stage transition