Documentation › Staff & HR

Roles and permissions

Everyone gets the pages their day needs. The rest — the books, the phone system, the settings — stays with administrators unless you tick a box to let someone in.

Last updated 12 October 2026

At a glance

  • There are two roles: Admin, who can do everything, and User.
  • Every user has the day-to-day pages — the dashboard, the dial pad, their own voicemail and the hotel desk.
  • Admin areas are opened one by one, per person, with a tick.
  • Changes apply at once. A demoted admin loses access on their next click.
  • You can sign anyone out of the Windows app from the same page.

On this page:

  1. The two roles
  2. The areas you can grant
  3. Give someone an area
  4. Make someone an admin
  5. Sign-ins and signing out
  6. Who should have what
  7. Questions

1The two roles

Admin

Every area, always. Manages people, settings, the subscription and the bill. Not listed in the permissions grid, because there is nothing to grant.

The owner and whoever runs the system

User

The day-to-day pages, plus any admin areas you have ticked for them personally.

Everybody else

The idea is simple: only the admin areas are locked. A receptionist can take calls, check a guest in and listen to their voicemail on day one, without anyone setting a permission.

Signing in at all is a separate switch. Someone added without Can sign in to this web interface has no access to grant — see Let them sign in.

2The areas you can grant

Staff & Extensions

Add and edit people, departments, extensions, handsets and phone provisioning.

Phone System

Trunks, gateways, routing, caller-ID masking, feature codes and call-control rules.

Accounting

The books: invoicing, ledger, day book, purchases, payroll and statements.

Stock & Stores

Stores, stock tracking, recipes, issues, wastage and physical counts.

Front Desk

Rooms, bookings, check-in and check-out, guest folios, wake-up calls and the desk tills.

Restaurant manager

Cancel food already cooking, discounts above the limit, comps, bill voids, menu and floor setup. Includes the Front Desk and managing every till.

Service Connectors

Outside services, CRMs, databases, mail, payment gateways and registering card machines.

SMS & Auto Dialer

SMS providers and templates, and the automatic outbound dialer.

Call Records & Logs

Call records for every extension, the TV wallboard and the system log.

System Settings

Appearance, modules, office hours, the firewall and voicemail defaults.

Machine Administration

Backup and restore, updates, network, health, support and first-time setup.

You see only the areas your business runs: Front Desk is listed for a hotel and Restaurant manager for a restaurant — a business with neither sees neither.

3Give someone an area

  1. Open Tune up → Permissions. You must be an admin.
  2. Find the person. Each is shown with their name and extension.
  3. Tick the areas they should have. Untick to take one away.
  4. Click Save on their row.
  • A grant belongs to the person, not to a job title. Two cashiers can hold different areas.
  • Restaurant manager brings Front Desk with it.
  • The Permissions page itself can never be granted — only an admin decides who gets what.

4Make someone an admin

  1. Open Office → Employees and click the pencil on the person’s row.
  2. Change Role from User to Admin and save.

The foot of the Permissions page lists every administrator, so you can always see who has full access.

Keep admins few. An admin can see salaries, change the subscription and remove people. For most managers, a couple of ticked areas is the right answer.

5Sign-ins and signing out

Access is checked on every page, not only at sign-in — so what you change takes effect straight away:

You change somethingA role, a password, or you remove the person
Their sessions endEvery browser they are signed in on
They sign in againwith the new role — or cannot, if removed
Nobody keeps yesterday’s access because a browser was left open.

Under Windows app sign-ins, the Permissions page lists each person signed in to the Windows app, with when they signed in and when they were last seen. Click Sign out to end one — for a lost laptop or someone who has left.

6Who should have what

PersonRoleAreas to tick
Owner, general managerAdmin— everything already
Accountant, bookkeeperUserAccounting; Stock & Stores if they value stock
Front office managerUserFront Desk; Staff & Extensions
Restaurant managerUserRestaurant manager
StorekeeperUserStock & Stores
IT or phone technicianUserPhone System; Staff & Extensions
Receptionist, waiter, agentUserNone — the day-to-day pages are enough

7Questions

Someone says a page is “not permitted”.

It is in an admin area they have not been granted. Tick that area for them on Permissions, or do the task yourself.

Can staff see each other’s voicemail or call records?

A user reaches their own voicemail. Call records for every extension are in Call Records & Logs, which is an admin area you grant deliberately.

The person I want is not in the grid.

Either they are an admin — listed at the foot of the page — or they have no sign-in. Add a sign-in for them on Employees first.

Can a user grant permissions to others?

No. Only admins can open the Permissions page, and it cannot be granted.

Does taking away an area delete anything they did?

No. Their invoices, vouchers and bookings stay exactly as they are. They simply cannot open that area any more.

Open by default where it is safe, locked where it matters

New staff are productive on day one, and your books, your phone lines and your settings stay with the people you chose. One page shows who can do what.

  • Two rolesAdmin and user — nothing to learn.
  • Per personTick only the areas each one needs.
  • ImmediateChanges apply on the next click.

What to do next

If your people handle cash, set up their drawers: Open, hand over and close a till.

Still stuck?

Write to support@filantis.com with your workspace name and what you were trying to do.