# Roles explained

What each built-in role can see and do, from tenant administrator to engineer, and when to make your own.

A person can have more than one role. Roles can apply to the whole company or to one branch.

| Role | Typically for | Can |
|---|---|---|
| **Tenant administrator** | The owner | Everything, including settings, users and billing |
| **Operations manager** | Office or service manager | Run the whole operation: jobs, planner, quotes, invoices, contracts, stock and purchasing, certificates (including voiding them), and all reports. Can view settings |
| **Dispatcher / planner** | Planners and coordinators | Enquiries, jobs, the planner and dispatch, raise quotes, operational reports. Can view stock and purchase orders |
| **Service desk** | Whoever answers the phone | Log enquiries and jobs, look at the planner, raise quotes |
| **Estimator** | Surveyors and estimators | Write quotes and see costs and margins |
| **Accounts** | Finance | Invoices, payments, credit notes, financial and stock reports, and matching supplier invoices |
| **Stock controller** | Stores | Parts, stock locations and vans, transfers and stock takes, suppliers and purchase orders (including approving other people's), stock reports |
| **Engineer** | Field engineers | Their own visits, in the engineer app only |
| **Auditor (read-only)** | Accountants, auditors | See everything, change nothing |

Office roles (dispatcher, service desk, estimator, accounts) can see certificates; voiding one needs the operations manager or administrator.

Built-in roles can't be changed. To choose permissions yourself, open **Settings → Roles & permissions** and select **New role**.

Hiding a button isn't the only protection: Sustainable ERP checks every action on the server, so a person can never do something their role doesn't allow.