Set Up Permissions Your Way: by User, Group or Location

Someone on your team can see something they shouldn't, or can't see something they need. You can fix it yourself in a few minutes, once you know how NextCrew decides.

That's a permission set and checked. Everything below is for when you're planning who should see what, or when someone sees the wrong thing.

Why it matters

• Clients trust you when their rates and their Crew's details are seen only by the people who need them.
• Crew stay loyal when their SSN, birthdate and pay are kept private.
• Your team builds relationships when each person sees what they need for their job, without wading through screens that aren't theirs.

Where it usually breaks

• Everyone shares one login, so you can't give different people different access.
• A rule set for one person months ago quietly overrides the change you just made for their role.
• A Global switch is changed to fix one person, and it changes everyone.
• Permissions are changed and never tested, so the first person to notice is the one who can suddenly see pay rates.
• Someone leaves and their login stays on.

The two kinds of permissions

The three levels for records and fields:

• Write: they can see it and change it.
• Read: they can see it but not change it. For SSN, Read shows only part of the number.
• Deny: they can't see it.

Which setting wins

NextCrew checks settings in this order, and the more specific setting wins:

"Location" here means your own office locations, the branches you set up in Settings › Company Profile › Locations. Each office user has an office location on their user record.

The rule of thumb: set the usual case in Global, and use the narrower scopes only for the exceptions. The fewer narrow rules you have, the easier it is to know why someone sees what they see.

Pick the right scope

Roles are labels from your Admin Roles list, added to each person on their user record. A role on its own doesn't grant access. Access comes from the permissions you set for that role. See Add an Office User.

Common goals, step by step

Hide pay and bill rates from a role.

1. Go to Settings › Permissions and open the Role tab.
2. In the Add New row, choose the role and the field to protect, such as Pay Rate or Bill Rate.
3. Choose the office location it applies to, and set the level to Deny.
4. Do the same for Rate Markup if that role shouldn't work out your margin either.
5. Sign in as a test user with that role and open a Crew Member and an order to check.

Keep each office to its own records.

1. On the Role tab, add a rule that denies the role access to all office locations.
2. Add a second rule that grants the role access to its own office.
3. Check that each user has the right Office Location on their user record, since that's what the rule follows.
4. Test with one user from each office.

Give one person an exception.

1. Leave the role or group rule as it is.
2. Open the User tab and add a rule for that one person.
3. Don't change a Global switch to fix one person. That changes it for everyone.

Protect SSN and birthdate.

1. Decide who truly needs them, usually the people who run payroll and onboarding.
2. Set SSN and Birthdate to Deny, or to Read if they need to confirm part of the number.
3. Give Write only to the people who enter or correct them.

Control a screen or an action.

1. Open the System tab.
2. Choose the scope, such as Role Permissions or Group Permissions.
3. Turn the screen or action on or off for that scope.

Fields you can protect

• Pay Rate and Bill Rate
• Rate Markup
• SSN and Birthdate
• Office Location
• Workers Comp Code
• User Rating and Crew Review
• Assignment Status, and the Order, Job and User Internal ID

Test it before your team does

• Keep a test user for each role you set rules for.
• After any change, sign in as that test user and open the screens and records the change touches.
• Check both sides: what they should now see, and what they should no longer see.
• If something looks wrong, use the Permission Hierarchy icon. It shows which permission applies on the screen you're on. It appears once Allow Viewing Permission Hierarchy is turned on for you.

Who can manage admin users and permissions

• By default, only the master admin can open Settings › Permissions. To let another admin manage permissions, turn on Allow Admin to Manage Permissions for them.
• By default, only the master admin can add, change or disable office users. To let someone else manage them, give them the permission Allow Company Profile Page Manage Admin Users.
• Keep both to as few people as you can. Anyone who can change permissions can give themselves more access.

Keep it tidy

• Every person has their own login. No shared accounts.
• When someone leaves, open their record in Settings › Company Profile › Admin Users, add a Termination Date and turn on Disabled, on their last day. Their history is kept.
• Once a quarter, run through Is Your Agency Secure? A 2-Minute Security Checklist, and look over your User tab rules. Remove any exceptions nobody needs anymore.

A worked example

An agency with two offices sets up its rules. An example, not a real agency.

• The goal. Recruiters shouldn't see bill rates. Each office should see only its own Crew and clients. One senior recruiter covers both offices.
• Step 1. On the Role tab, the admin denies Bill Rate and Rate Markup to the Recruiter role.
• Step 2. On the Role tab, she denies the Recruiter role all office locations, then adds a rule granting each recruiter's own office.
• Step 3. On the User tab, she grants the senior recruiter access to the second office.
• Step 4. She signs in as a test recruiter from each office and checks a Crew Member, a client and an order.
• The result. Three rules for the whole team, and one exception that's easy to find later.

You're set up when…

• ☐ Every person on your team has their own login.
• ☐ You've decided who needs pay rates, bill rates, SSN and birthdate, and set them.
• ☐ Each office user has the right office location on their record.
• ☐ Exceptions are set on the User tab, not by changing Global.
• ☐ You have a test user for each role with rules, and you test after every change.
• ☐ Only a few people can manage permissions and admin users.
• ☐ Departing staff are disabled on their last day.

If something isn't working

Questions people ask

Does giving someone a role give them access? Not on its own. A role is a label. Access comes from the permissions you set for that role in Settings › Permissions.

What wins if a person's role says Deny and their user rule says Read? The user rule. The more specific setting always wins: Global, then Role, Location, Group, User.

Can I see why someone can see a field? Yes. Turn on Allow Viewing Permission Hierarchy for yourself, and use the Permission Hierarchy icon on that screen.

Can I stop one office from seeing another office's Crew? Yes. Deny the role all office locations, then grant its own office.

Who can add new office users? The master admin, plus anyone given Allow Company Profile Page Manage Admin Users.

Do Crew or clients use these permissions? This guide is for your office users. Crew sign up themselves, and client users get access from their client record.

Other ways people ask this

• How do I hide pay rates from recruiters?
• How do I stop a branch from seeing another branch's data?
• Why can this user see SSNs?
• How do I give one person extra access?
• Who can add users in NextCrew?
• How do I set up roles and permissions?

Related guides

• Control What Each Person Can See and Do: Permissions · Users and Permissions: Start Here · Add an Office User
• Set Up Groups · Add Your Office Locations · Is Your Agency Secure? A 2-Minute Security Checklist