Roles and permissions | Asphalt OS wiki

How access works

Everyone has one role. A role is a list of permissions.
Some permissions have a scope: whose records they cover. "Their own" (only their own leads), "Their crew" or "Everyone".
Some have a limit: a dollar amount (the biggest estimate someone can send without approval) or a percentage (the biggest discount).
Each role has a rank. People can only manage people and roles ranked below them.
An exception allows or blocks one permission for one person, on top of their role.

The database checks these rules on every read and every change. Hiding a button is only a convenience; the rule holds even if someone finds a way around the screen.

The eleven default roles

Every new company starts with these roles. Change them, add your own, or give one person an exception. See Your own roles and exceptions.

The default roles
Role	In short
CEORank 100, lands on the Dashboard	The owner role. Every permission, now and in future. It can't be restricted, and the company always keeps at least one person in it.
Asphalt OS staffRank 90	The Asphalt OS team, invited when your company is set up so we can help you connect your outside services. They can change API keys and company settings, and nothing else. Only Asphalt OS puts anyone into this role; your CEO can take anyone out of it, or out of the company, at any time: it is your data.
VP OperationsRank 80, lands on the Dashboard	Runs the crews, the schedule, equipment, incidents, driver compliance and support. Sees the money, manages people and roles.
VP SalesRank 80, lands on the Dashboard	Runs estimating and pricing. Sends and approves estimates up to $250,000 and gives discounts up to 15%. Manages people and roles.
ControllerRank 70, lands on the Dashboard	Invoices and payments, bills, job money and closing jobs, company settings and imports. Sees leads but doesn't work them.
Office managerRank 50, lands on the Dashboard	Phones, the shared inbox, estimates up to $25,000, scheduling, invoices, bills, paperwork and support.
EstimatorRank 30, lands on My day	Measures and prices their own leads. Sends estimates up to $15,000 and gives discounts up to 5%.
DispatcherRank 30, lands on My day	The schedule, trucks and loads, equipment, incidents and driver compliance. Takes calls, but doesn't see the pipelines.
Intake VARank 25, lands on My day	Logs, sizes, tiers and routes new leads, works the shared inbox and books quote visits. No pricing.
ForemanRank 20, lands on My day	Their crew's jobs on the phone: address, scope, access notes and contacts. Records loads, files inspections and manages incidents. No prices.
Crew memberRank 10, lands on My day	Their crew's schedule and today's jobs, truck loads, vehicle inspections, incident reports and their own expenses. No prices.

What each role can do

A tick means the role has the permission. Where a permission covers only some records, the cell says whose. Where it has a limit, the cell shows the most it allows. The wording is the same as on the Roles screen. On a phone, slide a table sideways to see every role.

Sales: what each default role can do
Permission	CEO	Asphalt OS staff	VP Operations	VP Sales	Controller	Office manager	Estimator	Dispatcher	Intake VA	Foreman	Crew member
See leads, customers and estimates	Everyone	No	Everyone	Everyone	Everyone	Everyone	Their own	No	Everyone	No	No
Take calls and create leads	Yes	No	No	Yes	No	Yes	Yes	Yes	Yes	No	No
Tier and route new leads	Yes	No	Yes	Yes	No	Yes	No	No	Yes	No	No
Work the shared inbox	Yes	No	No	No	No	Yes	No	No	Yes	No	No
Measure properties on satellite	Yes	No	No	Yes	No	Yes	Yes	No	Yes	No	No
Create and edit estimates	Yes	No	No	Yes	No	Yes	Yes	No	No	No	No
Send estimates to customers	No limit	No	No	Up to $250,000	No	Up to $25,000	Up to $15,000	No	No	No	No
Approve other people's estimates	No limit	No	No	Up to $250,000	No	No	No	No	No	No	No
Give discounts	No limit	No	No	Up to 15%	No	Up to 5%	Up to 5%	No	No	No	No
Change the price list	Yes	No	No	Yes	No	No	No	No	No	No	No
Text and email customers	Yes	No	Yes	Yes	No	Yes	Yes	Yes	Yes	No	No
Book quote appointments	Yes	No	No	Yes	No	Yes	Yes	No	Yes	No	No
See phone calls, recordings and transcripts	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes	No	No
Upload call recordings and edit transcripts	Yes	No	Yes	Yes	No	Yes	No	No	Yes	No	No
Delete phone calls and their recordings	Yes	No	Yes	Yes	No	Yes	No	No	No	No	No
Import customers from a spreadsheet	Yes	No	No	No	Yes	Yes	No	No	No	No	No
Comment on leads, jobs and tickets	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes

Operations: what each default role can do
Permission	CEO	Asphalt OS staff	VP Operations	VP Sales	Controller	Office manager	Estimator	Dispatcher	Intake VA	Foreman	Crew member
See the schedule	Everyone	No	Everyone	Everyone	No	Everyone	No	Everyone	No	Their crew	Their crew
Assign crews and dates	Yes	No	Yes	No	No	Yes	No	Yes	No	No	No
See today's quotes and jobs	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Enter load tickets	Yes	No	Yes	No	No	No	No	Yes	No	Yes	No
Record truck loads at the plant and on site	Yes	No	No	No	No	No	No	Yes	No	Yes	Yes
See load tickets and the truck cycle	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes	No	No	No
See asphalt plants and equipment needs	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes	No	Yes	No
Add plants and manage equipment needs	Yes	No	Yes	No	No	No	No	Yes	No	No	No
Manage equipment and service	Yes	No	Yes	No	No	No	No	No	No	No	No
See equipment, meters and service	Yes	No	Yes	Yes	Yes	Yes	No	Yes	No	Yes	No
Log meters and service and take units out of service	Yes	No	Yes	No	No	No	No	Yes	No	No	No
Report incidents and see your own	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Manage incidents and assign solvers	Yes	No	Yes	No	No	No	No	Yes	No	Yes	No
File vehicle inspections and see your own driver file	Yes	No	No	No	No	No	No	No	No	Yes	Yes
Manage driver compliance and driver files	Yes	No	Yes	No	No	No	No	Yes	No	No	No
See support tickets	Everyone	No	Everyone	Everyone	Everyone	Everyone	Everyone	Everyone	Everyone	Their crew	No
Open, assign and close support tickets	Yes	No	Yes	No	No	Yes	No	No	No	No	No
See subcontracted jobs and their margins	Yes	No	Yes	Yes	Yes	Yes	No	No	No	No	No
Subcontract jobs and manage sub jobs	Yes	No	Yes	No	Yes	Yes	No	No	No	No	No
Send job paperwork (COI, W-9, contracts)	Yes	No	Yes	No	Yes	Yes	No	No	No	No	No
See vendors and subcontractors	Yes	No	Yes	Yes	Yes	Yes	No	Yes	No	No	No
Add and edit vendors and subcontractors	Yes	No	Yes	No	Yes	Yes	No	No	No	No	No

Money: what each default role can do
Permission	CEO	Asphalt OS staff	VP Operations	VP Sales	Controller	Office manager	Estimator	Dispatcher	Intake VA	Foreman	Crew member
See job costs and margins	Yes	No	Yes	Yes	Yes	No	No	No	No	No	No
See job income, costs and margins	Yes	No	Yes	Yes	Yes	Yes	No	No	No	No	No
Enter job transactions and close jobs	Yes	No	No	No	Yes	No	No	No	No	No	No
See what we pay and the win or loss on a quote	Yes	No	Yes	Yes	Yes	Yes	Yes	No	No	No	No
See invoices	Yes	No	Yes	Yes	Yes	Yes	No	No	No	No	No
Create and send invoices	Yes	No	No	No	Yes	Yes	No	No	No	No	No
Record payments and release retainage	Yes	No	No	No	Yes	No	No	No	No	No	No
See bills and payroll totals	Yes	No	Yes	No	Yes	Yes	No	No	No	No	No
Enter bills and mark them paid	Yes	No	No	No	Yes	Yes	No	No	No	No	No
Submit expenses for reimbursement and see your own	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Approve expenses and see everyone's	Yes	No	Yes	No	Yes	Yes	No	No	No	No	No
See reports and the investor pack	Yes	No	Yes	Yes	Yes	No	No	No	No	No	No
See marketing numbers: what a lead and a job cost per channel	Yes	No	Yes	Yes	Yes	Yes	No	No	No	No	No
Type marketing spend	Yes	No	No	No	Yes	Yes	No	No	No	No	No

Admin: what each default role can do
Permission	CEO	Asphalt OS staff	VP Operations	VP Sales	Controller	Office manager	Estimator	Dispatcher	Intake VA	Foreman	Crew member
See the company dashboard	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes	No	No
See and assign everyone's tasks	Yes	No	Yes	Yes	No	Yes	No	No	No	No	No
Manage people and their exceptions	Yes	No	Yes	Yes	No	No	No	No	No	No	No
Create and edit roles	Yes	No	Yes	Yes	No	No	No	No	No	No	No
See the audit log	Yes	No	Yes	Yes	Yes	No	No	No	No	No	No
View full Social Security numbers	Yes	No	No	No	Yes	No	No	No	No	No	No
Change company and sign-in settings	Yes	Yes	No	No	Yes	No	No	No	No	No	No
Change API keys and outside connections	Yes	Yes	No	No	No	No	No	No	No	No	No
Change automations, SLAs, tiers and routing	Yes	No	No	No	No	No	No	No	No	No	No
Import and migrate data	Yes	No	No	No	Yes	No	No	No	No	No	No
Ask Asphalt about the business	Yes	No	Yes	Yes	Yes	No	No	No	No	No	No
See the decision playbook and log decisions	Yes	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Write and edit playbook rules	Yes	No	Yes	Yes	No	No	No	No	No	No	No

The Roles screen also lists a few permissions for screens that are not in Asphalt OS today, such as the live map and payroll hours. They are left out of these tables.

Things worth knowing

Automations can only be changed by the CEO in a new company. Everyone else who can open the page sees it read-only.
Estimators see only their own leads.
The Controller can look at leads but can't move them or add notes.
What the company pays for materials is behind its own permission, "See what we pay and the win or loss on a quote". The Intake VA, the Dispatcher and the crews don't have it. See Why crews never see prices or costs.
The dollar and percent limits are starting numbers. Change them on the role, or for one person with an exception.
A quote over the sender's limit, with a changed standard price, or with any discount, needs approval first. See Estimates, proposals and approvals.
Import customers from a spreadsheet is its own permission: the CEO, the Controller and the Office manager in a new company. Merging two customers is for the people who add and change customers, not the Controller. See Customers.
View full Social Security numbers (the Controller in a new company) reveals a colleague's number for 10 seconds after the password again; every reveal goes into the history log and alerts the owners. See The Team & security page.