Access Control lets you decide what each user role can see and do in HQ. For every rule, such as "Can delete Reservations", you choose whether a role is allowed, denied, or doesn't decide.

<aside> 💡

Note - The Administrator role has full access to the system. Access Control rules never apply to administrators, and this can't be changed.

</aside>

How Access Control Works

Each user has one or more user roles. Each role has its own set of rules, and each rule has one of three values:

• Allow - the role can do it.
• Deny - the role can't do it, unless another role of the same user allows it.
• Not Set - the role doesn't decide. HQ looks at the user's other roles, and if none of them decides, it uses the rule's default.

When A User Has More Than One Role

HQ checks every role of the user, in this order:

1. If any role says Allow, the user is allowed. One Allow is enough, even if other roles say Deny.
2. If no role allows it and any role says Deny, the user is denied.
3. If no role sets the rule, HQ uses the rule's default.

The Default When No Role Decides

• Most rules are allowed by default. If you want to block them, set them to Deny.
• Some rules need an explicit Allow. Users can't do them until one of their roles is set to Allow. This includes every Settings page and sensitive actions such as booking reservations in the past, setting a reservation to rental with an outstanding balance, or overriding pick-up and return time limits.

The Access Control Rules List shows the default of every rule.

Example

A user has two roles, "Counter Agent" and "Night Shift":