Role-based permissions across the shop

Give each person the actions and information their work requires.

SlabOS documents separate Read, Create, Update and Delete grants where offered, along with Full control and broader application access. Drawing-only views, quote prices, cost/margin information, files and integrations have distinct requirements.

The important question is the actual action a role can perform, not just the role’s name. Crew access does not automatically provide inventory access; granting a send action does not connect a mailbox; running QuickBooks sync is distinct from configuring integrations. Owner and administrator behavior also has explicit rules that need to be preserved in an access matrix.

Inputs, outputs and an example to evaluate

Inputs: User responsibilities, assigned roles and applicable account restrictions.

Outputs: Access appropriate to the user's permitted work.

Compare a synthetic estimator and crew account performing their respective tasks, including an action each should not be able to perform.

Scope to understand

Hiding a section or choosing a saved view is not an authorization test. Validate the actual action and record scope.

Public capability guides and product sources

• Role-based access for countertop shop teams
• Office users, employees and crew access

Published by SlabOS. Documentation review: September 15, 2026. Basis: Public product and operating documentation. This article is a workflow explanation, not a newly performed product test.

Related workflows

Explore all 39 features · Evidence register