Roles and permissions
Give each person the access their job needs, by role and, on Growth and above, by site.
Agoo is in early access. This page describes the feature as it ships to early-access organisations; screens are illustrative.
Everyone who signs in to Agoo has a role. The role decides what they can see and do; on Growth and above, it can also be limited to particular sites. Front desk, hosts, security and admins each see only what their role and site allow.
See what each role can do in Console → Settings → Roles, and give people roles in Console → People.
Built-in roles
| Role | Typical person | Uses | Can |
|---|---|---|---|
| Owner | The account holder | Console, Workspace | Everything, including billing, transferring ownership and closing the organisation. One per organisation. |
| Admin | IT, facilities or office manager | Console, Workspace | Everything except changing the plan, paying, ownership and closing the organisation: people, sites, devices, forms, branding, notifications |
| Site admin | Branch or site manager | Console, Workspace | Sites, gates, devices, people and roles, visitors, bookings, attendance, vehicles and roll calls at their own sites (Growth and above). Forms, branding, notifications, billing and data settings stay with Owners and Admins |
| HR | HR and payroll | Console, Workspace | People's records, attendance everywhere, leave, timesheets and the payroll export (Pro and above). Not billing, security, settings, visitors or the audit trail |
| Finance | Whoever pays and reconciles | Console, Workspace | Pays expense claims, advances and payroll payments as those arrive. Sees names, sites and departments only: no HR records, numbers, accounts or pay. Given only by the Owner |
| Receptionist | Front desk | Console, Workspace | Check visitors in and out, invite visitors for any host, see the on-site list, log parcels and hand them over (and print badges, when that arrives), start an emergency alert and mark people safe or missing in a roll call |
| Security lead | Head of security | Console, Workspace | Everything a receptionist can do, plus manage the watchlist, run roll calls (drills, and ending them), see the audit trail for their sites, see who signed in at the gate and see a visitor's full ID number (with a reason, recorded) |
| Guard | Gate security | Kiosk (guard mode), Workspace | Scan passes, check people in and out at the gate, log vehicles and parcels, call or WhatsApp hosts, start an emergency alert and mark people safe or missing in a roll call |
| Host | Anyone who receives visitors | Workspace, Console | Invite their own visitors, approve or decline arrivals, manage their bookings |
| Employee | Staff on attendance | Workspace | Clock in and out, see their own attendance, shifts and leave, ask for leave, and claim open shifts and swap shifts (Growth and above) |
| Auditor | Internal audit or compliance | Console (read-only) | Read reports, the visit history and the audit trail |
Each person has one role. Agoo shows the roles in this order everywhere: Owner, Admin, Site admin, HR, Finance, Receptionist, Security lead, Guard, Host, Employee, Auditor.
An Employee who also receives visitors can be given the Receives visitors switch in Console → People, so they can invite guests and approve arrivals. Kiosks don't use roles: each kiosk, in the app or in a computer's browser, is paired to a site as a device and can only do kiosk tasks. Owners and Admins decide whether kiosks in a browser are allowed, in Console → Settings → Security.
On a device in guard mode, people whose role works the gate (Owner, Admin, Site admin, Security lead, Receptionist, Guard) sign in with their name and their own PIN, and so can anyone with Works the gate turned on in Console → People, account or not. What they do at the gate is recorded in their name. See Signing in at the gate.
Emergency alerts and roll call (Starter and above): Settings → Roles lists three permissions.
| Permission | Roles |
|---|---|
| Start an emergency alert | Owner, Admin, Site admin, Security lead, Receptionist, Guard |
| Mark people safe or missing in a roll call | Owner, Admin, Site admin, Security lead, Receptionist, Guard |
| Run roll calls: drills, and ending them | Owner, Admin, Site admin, Security lead |
To stop receptionists and guards starting alerts, turn off Receptionists and guards can start an emergency alert in Console → Settings → Security → Emergency alerts. It's on by default, because they're often the first to see a fire or a threat. See Roll call.
WhatsApp replies from visitors: Owners, Admins, Site admins, Security leads and Receptionists have Answer WhatsApp messages: they read and answer every visitor's WhatsApp conversation at their sites. Hosts answer their own visitors and guests, unless your organisation turns that off; then they read and add notes, and reception answers. Each reply counts as a WhatsApp message, and on the Free plan nobody in your organisation sends: you read the conversations and Agoo's team answers. See WhatsApp replies.
Who a visit is for: Owners, Admins and Site admins make and change teams (People → Teams) and set whether a person's walk-ins go through their office; Owners and Admins set each visitor type's rules for who visitors may see. Owners, Admins, Site admins, Security leads and Receptionists do the front desk's work on a waiting visitor at their sites, in the Console or on the Workspace app's Desk: ask someone, write down an answer, take the visit, hand it over, book the visitor in for another time or turn them away. So can the person or team a waiting visitor was passed to, whatever their role, for that visit only. A Host, or an Employee who receives visitors, adds colleagues to their own invitation and invites for a team they're in; they find colleagues who receive visitors at their own sites, by name, job title and department. See Who a visit is for.
Vehicles at the gate: Guards log vehicles in and out; Owners, Admins, Site admins and Security leads can too, and they also manage known and barred vehicles and whether guards photograph each vehicle. Receptionists and Auditors see the register. See Vehicles at the gate.
Deliveries: Owners, Admins, Site admins, Receptionists, Security leads and Guards see the parcels at their sites, log them, hand them over, correct them and send them back; Auditors see them and change nothing. Hosts and Employees see their own parcels and their teams', with each collection code. Owners and Admins hold Change the deliveries settings: couriers at kiosks and the drop-off poster, what collecting takes, reminders, who gets a parcel nobody is named for, and reading labels with AI. See Deliveries.
Feedback from visitors: Owners and Admins set up surveys, posters and Settings → Feedback; Site admins see the results and follow up low scores for their sites; Auditors can read the results. Hosts see feedback about their own visits only if your organisation turns that on (Growth and above). See Feedback.
Public reviews on Agoo Reviews: Owners, Admins, Site admins and Auditors see your page in Feedback → Public reviews: when it opens, its branches, its score and its reviews. Owners and Admins choose its category, opt in where your kind of place asks, ask Agoo about a site that's secure, someone's home or not open to the public, and set up review invitations, the forwarding address and the branches with the review tools. Owners, Admins and Site admins reply to reviews, flag them, draft replies with AI, send review invitations and message a reviewer who allowed it, through Agoo (Site admins for their own sites). Everyone who sees the page reads its insights and makes widgets, and whoever manages or sends invitations makes the review poster. Nobody, whatever their role, can hide, edit or reorder a review. See Agoo Reviews and Review invitations and tools.
Guest and staff Wi-Fi
Settings → Roles lists four Wi-Fi permissions. Each works at the person's sites, and on Growth and above a role limited to sites sees only their networks.
| Permission | Roles |
|---|---|
| See the Wi-Fi at their sites (never a password) and who was given guest Wi-Fi | Owner, Admin, Site admin, Receptionist, Security lead, Auditor |
| Change the Wi-Fi: turn guest and staff Wi-Fi on or off, and add and change networks, passwords and terms | Owner, Admin, Site admin |
| See a stored Wi-Fi password (each time recorded) | Owner, Admin, Site admin |
| Give a checked-in visitor the guest Wi-Fi at the desk | Owner, Admin, Site admin, Receptionist, Security lead |
The two switches, the terms and the password reminders are for the whole organisation, so only Owners and Admins change them; a Site admin changes networks whose sites are all theirs. Staff need no permission to use a staff network: being among the people it's shared with is enough. Agoo support never sees a Wi-Fi password, even with emergency access. On Pro, custom roles will be able to hold any of the four when custom roles arrive. See Guest and staff Wi-Fi.
HR and line managers
HR is a built-in role on every plan, for the people who keep staff records, leave and timesheets. Without it, organisations had to make their HR team Admins, which hands them billing, security and settings too.
| HR can | HR can't |
|---|---|
| Add and change people in Console → People, including their manager and employment details, and keep their HR records, departments and positions, and job changes | Give or change anyone's role, or invite people to sign in |
| See and manage attendance at every site: Today, Daily hours, timesheets, the review queue, voiding, extra time, and rosters with their imports, open shifts, swaps and records of consent (Growth and above) | Change billing, security, organisation settings or privacy |
| Set the attendance rules and work-rule sets, including overtime, the leave year and how timesheets are approved | See visitors, the watchlist, roll calls or the audit trail |
| Keep leave: leave types, recording and ending leave, balances and adjustments, certificates and the year end | Export the whole organisation's data |
| Approve any step of a timesheet, send it back, reopen an approved one with a reason and move a period's payroll date; on Pro and above, make and download payroll files and set the pay codes and payroll layouts | |
| Clock in, see their own time, receive visitors and take bookings, like anyone else | |
| Choose who approves leave, swaps and claims for open shifts, decide any step of one, and name a deputy for anyone |
- Who can give the HR role: Owners and Admins. A Site admin can't give it, or change the role of someone who has it, because HR approves timesheets and makes payroll files for the whole organisation, which a Site admin can't.
- It isn't an admin seat. HR doesn't count towards your plan's admin seats.
- On Growth and above you can limit HR to some sites, like any role. HR limited to sites can't change the organisation's attendance rules, pay codes or payroll layouts, and makes and sees payroll files for its own sites only.
- Receives visitors is on by default for HR, as it is for hosts.
Line managers aren't a role. When you set someone's manager on their page in Console → People, that manager can see the people who report to them, directly or further down the line, whatever role the manager has. A person's page in People shows who they report to and their team; their team's punches, shifts and leave follow on Attendance → Today and on the Team tab of the Workspace app. Managers approve their own team's leave, extra time and timesheets, in the app or the Console, never their own. Private kinds of leave, such as sick or maternity leave, show to a manager only as Away. While a manager is away, a deputy they name, or their own manager and then HR, decides their leave requests. See Line managers and HR.
On Pro, custom roles will be able to hold HR's payroll permission when custom roles arrive.
HR records
Three permissions in Settings → Roles cover HR records, on every plan:
| Permission | Roles |
|---|---|
| Read HR records: personal and employment details, contacts, job history and change requests, never a full number | Owner, Admin, HR |
| Keep HR records: change them, keep departments and positions, and apply or decide changes to people's jobs | Owner, Admin, HR |
| See full statutory numbers and pay account numbers, giving a reason each time | Owner, HR |
- Admins keep records but never see a full number. Only the Owner and HR do, and each time is recorded with its reason.
- HR limited to sites (Growth and above) keeps the records of people at its sites; departments, positions and the People and HR settings stay with those who work across the whole organisation.
- Line managers see their people's job and job history, and propose changes to it, through being their manager, never their personal details, contacts, numbers or accounts.
- Everyone sees their own record in My record.
- Agoo's support team never opens an HR record, even with access to your organisation.
- Connected apps and API keys use the
hr:readandhr:writescopes (Pro and above), and never see a number or a contact.
HR documents
Four permissions cover documents, on every plan:
| Permission | Roles |
|---|---|
| Read people's documents: contracts, letters, licences, certificates and their expiry dates | Owner, Admin, HR |
| Read restricted documents: identity documents and disciplinary letters, each opening recorded | Owner, HR |
| Read health documents: health documents and police clearance, each opening recorded | HR |
| Keep the documents vault: add, replace, change and remove documents, and set up document types | Owner, Admin, HR |
- Health documents are HR's alone, not even the Owner's, because health and alleged offences are special personal data under the Data Protection Act.
- Line managers see a standard document only when its type lets them, never a restricted or health one.
- Everyone sees and adds their own in My record.
- Agoo's support team never opens a document.
- Connected apps and API keys use the
documents:readanddocuments:writescopes (Pro and above), for standard documents only.
Finance
Finance is a built-in role on every plan for whoever pays and reconciles: expense claims, cash advances and payroll payments, as each of those arrives in Agoo. Until then it holds what everyone holds for themselves: your organisation and its sites, their own attendance, leave, visits and parcels, forms and uploading files.
- Only the Owner gives it, changes it or takes it away, because it releases money. Admins, Site admins and HR can't, and neither can Agoo's support team.
- It sees no HR records, statutory numbers, pay accounts or pay: payments use the accounts inside Agoo, never on screen.
- It isn't an admin seat, like HR.
- Handing over ownership: an Owner who transfers the organisation can keep the Finance role.
On Pro, custom roles will be able to hold the HR records permissions when custom roles arrive.
Admin seats
The number of admin seats depends on your plan: 1 on Free, 3 on Starter, 10 on Growth, unlimited on Pro, and unlimited with delegated administration on Enterprise.
What each plan adds
| Plan | Roles |
|---|---|
| Free and Starter | Basic: the built-in roles, applying across the whole organisation |
| Growth | Per site: limit any role to particular sites, so a Tema Branch receptionist sees only Tema Branch |
| Pro | Custom roles: copy a built-in role and switch individual permissions on or off. Planned. |
| Enterprise | Approval chains: leave and timesheets approved in up to five steps of your own, such as the line manager, their manager, then HR (now). Visits that need several sign-offs, such as host, then security, then facilities, with time limits and escalation, are planned. |
Give someone a role
Open Console → People
Find the person, or add them. Staff can also come from a CSV import.
Choose their role
Choose their role. On Growth and above, choose All sites or pick the sites the role applies to.
Save
The change takes effect straight away: if they're using Agoo, it catches up on their next click. Agoo emails them about it, and the change, with who made it, is recorded in the audit trail.
Good practice
- Keep Owners and Admins few. Give people the narrowest role that lets them do their job.
- Use two-step verification for everyone with admin access.
- Remove access on the day someone leaves. Deactivate them in Console → People; when SCIM provisioning arrives (planned, see single sign-on), it will happen automatically when they leave your directory.
- Review roles every quarter. Filter Console → People by role to check who has admin access.