Permission Matrix Deep Dive
Appello's permission system provides granular control over what each user role can access, organized into 19 categories on the Basic Permissions tab (18 permission categories plus the Active Permissions quick view). This guide explains the permission structure, gives illustrative example role configurations, and covers scope-based data restriction.
Permission Architecture
Appello uses a role-based access control (RBAC) model:
User → Role → Permission Matrix → Access Decision
Every user is assigned exactly one role. The role's permission matrix, configured on Settings → Roles & Permissions, determines their access to every feature, module, and (where Field-Level Permissions is enabled) data field across the platform.
How a Permission Item Works
On the Basic Permissions tab, each permission category (see below) breaks down into permission items — for example, under CRM, Companies and Contacts are each a permission item. A permission item is a named group of one or more underlying actions with a single toggle; the action groups that exist vary by item. Commonly seen groups include:
| Group name (examples) | What it covers |
|---|---|
| View | See the records. |
| Create/Edit | Add new records or modify existing ones. |
| Archive/Delete | Archive, delete, or restore records. |
| Approve/Reject | Domain-specific approval actions (e.g. timesheets, equipment time entries). |
Some items add domain-specific groups beyond these — for example Companies also has a View Company Lifetime Value group, and Timesheets (mobile) adds groups like Manual Time Entry Override and Override Trade Level. Some categories (such as parts of Settings Access) show a single all-or-nothing toggle with a + button that expands finer sub-permissions.
Many permission items also carry a scope (see below) that restricts which records the toggle applies to.
Field-Level Permissions is different
The Field-Level Permissions tab (also on a role's edit page) is a separate, gated feature. Where it's enabled, it shows a real View / Edit / Delete grid, scoped per field, for a specific model you pick from a dropdown: Projects, Jobs, Companies, Contacts, Departments, Users, Expenses, Equipment, Estimate/Change Order, Invoices, or RFIs. Selecting Equipment also lets you pick an Equipment Category and configure that category's attributes. On an instance where the feature is not enabled, the tab shows a message directing you to contact your Appello Rep instead of the grid.
See Roles & Permissions for the full page walkthrough, including the Assign Users to Role and Duplicate features on a role's edit page.
Permission Categories
| Category | Contains permission items for |
|---|---|
| Default Application | Restricting a user to the mobile app only. |
| Settings Access | Accounting, Business Settings, Document Template, Download Template, Human Resources, Instance Settings, Integrations, Locations, Mobile Settings, Notification Settings, Property Settings, Roles and Permissions, and API Credentials. |
| System Related | Property Model Form Overrides, Audit Trail, Sensitive Form Data, Sensitive User Data, and Map (Beta). |
| Mobile Application | Jobs, Schedules, Timesheets, Timesheet Expenses, Form Submission History, Clock In/Out, Certifications, and Work Order Checklist, all on the mobile app. |
| Workforce | User, User Groups, and Department. |
| CRM | Companies and Contacts. |
| Operations | Projects, Jobs, Work Orders (pricing visibility and sharing only — standard job CRUD lives under Jobs), Job Material Specification, and Request For Information. |
| Signatures | Requesting and managing signatures on work orders and other records. |
| Equipment | Equipment, Equipment Rates, Equipment Time Entry, Maintenance Thresholds, and Maintenance Schedule. |
| Inventory Management | Stock locations, per-location inventory levels, and the movement ledger (receive, checkout, transfer, adjust). |
| Scheduling | Job Schedule and User Schedule (daily/user scheduling). |
| Forms | Form Management (desktop), Form Inbox (submission review), and Form Submission Administration (desktop + mobile). |
| Training and Certifications | Certification Types, User Certifications, and Training Providers. |
| Finance & Admin | Timesheet Matrix & Timesheet Log, Clock In & Out, Expenses, Vacation/Leave, Financial Summary, Purchase Orders, Invoices, Progress Reports, and Billing Templates. |
| Sales | Estimates and Change Orders. |
| Communications | Notes and Policy Documents. |
| File Management | Files, Document Folders, and Onboarding Document Packages. |
| Dashboard Metrics | Financial Metrics shown on the dashboard. |
| Reports | Sales, Operations, Health and Safety, Workforce Administration, and Custom Report. |
There is no category or domain named "Accounts Payable," "Accounts Receivable," "Budget vs Actual," or "QuickBooks Sync" in the permission matrix. The Finance & Admin category's actual domains are listed above.
Permission Scopes
Where a permission item supports scoping, its toggle carries one of these levels:
| Scope shown in the UI as | What it restricts the user to |
|---|---|
| All | Every record, instance-wide. |
| Own | Only records the user owns or created. |
| Department | Only records tied to the user's own department. |
| Direct Reports | The user's own records plus their direct reports'. |
| Project Based (Assigned Projects Only) | Only records under projects the user is assigned to. |
| For Scheduled Jobs | Only records tied to jobs the user is scheduled on. |
| Shared | Records explicitly shared with the user. |
| None | No access — the permission is effectively off. |
Not every permission item offers every scope in this list — the set of scopes available on a given toggle depends on that specific item. This page could not confirm from the product a general rule for which items expose which subset; check the scope dropdown on the specific permission item in Roles & Permissions to see what it supports. See also the note on this in Departments.
Example Role Configurations
The role names and access levels below are illustrative examples only — they are not roles that ship with the product (see Default Roles for what actually seeds) and not a recommendation to name your roles this way. Every category and action-group name used here exists in the permission matrix as described above.
Example: "Admin" (Full Access)
All permission items enabled, scoped to All, across every category. This is how the product's own seeded Admin role is configured.
Example: "Project Manager"
| Category | Illustrative access |
|---|---|
| Operations | View, Create/Edit, and Archive/Delete on Projects and Jobs. |
| Scheduling | Job Schedule enabled. |
| Finance & Admin | Financial Summary and Invoices enabled, Purchase Orders left off. |
| CRM | View and Create/Edit on Companies and Contacts. |
| Reports | Operations and Sales reports enabled. |
| Settings Access | Left off entirely. |
Example: "Field Supervisor / Foreman"
| Category | Illustrative access |
|---|---|
| Operations | View plus Create/Edit on notes-adjacent items only. |
| Scheduling | Job Schedule (View only). |
| Finance & Admin | Timesheet Matrix & Timesheet Log enabled for approving crew hours. |
| Forms | Form Submission Administration enabled. |
| Mobile Application | Jobs, Schedules, Timesheets, and Certifications enabled. |
| Finance (rest) | No access. |
| Settings Access | No access. |
Example: "Field Worker"
| Category | Illustrative access |
|---|---|
| Mobile Application — Schedules | View only. |
| Mobile Application — Timesheets | Submit own time. |
| Mobile Application — Work Order Checklist | Create/Edit/Archive assigned items. |
| Everything else | No access (mobile-only role). |
Best Practices
- Start from a built-in role — Duplicate Admin, Field Supervisor, or Field Worker (see Roles & Permissions) and adjust from there.
- Use scoping instead of "All" — Prefer Department, Direct Reports, or Project Based scope over All where the permission item supports it, so users only see what they need to.
- Use the Active Permissions view to audit — It's a real quick-view of every permission currently enabled for the role, and is the fastest way to review a role's full grant.
- Test with a real user — After configuring a role, sign in as (or ask) a user with that role to confirm the experience matches what you intended.
Related Pages
- Roles & Permissions — Role list, the permission editor, Field-Level Permissions, and Duplicate.
- Departments — Department structure for the Department permission scope.