How roles and permissions work in Staffintra

A short explanation of the role hierarchy and what each level can actually do.

Staffintra uses a layered role model. Higher roles include everything below them, and permission checks happen in layers: what the platform allows, what your workspace subscribed to, what your department can access, and what your role permits.

Follow these steps to find the practical answer:

1. Understand the hierarchy, top to bottom: platform_superadmin → platform_admin → tenant_owner → tenant_admin → tenant_user. Within a workspace, the practical levels are Staff (tenant_user), Administrator (tenant_admin), and Owner (tenant_owner).

2. Staff clock in, manage their own tasks/profile, submit timesheets and leave, and read what they're given access to.

3. Administrators add all of that plus approvals, payroll, users, departments, settings, and reporting.

4. Owners add the highest workspace powers: promote owners, connect a custom domain, and manage billing decisions.

5. Platform admins operate across every workspace — tenants, plans, and releases — from /admin.

6. For a specific question ("who can do X?"), open Settings > Access Control and check the permission catalog, or read Who can manage an app's access.