Boyoti
Concept1 min read·Updated Nov 2, 2026

Roles and permissions explained

How access is gated: modules, actions, 'own vs all' scopes, and the built-in roles.

Requires permission agency.roles.view
On this page

Every action in Boyoti is checked against a permission of the form module.action — for example leases.create, payments.void or payroll.pay. A role is a named set of permissions; each user has one role. Menus, buttons and API calls are hidden or refused when the permission is missing, so the UI you see is exactly what you may do.

Scopes: own vs. all

Several modules have both view and view_all. With only view, an agent sees the leads, viewings, leases, invoices, tasks and commissions where they are the assigned agent; view_all opens the whole agency. The same applies to data in reports.

Built-in roles

RoleTypical use
OwnerAgency owner — everything, including billing and plan. Cannot be deleted.
ManagerEverything operational, all records, approvals; no plan/billing changes.
AccountantBilling, payments, cheques, accounts, expenses, payroll pay; read-only on leasing.
Leasing agentOwn leads/viewings/leases, contacts, listings; record payments.
Sales agentOwn leads, reservations, sale contracts, commissions view.
MaintenanceMaintenance requests (work/resolve), vendors, inventory moves.
ViewerRead-only across the agency — for auditors or owners' representatives.

Built-in roles are updated by Boyoti when new features arrive; duplicate one to customise it.

Plan gating sits above permissions: a permission for a feature your plan does not include is simply inactive.

Was this article helpful?

Related articles

Create a custom roleHow-toBuild a role with exactly the permissions a job needs, then assign it to users.1 min readInvite your team and assign rolesHow-toAdd users, pick a role for each, and understand what the built-in roles can do.1 min readThe audit logConceptWho changed what and when — every create, edit, delete, void, login and export is recorded.1 min read