Roles & Permissions

Every member of a Booked55 organization has one or more roles. Roles decide which pages someone sees and which records they can open. You give roles when you invite someone, and owners and managers can change them later.

The four roles

When you create an organization you get both Owner and Sales Person, so your own sales activity still counts on the Scoreboard.

Owner rules

• Only an owner can grant the owner role — That covers inviting someone as an owner (a manager who tries gets “Only an owner can invite someone as an owner.”) and adding Owner to an existing member (“Only an owner can grant the owner role or change an owner's roles.”).
• Only an owner can grant the manager role — A manager can't invite someone as a manager (“Only an owner can invite someone as a manager.”) or add Manager to an existing member.
• Managers change only Sales Persons and Operators — A manager can edit the roles of a member whose roles are only Sales Person and/or Operator, and only to those roles. They can't change an owner, another manager, or their own roles: “Only an owner can grant the manager role or change a manager's roles, including your own.”
• Managers remove the same members — A manager can remove exactly the members they can edit: those who are only Sales Person and/or Operator. Owners can remove anyone but themselves. See Removing users.
• Unless a role can do more than managers — If an owner turns on an action on the Permissions page for Operator or Sales Person but not for Manager, that role can now do something managers can't. From then on only an owner can invite someone with that role, give it to a member, or change or remove a member who has it: “This organization's permission settings give that role access managers don't have, so only an owner can grant, change or remove it.” Managers get it back as soon as Manager is selected for that action again, or the action's switch is turned off.
• There is always at least one owner — Booked55 refuses to remove the owner role from the last owner, or to remove the last owner from the organization: “Every organization needs at least one owner. Make someone else an owner first.” The last owner can't leave the organization either; they can make someone else an owner first, or delete the organization (the parent organization of a parent account is deleted by the Booked55 team on request instead).
• Account owners are managed by the parent account — In a team organization of a parent account, a member marked Account owner holds the Owner role through the account. Nobody can edit or remove that role inside the team organization, and they can't leave it: “This person owns the parent account, so their access to its team organizations follows the account. Change their role in the parent organization instead.” See An account owner's role is managed by the account.
• People added by the account are managed by the account — In a team organization of a parent account, a member marked Added by the account is a manager there because an account owner added them to that team. Nobody in the team can change their role or remove them, and they can't leave it. An account owner changes it on the account's People page. See Everyone in the account, and adding someone to more teams.
• You confirm it's you first — Before Booked55 removes a member, lets you leave an organization or deletes one, it asks for your authenticator code, your password, or (if you sign in with Google, Microsoft or Apple and have no authenticator app) a code it emails you. See Confirming it's you.

Changing someone's roles

1. 1

   Open Users

   In the sidebar, go to Workspace → Users.

2. 2

   Click the edit icon on the person’s row

   Its tooltip is "Edit user roles". The Edit User Roles window opens.

3. 3

   Tick the roles they should have

   A person can hold more than one role, for example Owner and Sales Person.

4. 4

   Click "Update Roles"

   The change applies straight away.

Owners and managers can change roles, under the owner rules above. A manager sees the edit icon only on the rows of members who are just Sales Person and/or Operator (not on their own), and their Edit User Roles window offers only Operator and Sales Person. Nobody sees it on the row of a member marked Account owner, whose role follows the parent account. Nobody in the team can change the role of a member marked Added by the account either: an account owner changes their teams on the account's People page. The AI assistant can also do it for you: it shows a confirmation card, and nothing changes until you click Confirm.

Managers and Operators must turn on two-factor authentication, so someone you make a Manager or Operator is asked to set it up before they can keep working. See When two-factor authentication is required.

The Permissions page

Owners can adjust the defaults above under Workspace → Workspace Settings → Advanced → Permissions. Managers can open the page but can't change anything on it.

Data Isolation

Data isolation decides whether members who are not owners or managers see everyone's records or only their own. It is on by default for every type, and each can be switched separately:

• Contacts — only contacts they created or are assigned to. Deals follow this setting.
• Companies — only companies they created or own.
• Tasks — only tasks assigned to them or that they created.
• Events — only events they created.
• Bulk Emails — only bulk emails they created.
• Templates — only templates they created.

Owners and managers always see all data, whatever these switches say.

Who can view, create, edit and delete

Below the Data Isolation and Data Export cards, the page lists actions for Contacts, Companies and Tasks, such as “Create Contact” or “Delete Task”. While an action's switch is off, every role can do it (the default). Turn it on and pick the roles that may; everyone else is refused. At least one role must stay selected.

Leave Manager selected wherever you select Operator or Sales Person. An action that Operators or Sales Persons may do and managers may not puts members with that role out of managers' reach (see Owner rules).

Who can export data

The Data Export card sits right under Data Isolation and has one switch, Export Data. It covers every way records leave Booked55 as a file: Export on the Contacts page, Export all contacts at the bottom of the Billing tab, Export CSV on a bulk email's contacts, and Export contacts (CSV) in the mobile app. While the switch is off, every role can export the records they can see (the default). Turn it on and pick the roles that may. Everyone else no longer has those buttons, and anyone who tries another way is told they don't have access. It changes only who can download a file. What people see on screen stays the same, and so does what they can read through the API or a connected AI app. To limit that, use Data Isolation and the View rows.

Owner is always selected on this row and can't be taken off: an owner can always export. The same advice about Manager applies. The choice also holds for API keys and connected AI apps, which act with the role of the person who made them. The AI assistant and the MCP server can't export a file at all.

Best practices

• Give the least access that works — Most of the team should be Sales Persons or Operators.
• Have two owners — A second owner keeps billing and settings reachable when one is away.
• Managers for team leads — Managers see the whole team's records and can use the global user filter to review each person's work.