# Roles

## Tenant roles

| Role | What they do |
| --- | --- |
| Owner | Everything, including billing, team, and deleting the organisation |
| Admin | Customers, sites, jobs, worksheets, scheduling, quotes, POs |
| Dispatcher | Jobs and worksheets. No customer or site management |
| Engineer | Assigned jobs, status, own worksheets, photos, risk assessment |
| Viewer | Read only |

Every new feature is gated three ways: Stripe entitlement, tenant role, and a Laravel policy. The UI hides what you cannot use. The policy still enforces it.

## DoorOps staff

Support, Billing, Admin, Manager. `is_super_admin` overrides all of those. Staff work in the platform admin, not inside your tenant sidebar as a fake user, except when impersonation is explicitly started and audited.

## Audit

Creates, updates, deletes, restores, permission changes, impersonation, schedule moves, job-lock overrides, and customer-facing sends are written to the audit log.