Who can see and do what

Everyone who signs in to MedAligna holds one of four roles: owner, admin, scheduler or staff. In this video you'll see what each one can do, invite someone with the right role, see exactly what a scheduler is refused, and then change a role and remove someone's access safely. Roles live in Settings, under Team. Everyone who can sign in is listed under People who can sign in, each with their role and a line saying what that role does. A role is set when someone is invited, and can be changed here later. The owner can do everything an admin can, plus two things nobody else can: make someone else an owner, and require two-factor sign-in for owners and admins. There's always at least one owner, and the last one can't be demoted or removed, which is why Jordan's row is fixed. An admin runs staff, settings, rules, billing and the team: inviting people, changing roles and removing access, locations and work rules, the subscription and invoices, API keys and webhooks, credential requirements per role, Nursys details, and the activity log. An admin can't appoint an owner. A scheduler builds and publishes the schedule: creating, assigning and moving shifts, posting open shifts, approving swaps and time off, keeping the roster, and running reports and hours exports. A scheduler can't invite people, change anyone's role, change rules or settings, or see invoices, API keys or the activity log. Staff see their own shifts, swaps, open-shift claims, time off, the time clock, their own credential wallet and calendar link, and the published schedule, read-only. Nothing about anybody else's pay, contract or paperwork. To invite someone, scroll up to Invite somebody else. First, say who they already are on the roster. Omar Haddad is on it, so pick him, and his email fills in. He keeps every shift already assigned to him. For someone who isn't on the roster yet, choose New person. Then choose the role. Staff is the default; Scheduler and Admin are next. Owner only appears in this list for an owner, because nobody else can appoint one. Omar is a nurse, so he stays as Staff. Press Create invitation. It's emailed to him, and the link is also shown here, once, in case you'd rather send it yourself. It works once, only from the mailbox it was sent to, and expires after fourteen days; if it's lost, invite again. And because one login belongs to one organization, someone already in another organization can't accept with that same login. Here's the product signed in as Nina, our scheduler. Every tab is visible to every role, on purpose, so anyone can be told it's under Settings over the phone. Settings opens for her, but says plainly that changing it is an owner's or an admin's job. A screen that isn't hers says so in words, with the reason, instead of vanishing. API keys and webhooks are kept to owners and admins. The refusal is real, not cosmetic: the database itself returns nothing to the wrong reader, and every change that grants authority is re-checked there too. Billing shows her where the organization stands and who to ask. What it pays, and every invoice, stays with owners and admins. Her own shifts and the time clock never depend on this page. Back as the owner. To change someone's role, choose the new one beside their name and press Save. It applies from their next page load. Here, Maya becomes a scheduler. Two changes are refused, in words: only an owner can choose Owner, and the last owner can't be demoted. So to hand over the organization, make the new person an owner first, because an organization with no owner can't appoint one later. When someone leaves, press Remove access. It deletes their login and nothing else: they stay on the roster, on every shift they've worked, so the equity report and the hours export still add up. Confirm with Remove access. One last owner-only control lives under Security: require two-factor sign-in for every owner and admin. Set up your own authenticator first, or turning it on would lock you out. Schedulers and staff aren't affected. That's roles covered: four of them, each with a clear job; invitations that go to exactly one person; refusals that explain themselves; and access you can change or remove without losing a single shift of history.