Who can see and do what

Owner — everything, including billing and the ability to delete the organisation. There is always at least one, and the last one cannot be demoted.

Admin — everything except ownership transfer. Sees pay rates, invoices, exports and the Nursys screen.

Scheduler — builds rotas. Assigns, approves swaps and time off, runs reports. Deliberately cannot see pay rates, invoices, API keys or home addresses.

Staff — their own shifts, their own hours, their own credentials, and the parts of the schedule their colleagues can see.

Every tab is visible to every role on purpose, and a screen that is not yours says so in words rather than vanishing. A menu that changes shape by role is one where nobody can be told 'it's under Reports' over the phone.

The refusal is real, not cosmetic — the database returns nothing to the wrong reader regardless of what the page does.