Privileges reference

pro

Every permission in Apolaris AI, what it unlocks, and how managers, privilege admins, and franchise/HQ operators fit together.

This page lists every permission in Apolaris AI and what each one unlocks. Because every privilege lives in one place and applies consistently across the calendar, point of sale, reports, and the mobile app, you give people exactly the access they need without juggling spreadsheets, shared logins, or separate tools that each have their own rules.

Permissions are assigned per user. Set them in Users & privileges, and see Employees, users & permissions for how users, roles, and sites fit together.

How access works

Access is granular and per-privilege. Each permission is its own on/off switch on the user. There are no fixed, pre-baked role names — you build a person's role by ticking the boxes they need.

Three things shape what someone can do:

The manager flag (is_manager). A manager passes every granular privilege check below, unconditionally. There is no per-feature box a manager fails. (The only screens a manager still can't reach are platform-operator screens managed by Apolaris — see the note at the end.)
The individual privilege boxes. A non-manager needs the specific privilege for each action. Ticking "View customers" does not also grant "Edit customers"; each is separate.
Site visibility. Every action is scoped to the sites the person can see. See Site visibility below.

Managers bypass all granular privilege checks in management views. Grant is_manager to trusted leads and reserve the individual privileges for everyone else. Use the Users & privileges screen to see exactly what each person can do.

Roles in practice

Although access is per-privilege, three patterns recur often enough to be worth naming. None of these are flags by themselves except the manager flag — the rest are combinations.

Role	How it's defined	What it can do
Domain manager	`is_manager`	Full access across the organization and all its sites. Always counts as a privilege admin (`can_admin_privileges()` is always true for managers).
Privilege admin	`can_manage_privileges` (on a non-manager)	Add, edit, and remove user accounts and toggle other people's privileges — without being a full manager. Subject to the escalation guard (see below).
Franchise / HQ operator	`can_manage_material_requests` + `can_manage_loyalty` + `can_manage_discounts` (any or all)	Runs the headquarters side: curates the HQ catalog and central warehouse, configures the brand-wide loyalty program, and creates discount/promo codes.

There is no is_franchise or is_hq flag. "HQ operator" is simply the combination of the three can_manage_* privileges above, plus access to a central warehouse. See Material ordering and Loyalty program.

Privilege admin & the escalation guard

can_manage_privileges ("Manage Privileges") lets a non-manager administer user accounts and privileges — the entire Privilege admin role. They can create users, edit their privileges, and remove accounts, just like a manager would, but without full domain access to everything else.

To prevent someone from quietly promoting themselves, an escalation guard applies: a privilege admin cannot toggle the two protected flags — is_manager and can_manage_privileges. Only a real manager (or the Apolaris platform operator) can grant those. If a privilege admin submits the user form, any change to those two flags is ignored; every other privilege is saved normally.

Who is editing	Can grant ordinary privileges?	Can toggle `is_manager` / `can_manage_privileges`?
Manager (`is_manager`)	Yes	Yes
Privilege admin (`can_manage_privileges`, non-manager)	Yes	No — blocked by the escalation guard
Everyone else	No (no access to the user-management screens)	No

Delegating can_manage_privileges is powerful: that person can grant or revoke almost any other privilege for other users. The escalation guard stops them creating new managers or new privilege admins, but it does not stop them granting strong functional privileges (e.g. "Manage sales" or "Manage discounts"). Reserve it for trusted office/admin staff.

See Users & privileges for the step-by-step admin workflow.

Branch access

Site visibility decides which locations a user sees data for. It is not the same as the site-management privileges (can_*_site) further below — visibility controls what you can see and act in; the management privileges control whether you can create/edit/delete site records themselves.

The rules:

Managers see every site in the organization.
All branches (all_sites_access) gives a non-manager the same reach, including branches opened later. This is the default for a new user and the recommended choice: it is the only option that keeps working when you add a location.
Only selected branches limits the user to the branches you pick (visible_sites), combined with their linked employee's assigned sites. Branches created afterwards are not included — you have to come back and add them.

So a receptionist linked to one location can be given visibility into a second location by adding an explicit grant, without being made a manager.

Reach for "Only selected branches" when a person genuinely must not see the others — a franchisee, or a location with separate ownership. If the goal is just "give them what they need", All branches plus narrow action privileges is easier to keep correct: the failure mode of the enumerated list is silent (someone quietly stops seeing a new branch and reports it as a bug), while the failure mode of a missing action privilege is loud and obvious.

See Organizations & sites and Switching sites.

Customers

Privilege	What it unlocks
Add customers (`can_add_customer`)	Create new customer records.
View customers (`can_view_customer`)	Open the customer list and individual profiles.
Edit customers (`can_edit_customer`)	Update customer details, notes, and contact info.
Delete customers (`can_delete_customer`)	Remove customer records permanently.

See Customers.

Bookings & calendar

Privilege	What it unlocks
Add bookings (`can_add_booking`)	Create new appointments.
View bookings (`can_view_booking`)	See appointment details and history.
Edit bookings (`can_edit_booking`)	Change time, service, staff, or status.
Delete bookings (`can_delete_booking`)	Cancel and remove appointments.
View whole-site schedule (`can_view_site_schedule`)	See every employee's appointments at the sites the user can access (e.g. a receptionist), not just their own. Off by default.
Drag appointments to reschedule (`can_drag_appointments`)	Drag an appointment card to a new slot to reschedule (and reassign across staff). Off by default; requires "Edit bookings".

See Appointments & calendar.

Sales & point of sale

Privilege	What it unlocks
Add sales (`can_add_sale`)	Ring up a sale at the point of sale.
View sales (`can_view_sale`)	See sales records and receipts.
Edit sales (`can_edit_sale`)	Modify existing sales.
Delete sales (`can_delete_sale`)	Remove sales records.
Manage sales (`can_manage_sales`)	Broader sales control, including corrections and overrides. Applying a discount code at checkout rides on this privilege, so cashiers who redeem codes need it.

A sale touches more than the till: it draws down inventory, can earn loyalty points, and feeds the analytics dashboards. A discount applied at checkout lowers the net sale amount, which is the figure reports count — so deleting or editing sales has knock-on effects on stock, loyalty balances, and your P&L. Restrict delete/edit to trusted staff.

See Sales & point of sale and Discount codes.

The service catalogue (treatments, durations, prices) has the full add/view/edit/delete set of separate privileges.

Privilege	What it unlocks
Add services (`can_add_service`)	Add new treatments to the menu.
View services (`can_view_service`)	Open the service-management area and see the menu.
Edit services (`can_edit_service`)	Change a service's name, duration, or price.
Delete services (`can_delete_service`)	Remove a service from the menu.

Employees (team directory)

The team directory likewise has a full add/view/edit/delete set.

Privilege	What it unlocks
Add employees (`can_add_employee`)	Create new employee records.
View employees (`can_view_employee`)	Open the team directory and employee records.
Edit employees (`can_edit_employee`)	Update an employee's details.
Delete employees (`can_delete_employee`)	Remove employee records.

Editing employee privileges and user accounts is governed by the Privilege admin role (can_manage_privileges), not by these directory privileges. See Privilege admin & the escalation guard.

Sites (location records)

These privileges control managing the location records themselves. They are distinct from site visibility, which controls which locations a user can see.

Privilege	What it unlocks
Add sites (`can_add_site`)	Create a new site (location).
View sites (`can_view_site`)	Open the sites list and site records.
Edit sites (`can_edit_site`)	Change a site's details.
Delete sites (`can_delete_site`)	Remove a site record.

Reports & data

Privilege	What it unlocks
View reports (`can_view_reports`)	Open Analytics dashboards.
Export reports (`can_export_reports`)	Download reports as CSV, Excel, PDF, or Word.
Use data explorer (`can_explore_data`)	Use the Data Explorer to build custom deep-dive reports. Data stays scoped to the user's visible sites.

See Analytics & Data Explorer.

Settings

Privilege	What it unlocks
Manage settings (`can_manage_settings`)	Access organization and module configuration. See Organization settings.

Turning whole modules on or off is managed by Apolaris as part of your plan, not self-served from this screen. Contact support to enable or disable a module.

Material ordering (franchise / HQ)

Privilege	What it unlocks
Order material from HQ (`can_order_material`)	Place material requests from the HQ catalog for the sites the user can see.
Manage material requests (`can_manage_material_requests`)	The HQ-operator side: curate the orderable catalog, control central-warehouse stock, and approve/ship incoming site orders ("franchise view").

See Material ordering. can_manage_material_requests is one of the three privileges that make up the Franchise / HQ operator role.

Loyalty

The loyalty program is tier- and points/visits-based. There are two distinct privileges: a site-side one for day-to-day use and an HQ-operator one for configuring the program.

Privilege	What it unlocks
Use loyalty program (`can_use_loyalty`)	Site side: enroll customers, award and adjust points, and redeem rewards at the counter.
Manage loyalty program (`can_manage_loyalty`)	HQ-operator side: configure the program, tiers, and reward catalog for the whole brand ("loyalty HQ view"). One of the three Franchise / HQ operator privileges.

See Loyalty program.

Discounts

Privilege	What it unlocks
Manage discount codes (`can_manage_discounts`)	Create discount/promo codes and read the impact report ("HQ operator"). One of the three Franchise / HQ operator privileges.

Redeeming a discount code at checkout does not need this privilege — it rides on "Manage sales". This privilege is for creating and reporting on codes.

See Discount codes.

Vacation & leave

Privilege	What it unlocks
Request vacation (`can_request_vacation`)	Submit time-off requests.
Approve vacation (`can_approve_vacation`)	Review and approve or reject leave requests.
View vacation calendar (`can_view_vacation_calendar`)	See who is off and when across the team.

See HR: team, leave & documents.

Employee workspace (Caja / portal)

Privilege	What it unlocks
Use the POS (`can_use_pos`)	Lets the user open the POS workspace ("Caja"). Additive: they still land in the CRM after signing in and keep every other privilege they hold.
POS only — no CRM access (`pos_only`)	Locks the user to the POS. The CRM is closed to them and they land at the till after signing in. Requires "Use the POS"; on its own it does nothing, so a stray tick can never leave someone with no workspace at all.
View own earnings (`can_view_own_earnings`)	See personal commission and bonus progress in the portal. On by default.
Submit expenses (`can_submit_expense`)	Log business expenses for approval from the workspace.
Use contact center (`can_use_ccaas`)	Use the contact center (CCaaS) inbox for the user's site — typically a receptionist.

See Employee workspace (Caja).

Contact center (build side)

Answering the inbox rides on can_use_ccaas (above). These configure what the AI does before a human sees the conversation.

Privilege	What it unlocks
Configure workflows & automations (`can_manage_ccaas_settings`)	The workflow rules, automations and reply templates behind the inbox.
Build conversation flows (`can_manage_ccaas_flows`)	Design the conversation and call flows the AI agent follows.
Manage the knowledge base (`can_manage_knowledge_base`)	The documents the AI answers from. What goes in here is what customers get told.
Send broadcasts (`can_send_broadcasts`)	Send a message to many customers at once.

See Contact center.

Voice & telephony

Privilege	What it unlocks
See calls & recordings (`can_view_voice_calls`)	Call history, transcripts, recordings and voice usage.
Manage telephony (`can_manage_voice`)	Buy and route phone numbers, and tune the voice agent. Implies seeing the calls.

AI & automation

Privilege	What it unlocks
Use the AI assistant (`can_use_assistant`)	Ask the assistant questions and let it act — always within this user's own privileges.
Approve what the AI proposes (`can_approve_ai_actions`)	Review the queue of actions the AI wants to take and approve or reject them.
Manage automations & insights (`can_manage_ai_automations`)	Set up recurring AI automations and the insights feed.
See the AI activity log (`can_view_ai_activity`)	The audit trail of everything the AI has done in this organization.
Send customer messages without confirming (`can_copilot_autosend`)	The AI sends customer-facing messages immediately instead of queueing them for a Confirm click. Manager-granted only.

Cameras & vision

Privilege	What it unlocks
Watch cameras, arrivals & incidents (`can_view_cameras`)	Live views, the event stream, entrances and exits, incidents and connection status — for the user's branches only.
Configure cameras, zones & detection (`can_manage_cameras`)	Add cameras, draw zones and tune detection. This changes what the system watches and alerts on. Implies watching them.

See Cameras.

Marketing & growth

Privilege	What it unlocks
View / create / edit / delete customer journeys (`can_*_customer_journeys`)	The lifecycle journey builder. Outward sends still route through the approval queue for non-managers.
Manage the public website (`can_manage_website`)	The public site, its pages and the marketing studio.
Manage booking links & settings (`can_manage_online_booking`)	The public booking page, its links and QR codes, and the rules behind them.
View competitor intelligence (`can_view_competitors`)	Nearby competitors, their ratings and prices.

People (HR sub-areas)

Privilege	What it unlocks
Manage attendance & clock (`can_manage_attendance`)	The attendance clock, check-in / check-out corrections and the attendance dashboard.
Manage work schedules (`can_manage_schedules`)	Weekly rotas, shifts, and meal & break rules.
View payroll (`can_view_payroll`)	Read payroll runs and payslips.
Run payroll (`can_manage_payroll`)	Run payroll and edit its inputs. Implies viewing it.
Manage HR documents (`can_manage_hr_documents`)	Contracts, policies and the rest of the document library.

Money & analytics

Privilege	What it unlocks
View / manage expenses (`can_view_expenses`, `can_manage_expenses`)	The expense ledger and its dashboard.
View billing & usage (`can_view_billing`)	The subscription, add-ons and metered usage for this organization. Read-only.
Manage stock & catalog (`can_manage_inventory`)	Stock levels, categories, items, imports and stock templates.
View the analytics dashboard (`can_view_analytics`)	The analytics dashboard and its reports.

Tips

Start narrow. Grant the minimum each person needs, then add privileges as responsibilities grow.
Use the manager flag for leads instead of ticking dozens of boxes, and keep granular privileges for front-desk and specialist staff.
"View" without "edit" or "delete" is great for people who need visibility but should not change records.
Start from a privilege template on the permission form — your organization's saved roles (by default Employee (basic), Technician, Receptionist, Branch manager, Office administrator, Finance, Contact center agent, Telephony admin, Marketing, Analyst, Clinical practitioner and Camera operator, plus any you create). Each one is a starting point, not a fixed role — apply it, then adjust. See Privilege templates.
Related privileges are linked. Ticking "Drag appointments to reschedule" ticks "Edit" on bookings for you, and clearing a parent clears the children it would strand, so you cannot save a grant that does nothing.
Front-desk staff often only need Use the POS plus the workspace privileges, keeping them focused and the rest of the system locked down. Add POS only if they should not reach the CRM at all.
Delegate can_manage_privileges to an office admin if you want user-management handled below manager level — the escalation guard keeps them from promoting anyone (including themselves) to manager.

Not sure who can do what? The Users & privileges screen shows each user's permissions at a glance, so an audit takes minutes instead of an afternoon of cross-checking notes.

Platform-operator screens (the kind that span multiple organizations, manage global secrets, or tear down a tenant) are operated by Apolaris and never appear in your organization, regardless of any privilege above. Your organization's data and users are fully under your managers' control.

For definitions of other terms, see the Glossary and the FAQ & troubleshooting page.