Team members, roles and access

Settings

Settings

Team members, roles and access

Everyone sees what they need, and nothing more.

The problemGiving a colleague access is all or nothing, so you either share too much or spend your day answering requests.

The resultInvite people with a role that fits, define your own roles, and give outsiders access to chosen records only.

Book a demo
Tap a number to read what that part shows.

What you can do

  • Invite a person by email to one business, or to the whole account, with a role and a language
  • Resend or revoke a pending invitation
  • Change a member's role, or remove them from the business
  • Read what each built-in role can do, area by area
  • Create your own role from a list of permissions, and delete it again
  • Give a person access to specific records only, such as named properties or bookings, or only the jobs assigned to them
  • Take access away from a grant immediately by revoking it

How it works

  1. Invite a person

    Open Team and choose Invite member. Enter the email, pick the business, the role and the language of the invitation. They get a secure link to join, with no password to set up. Inviting the same email again resends it. A plan's seat limit is Off today: an invitation is never held back for it.

  2. Pick the right role

    Under Active members change a role from the list, or remove a member. A business always keeps at least one Owner. Open Roles to read what each role can read and change in each area.

  3. Make a role of your own

    On Roles choose New role, name it and tick the permissions it gets. You can only give permissions you hold yourself. Deleting a role takes its permissions from everyone who used it. Only an Owner can change or delete a role that someone holds.

  4. Grant access to chosen records

    On Access pick a team member, then grant access to named properties, bookings or project boards, or to the jobs assigned to them. This is how an outside cleaner sees only their own jobs. Revoke a grant and the access ends at once.

Who can use it

Owners, Admins and Managers can use this.

Seeing the team needs the team view permission, which Owners, Admins and Managers hold. Roles and access grants are for Owners and Admins out of the box. Anyone who invites or changes a role can only hand out access that they hold themselves.

Ask Heyva AI

  • Who is on my team and what roles do they have?

  • Invite a new colleague to this business as a manager

  • Which permissions does the Manager role have?

Questions

What is the difference between a role and a grant?
A role is a bundle of permissions for a whole area of work. A grant gives access to named records only, without a full role. Use a grant for an outsider who should see just a few jobs.
Can I invite someone to all my businesses at once?
An invitation can be for one business or for the whole account. Choose the account-wide option only for someone who oversees all of them.
Why can I not make someone an Owner?
Only an Owner can appoint or change an Owner. You also cannot give a role with permissions you do not hold yourself.
Can I remove the last Owner?
No. A business always keeps at least one Owner. Appoint another Owner first.
What happens when someone leaves?
Remove them from Active members. To also end their record grants and sign them out of every device at once, ask Claude, connected to Heyva, to offboard the person.
Do roles control what the assistant and Claude can do?
Yes. Both act as the signed-in person, so they can do only what that person's role and grants allow.

In more detail

Changes to who can see what are recorded, so you can look back at who changed a role.

For AI agents

Heyva AI and connected assistants can do this with these tools:

  • heyva_list_members
  • heyva_invite_member
  • heyva_create_invitation
  • heyva_set_member_role
  • heyva_list_roles
  • heyva_create_role
  • heyva_create_grant
  • heyva_offboard_user

About AI agents and MCP

Related

Last reviewed 9 November 2026