Roles and Permissions

Overview

Roles control what each person on your team can see and do in Discovery. Every person has one role. For each page, the role decides whether that person can:

• Not see the page at all,
• View the page (look only),
• Modify it (create and edit), or
• Delete records on it.

Discovery comes with three standard roles. You can also create Custom Roles for job-specific access, such as an AP clerk who works only in Gather, Extract and Audit, or an account manager who can view services but not change them.

Note: Roles can only give access to features your company already has. If your company doesn't have a feature, it won't show up in the role settings.

The standard roles

• Full User replaces the old "Data Entry" role. Anyone who was Data Entry is now Full User automatically. You don't need to do anything.
• When Discovery turns on a new feature for your company, Full Users get it straight away.
• The standard roles can't be renamed, edited or deleted.

Dashboard and My Profile are always available to everyone, whatever their role. Notifications and Custom Reports work the same as before.

Where to find roles

1. Click your name in the navigation.
2. Click Settings.

3. Click Employees.

4. Click the Roles tab.

The list shows each role, its access (Full access, Everything except Settings, or Custom), and how many people have it.

Who can manage roles: Owners, Admins, and anyone whose role has the Settings permission. Settings View lets someone see the Roles tab, Settings Modify lets them create and edit roles, and Settings Delete lets them delete roles.

Creating a Custom Role

1. On the Roles tab, type a name in the New role name box.

2. Click New Role.

3. A new Custom Role starts with the same access as Full User: everything except Settings. Untick what this role shouldn't have, and tick Settings if they need it.

4. Click Save Role.

Setting a role's permissions

Click Edit next to a Custom Role.

You'll see one row for each page your company has, with three columns: View, Modify and Delete.

• Ticking Delete also ticks Modify and View. You can't delete what you can't see.
• Unticking View clears the whole row.
• Some pages need others. For example, a work order is made against a service and a vendor, so giving Work Orders View also ticks View on Services and Vendors (and on Locations and Companies, which Services needs). Work Orders Modify also ticks Client Contacts View, for the Requested By list. Those boxes are greyed out while something needs them. Hover over or click a greyed-out box to see what needs it, for example "Needed by: Audit Delete".

• Settings is one row covering every Settings page, including Employees, Invitations and Roles. It's off by default for Full User and new Custom Roles.

Changes take effect the next time the person opens a page.

What each level means in practice

• View only: The person can open the page and look, but the New, Edit and Delete buttons are hidden, and Discovery refuses the change if they try it another way.
• No access: The page disappears from the sidebar and global search. Typing the page address directly shows an access-denied page.
• Delete covers attached items too. Removing a location's document, an incident's comment or a service's fee needs Delete on that page, not just Modify.

Pages you can control

Incidents · Pickups · Work Orders · Companies · Client Contacts · Locations · Services · Vendors · Vendor Contacts · Pioneer · Vendor Credits · Credit Requests · Gather · Extract · Audit · Revenue · Vendor Contracts · Client Contracts · Reports · Data Exports · Client Accounts · Vendor Accounts · Rover Credentials · Rover Accounts · Location Audits · Rebates · Tilt · Settings

You'll only see the pages your company has.

Giving one person different access

Sometimes one person needs a little more or less than the rest of their role. You can change their permissions without creating a new role.

1. Go to Settings → Employees.
2. Click Permissions next to the person.

3. Tick or untick boxes. A box that's different from their role turns blue, and a note above the grid names their role.

4. Click Save Permissions. A confirmation lists every page that will change, before and after (for example "Audit: Delete → View").
5. Click Save Permissions again to confirm, or Cancel to go back and keep editing.

Note: Changing a person's role clears these individual changes. They start over with exactly the new role's permissions. Discovery warns you before you save, so you can revisit their Permissions page afterward.

Assigning a role

• New people: pick the role when you invite them. See How Do I Add a New Discovery User?
• Existing people: go to Settings → Employees, click Edit next to the person, choose a new Role, and save.

Deleting a Custom Role

Click Delete next to the role on the Roles tab. You can't delete a role while people still have it, so move them to another role first. Open invitations for that role switch to Full User.

Who can manage whom

People rank Owner, then Admin, then everyone else. You can only edit, remove or change the permissions of someone below you:

• An Owner can remove an Admin.
• An Admin can't remove another Admin or an Owner.
• An Owner can't remove another Owner.
• Nobody can give someone a role higher than their own.

The Edit, Permissions and Remove links only appear next to people you're allowed to manage.

If you manage roles but aren't an Owner or Admin:

• You can only give out (or take away) access you have yourself. Permissions you don't have show as read-only in the grid ("You can only change permissions you have yourself").
• You can't invite someone into a role that has access you don't have.
• New roles you create start with only the Full User access you hold.
• You can't edit, remove, or change the role or permissions of any existing teammate. Only Owners and Admins can.

Other places roles show up

• Incident "Assigned To": only lists people who can Modify Incidents. Someone already assigned stays on that incident.
• Related records: if someone can't view a page, its records are left out of other pages too. For example, someone without Work Orders won't see the Work Orders tab on an incident.
• Impersonating a client contact (signing in to the Client Portal as them) needs Client Contacts Modify and Incidents Modify, plus View on Locations, Services, Pioneer, Revenue and Reports, which is everything the Client Portal lets a contact do. Owner, Admin and Full User have it.
• Pioneer Autopilot needs Pioneer Modify. View-only Pioneer users won't see the Autopilot tab.
• API and Discovery MCP: API tokens and AI assistants connected through the Discovery MCP can only do what the person's role allows on the web.

If you have additional questions or need more in depth information, please feel free to send us a message using the help beacon in the lower right-hand corner.