Roles and Permissions

Access is role-based and Salesforce-driven. The app provisions users from Salesforce Contact fields, then gates UI and API behavior by role level and assigned divisions. This model exists because inspection creation, Salesforce submission, product mapping, pricebook updates, and Level 5 assignment have different operational risk profiles and should not be exposed through one flat permission.

Role ladder

Role	Description
Level 1	Field entry only: create inspections and capture photos/notes
Level 2	Level 1 plus pricing visibility, Other Repairs, and own Salesforce submission
Level 3	Level 2 plus same-division submission/review for other users
Level 4	Level 3 plus Expert Mode and division-scoped setup tools
Level 5	Full administrative access

Level 1 is a full field role, not a limited trial. Level 1 users run the Renovation Review (Field) walkthrough — currently the default inspection type — and capture work-typed Job Documentation photos. What Level 1 does not have is pricing visibility and Salesforce submission; those begin at Level 2.

Permission model


Salesforce Contact fields ── provision ── app user
App user role ── gates ── screens and actions
Assigned division ── limits ── same-division review and setup
Explicit exception ── protects ── Level 5 assignment

Administrative exception

Only sjohnson@amenitycollective.com should be able to assign Level 5 access.

Some production admin surfaces can be temporarily restricted to specific users regardless of role when a feature is operationally sensitive.

Password registration

Most field staff sign in with Google. Approved team members who do not have a Google account can instead set a password and sign in with their email, through a secure emailed setup link — this is a way to log in to an already-approved account, not a self-signup path.

Admins send the links. From Admin → Users, a Level 5 admin sends a setup link to an approved user or approves staged users in bulk.
Some domains stay Google-only. Domains configured as SSO-only must sign in with Google and are blocked from setting a password, so users whose accounts already have Google SSO keep using it.
Approval comes first. Password registration sets a credential on an account that has already been approved and provisioned from Salesforce; it does not create new access.

The sign-in screen distinguishes “no password set yet” from “this is an SSO-only account” and says which one applies, rather than telling a non-Google user to sign in with Google. Accounts on SSO-only domains are not offered a password option at all, so nobody gets stuck on a form they cannot complete.

Division assignment from Salesforce

Users are provisioned from Salesforce, and their divisions come with them. Two rules are worth knowing:

Virginia access is granted by branch. Staff working the Central VA and Northern VA branches receive the VA division automatically, so Virginia pools stay visible to the people actually working them.
Refreshing the user list never signs people out. A preload that simply adds a division to an account leaves that account’s access intact — an earlier version revoked login on any division change at all.

Sign-in matches on the canonical email domain after alias rewriting. A Google Workspace account can present a different domain than the one it signs in from, so a domain missing from the alias list turns a legitimate user away as unknown. amenitypool.com and pools-world.com are both treated as americanpool.com.

Roles in the renovation workflow

The review → proposal pipeline and Manager Requests add floors on top of the ladder above:

Action	Floor
Mark Reviewed; write and submit review notes	Level 2
Raise a Manager Request	Level 2
Answer a Manager Request	Any level, including Level 1
Create or link proposals; mark Proposals Complete or Sent to Customer	Level 4
Accept a Manager Request	The raiser, in-division Level 4+, or Level 5
Cancel a Manager Request	The raiser or Level 5 only
Delete an inspection with an outstanding request	Level 5 only

The Level 1 exception is deliberate: the person standing at the pool often has the fewest permissions, and requiring a higher level to answer would defeat the loop.

Pitfalls

Do not assume Level 4 means unrestricted global administration; many setup tools remain division-scoped.
Do not assign Level 5 through normal user editing paths unless the current user is the explicit Level 5 administrator.
Do not evaluate access using only the UI; API routes also need to enforce the same permission boundaries.

Admin Tools lists the screens affected by elevated permissions.
Salesforce Integration explains the Contact fields behind provisioning.