Administration
Users
Invite staff, give them roles, reset passwords and two-factor, and deactivate people who leave.
Users lists everyone on your staff who can sign in to the panel, what roles they hold, what part of the book they see, and whether their sign-in is secure. It is where you invite new people and switch off people who leave. Customer and carrier portal users are not here; they are managed from the customer or carrier record (see How the portals work).
- Where
- Administration → Users (/users)
- Who can open it
- Users · view. By default: the Owner only
- Who can invite, resend and revoke
- Users · create
- Who can change roles, reset, deactivate
- Users · edit
- Invite link
- Valid for 7 days
- Password reset link
- Valid for 60 minutes
- Two-factor required for
- Owner and Finance Manager roles
What you see
Figures
| Figure | Meaning |
|---|---|
| People | Everyone on the staff list |
| Active | People who can sign in |
| Invites pending | Invites sent and not yet expired |
| Missing 2FA | People whose role requires two-factor but who have not set it up. Amber when above zero |
A Roles chart shows how many people hold each role. When anyone is missing two-factor, an amber banner names them.
People
| Column | Meaning |
|---|---|
| Person | Initials, name, email and how many open loads they are the agent on |
| Can do | Every role they hold. A person's access is the union of all their roles |
| Sees | "Own book only" for Sales Managers, otherwise "The whole tenant" |
| Status | Active or Deactivated (both grey: being active is not news) |
| Sign-in | Last sign-in (or "Never"), and for roles that need it, 2FA on or 2FA required, off in amber |
| (menu) | Actions for that person, if you can edit users |
Rows where two-factor is required but off are tinted amber. A Roles link opens Roles & permissions.
Invites waiting
| Column | Meaning |
|---|---|
| Who was invited | |
| Roles | The roles they will get |
| Status | Invite pending or Expired, with when it was sent |
| (buttons) | Resend and Revoke |
Invite someone
Click Invite someone
In the page header (only shown with Users · create).Enter their work email
One email can only belong to one account.Pick their roles
Pick one or more. They get the union of what the roles allow.Click Send invite
They receive an email with a link to set their own password. The link works for 7 days.
The server refuses when:
| Message | Why |
|---|---|
| "Someone already has an account with that email." | The email is in use |
| "That email already has an invite waiting. Use Resend below." | An unexpired invite exists |
| "You can't give the … role: it has access your own role doesn't." | You may only hand out roles within your own access, so "can invite" never becomes "can make someone an owner" |
| "Your plan has N seats and all of them are taken (counting invites waiting). Upgrade on the Billing page to add more people." | Active people plus waiting invites would exceed your plan's seats. See Billing |
Manage an invite
- Resend issues a fresh link valid for another 7 days and emails it. The old link stops working.
- Revoke asks first: "The link in their email stops working. You can invite them again later."
Manage a person
Open the menu at the end of the row.
| Action | What it does |
|---|---|
| Change roles | Pick a new set of roles. At least one is required |
| Send password reset | Emails a link to choose a new password. Their current password keeps working until they do |
| Reset two-factor | For a lost phone. They set it up again at their next sign-in, and their sessions end now |
| Deactivate | They are signed out everywhere and cannot sign in until reactivated. Their loads and history stay |
| Reactivate | Lets a deactivated person sign in again (subject to seats) |
Rules that protect the company
| Rule | Message |
|---|---|
| The company always keeps at least one active owner | "This would leave the company with no active admin. Make someone else an admin first." |
| You cannot deactivate yourself | "You cannot deactivate yourself. Ask another admin." |
| You cannot remove your own owner role | "You cannot remove your own admin role. Ask another admin." |
| Everyone has at least one role | "Give them at least one role. To stop someone signing in, deactivate them instead." |
| Reset emails are limited | At most 3 per person per hour: "Too many reset emails went to this person in the last hour. Try again later." |
| No reset for a deactivated person | "… is deactivated. Reactivate them first." |
What is recorded
Every change writes an audit entry: user.invite, user.invite_resend, user.invite_revoke, user.roles, user.deactivate, user.reactivate, user.password_reset_sent and user.2fa_reset. Deactivating someone or resetting their two-factor ends every session they have.
Related
- Roles & permissions
- Security: failed sign-ins, lockouts and two-factor
- Transfer accounts: move a leaver's customers and loads
- Billing: seats
- Signing in