Roles and permissions
The Planning security groups, exactly what each can and cannot do, which other groups matter, and how to give access.
This page is a reference for administrators and managers. It describes who can do what in Planning. The access rules behind it are listed for developers in Security reference.
The two Planning groups#
Planning adds a category Planning with two groups. Give them in Settings → Users & Companies → Users: open the user, go to the Access Rights tab and choose a level under Planning.
| Group | What it is for | Includes |
|---|---|---|
| Planning / User | Employees who work to a rota: they see the published schedule and use self-service. | Internal User |
| Planning / Administrator | Planners. They create, publish and delete every shift and set up roles and templates. | Planning / User |
The users OdooBot and Administrator are Planning Administrators from the start. A Planning Administrator is not automatically a Settings administrator: the Settings screen needs that right too.
An ordinary Internal User with no Planning group still sees the Planning application. They see My Planning, can open a shift that was sent to them, and can use self-service on shifts they can see. They do not see the Schedule, Open Shifts or Configuration menus.
What each level can do#
| Task | Internal User | Planning / User | Planning / Administrator | Project manager (own projects) |
|---|---|---|---|---|
| See their own published shifts | Yes | Yes | Yes | Yes |
| See published open shifts | Yes | Yes | Yes | Yes |
| See other people's published shifts | No | Yes | Yes | Only on projects they manage |
| See draft shifts | No | No | Yes | On projects they manage |
| Create, edit, delete shifts | No | No | Yes | Own projects |
| Edit the Note of their own shift | No | Yes | Yes | Yes |
| Take an open shift, give one back, ask to switch | Yes, if linked to an employee | Yes | Yes | Yes |
| Publish and unpublish a shift | No | No | Yes | Own projects (form and card) |
| Publish and Send, Copy Previous Week, Auto Plan, Plan with Template, Plan Orders | No | No | Yes | No |
| Split, duplicate, plan a task | No | No | Yes | Own projects |
| Approve or reject a change | No | No | Yes | Only as the shift manager, and the buttons are shown to planners only |
| Open the Schedule menus | No | Yes | Yes | Through Project → Planning (the Planning menus need Planning / User) |
| Open My Planning | Yes | Yes | Yes | Yes |
| Open Open Shifts | No | Yes | Yes | Only with Planning / User |
| Read roles and templates | Yes (read only) | Yes (read only) | Yes | Yes (read only) |
| Create or edit roles, templates, materials | No | No | Yes | No |
| See the Cost of a shift | No | No | Yes | No |
| Open the Dashboard | No | No | Yes | By direct link only |
| Open Settings → Planning | No | No | Only if also a Settings administrator | No |
Employees can never change anything on a shift except its Note. Taking, handing back and switching go through buttons that check the rules for them, and give a message when the shift is not for them; see Take an open shift.
Other rights that matter#
| Right | What it unlocks in Planning |
|---|---|
| Employees: Officer: Manage all employees | Planning → Configuration → Employees; the Utilisation report for everyone; seeing the reasons for time off on the schedule; the employee on a shift. |
| Project: User / Administrator | The Project bridge screens. A project manager plans their own projects. |
| Sales: User: Own Documents Only or higher | Seeing the Sales order item and order status on a shift. |
| Attendances: Officer | The Planned vs Attended report and the attendance fields. |
| Timesheets: Administrator | Timesheets to Confirm. |
| Settings: Administration | Planning → Configuration → Settings. |
Planning is multi-company aware: shifts, roles, templates and the other records belong to a company, and users only see those of the companies they are allowed in.
What not to expect#
- A Planning User can read roles with their hourly costs and templates, because everyone who plans needs to read them. Do not put sensitive figures in a role's cost if all internal users should not read it.
- The personal schedule links sent by email work without a login. Anyone holding a link can act as that employee. See the Portal guide.