Roles & permissions

The model in 30 seconds

Every action that touches data is gated by a permission key (e.g. can_create_file_matters). Each user has a role for the active business; the role grants a set of keys, and the server checks those keys on every request.

The same keys control both what appears in the interface and what the server actually allows. If a user lacks a key, the relevant buttons and pages are hidden and any attempt to perform the action is blocked.

Built-in roles

Five roles ship by default. The first user to sign up under a business automatically becomes the Business Owner.

• Business Owner — singleton per firm. Has every permission and bypasses permission checks server-side. Can't be deleted; ownership transfers manually.
• Business Administrator — full operational access. Manage team, billing, integrations, templates, settings. Can't delete the business itself.
• Lawyer — full conveyance toolset (file matters, documents, LTSA, LOTR, templates, contacts). Can't manage team or billing.
• Assistant — execute conveyance tasks but can't reassign work or change settings. Read most things, write within file matters.
• Viewer — read-only across the app. Useful for articling students or external auditors.

Custom roles

Firms can define their own roles when the built-ins don't fit — e.g. an Office Manager who needs to view team data and run reports but not touch file matter substance.

From Settings → Permissions, click + New role, name it, and tick the permission keys you want. The server starts honoring it immediately — no deploy needed. Existing built-in roles can't be edited (they're the safety net), only custom roles.

Model B — per-user overrides

Sometimes you need to grant a single permission to one person without changing their whole role. Example: an Assistant who also needs to approve trust transactions for a temporary stretch.

Triconvey supports this via per-member permission overrides. The effective permissions for a member are their role's keys plus any individually granted keys, minus any individually revoked ones.

Overrides are surfaced and edited per team member at Settings → Permissions → (member) → Custom permissions.

Permission categories

Keys are grouped so the editor stays scannable. The current categories — driven by the registry, so they evolve with the product:

• File Matters · Contacts · Documents
• Templates · Trust Accounting · Title Insurance
• Team · Permissions · Roles
• Business Settings · Billing · Integrations
• LTSA Web Filing · LOTR · LTSA Title Search

Note: the Business Owner always has full access regardless of permission keys, so these settings apply to every other role.