2. Prepare your organisation
What are roles and permissions?
Learn how to review built-in roles and create custom permission sets via the web app in LambdaAssetCheck, so people get only the access they need.
Last updated: September 2026
What you'll need
| Tier | Any plan to open Roles. Custom roles need Advanced (up to 3) or Professional (unlimited). Basic has none. |
| Platform | Web app |
| Permission | The Permissions platform-management capability. Owner and Administrator have it by default. |
| Where | Administration → Roles |
Built-in roles
LambdaAssetCheck ships with seeded roles. Display names in the product:
| Role | What it can do |
|---|---|
| Owner | Full access, including Billing and subscription management. Billing stays on this seeded role. |
| Administrator | Org-level admin — users, groups, sites, templates, and operational data. Does not include billing or organisation deletion. |
| Site Manager | Site-level supervisor — assets, inspections, schedules, work requests, and tasks at the sites they can access. |
| Inspector | Runs asset inspections (not audits); can view schedules and their tasks. Does not manage templates or users. |
| Technician | Completes work orders and tasks (maintenance and repair). |
| Auditor | Conducts audit inspections; can view assigned schedules and create tasks. Does not view assets, templates, or work requests. |
| Safety Manager | Reviews and closes audit flags; can access flag media and assign or review flags. |
| Viewer | Read-only access to dashboards, inspections, assets, and schedules — cannot conduct inspections or make changes. |
There is no seeded Reviewer role. Review and approve behaviour for work and inspections sits on Site Manager (and Administrator / Owner) plus the assignment permissions you grant. Contractor is retired and maps to Technician.
Seeded roles are read-only. To change a permission set, copy the role into a custom role.
Create a custom role
Custom roles depend on your plan: Basic has none, Advanced up to 3, Professional unlimited. You cannot designate a custom role as Owner.
- Title - Product role designation — pick the closest built-in behaviour (Other is the default and uses only the permissions you select). Options: Admin, Site manager, Inspector, Auditor, Technician, Viewer, Safety manager, Other. - Description
- Go to Administration → Roles and select Create.
- In the left column, enter the Role details:
- In the right column, Choose permissions for the role, grouped by area. Some permissions only appear when the product role designation is Admin or Site manager.
- Select Create to save.
Billing is never grantable on custom roles, including those with the Admin designation — the checkbox stays disabled. Use the seeded Owner role for billing.
Administration permissions (Organisation settings, Permissions, Users, Credentials, Sites, Groups) are available only when Product role designation is Admin.
Copy an existing role
- Go to Administration → Roles and open the role you want to base yours on.
- Select Copy to create custom role.
- Adjust the title, description, and permissions. Product role designation stays locked to the source role’s behaviour.
- Select Create to save.
Site data access
Every role can be scoped to sites. Under Choose permissions → Site data access, the Organisation-wide operational data (all sites) checkbox controls how far operational data (assets, inspections, tasks, and other site-scoped data) reaches:
- Checked: the role can see operational data across all sites.
- Unchecked: the role is limited to the sites its users are assigned to.
Site data access does not replace module permissions — you still grant Tasks, Assets, and so on separately. Combine it with View own / involved only on a module to narrow a list further, down to records a person created or is assigned to.
Permissions reference
When you create or edit a custom role, you choose the permissions it should have. Some options only unlock for certain Product role designation values — those are noted per group.
Administration
*Available only when product role designation is Admin. Billing appears in the list but cannot be selected on any custom role.*
| Permission | What it allows |
|---|---|
| Organisation settings | Manage organisation settings such as single sign-on and custom branding, and set up integrations |
| Billing | Manage billing details and payment methods, and view tax invoices — seeded Owner only; never stored on a custom role |
| Permissions | Add, remove, and manage permission sets |
| Users | Add and deactivate users, and manage user details and settings |
| Credentials | View credential media, add and approve credentials, and manage credential types |
| Sites | Create, edit, activate/deactivate sites, and manage site membership |
| Groups | Create, edit, mark groups inactive, and manage group membership |
Assets
| Permission | What it allows |
|---|---|
| Read | View assets |
| Create | Create assets |
| Update | Edit assets |
| Assign | Assign assets |
| Manage asset types | Create and manage asset types |
| Assign meters to asset types | Attach meters to asset types |
| Meter marked as Not Equipped | Mark an asset's meter as not equipped |
| New Meter from Asset Sync – Review Required | Review new meters created by asset sync |
| Meter status conflict detected | Resolve meter status conflicts |
| View missing meter attempts | See missing meter-reading attempts |
*Meter review, missing-meter, and asset-sync meter alert permissions are available when the product role designation is Admin or Site manager.*
Templates
| Permission | What it allows |
|---|---|
| Read | View templates and configurations |
| Create | Create templates |
| Update | Edit templates and conditional logic |
| Template configuration | Manage the configurations overview, response types, audit types, and incident types |
| Archive | Archive templates and remove unpublished drafts (published templates are kept for history) |
*Template configuration and Archive are available only when the product role designation is Admin.*
Inspections
| Permission | What it allows |
|---|---|
| Conduct asset inspections | Create and conduct asset inspections |
| Read | View inspections within your site/data scope |
| View own / involved only | Limit inspection lists to records you created or are assigned to |
Audits
| Permission | What it allows |
|---|---|
| Conduct audit inspections | Conduct site audits |
| Read | View audits within your scope |
| View own / involved only | Limit audit lists to your own or involved records |
Incidents
| Permission | What it allows |
|---|---|
| Read | View incidents |
| Create | Report incidents |
| Assign | Assign incidents |
| Review (approve / close) | Close incidents that are In review |
| View own / involved only | Limit incident lists to your own or involved records |
Schedules
| Permission | What it allows |
|---|---|
| Read | View schedules in your scope |
| Create | Create schedules and view your own or assigned ones |
| Update | Edit or cancel existing schedules |
| Assign | View and assign other users' schedules within your scope |
Analytics
| Permission | What it allows |
|---|---|
| View | View Analytics dashboards you own or that were shared with you |
| Create dashboards | Create dashboards, and edit or delete only dashboards you created |
| Share dashboards | Share dashboards you created with users and groups |
Rounds
| Permission | What it allows |
|---|---|
| Define routes | Create and edit inspection routes used by round schedules |
| Define rounds | Define round schedules, pause/resume, and view instance status |
| Assign rounds | Assign round instances and view the daily roster |
| Conduct rounds | View and conduct round instances assigned to your groups |
Work requests
| Permission | What it allows |
|---|---|
| Read | View work requests |
| Create | Create work requests |
| Update | Update work requests |
| Assign | Reassign parent work requests and orders (child task assignment stays with the current parent assignee) |
| View own / involved only | Limit lists to your own or involved records |
Work orders
The same set as work requests, applied to work orders: Read, Create, Update, Assign (parent only), and View own / involved only.
Flags
| Permission | What it allows |
|---|---|
| Read | View flags |
| Create | Create flags |
| Update | Update flags |
| Assign | Assign flags |
| Review (approve / close) | Approve or close flags at review |
| View own / involved only | Limit lists to your own or involved records |
Tasks
Controls standalone task access. For tasks under work requests or work orders, creating and assigning are controlled by the current parent assignee.
| Permission | What it allows |
|---|---|
| Read | Open and view tasks in your scope, in any status |
| View own / involved only | Limit to tasks assigned to you or your groups, or created by you |
| Create | Create standalone tasks |
| Update | Update task details and complete tasks you can act on |
| Manage status (any task in scope) | Change status for any in-scope task without being the assignee |
| Cancel | Mark tasks as cancelled |
| Set priority | Change task priority |
| Assign | Assign standalone tasks |
| Task settings | Manage task types and task settings |
Manage status (any task in scope), Cancel, and Set priority are available only when the product role designation is Admin or Site manager. Task settings is available only when Admin.
Assignment (Owner / Reviewer)
These decide who is eligible to be assigned as the owner or reviewer of work and issues.
| Permission | What it allows |
|---|---|
| Work Request owner | Eligible to be assigned as owner of work requests (manual and auto-created) |
| Work Request reviewer | Eligible to review work requests at IN_REVIEW; can close or cancel once all tasks are closed |
| Work Order owner | Eligible to be assigned as owner of work orders |
| Work Order reviewer | Eligible to review work orders at IN_REVIEW; can complete or cancel once all tasks are closed |
| Audit Flag owner | Eligible to be assigned new audit flags |
| Audit Flag reviewer | Eligible to review and close audit flags at REVIEW — preferably the auditor who ran the audit |
| Incident owner | Eligible to be assigned new incident reports |
| Incident reviewer | Eligible to review and close incidents |
Home dashboard tiles
The home dashboard is a read-only preview whose tiles switch on automatically from the permissions above — there are no separate keys to set.
| Tile | Appears when the role can… |
|---|---|
| Open actions | read actions / tasks |
| Due today | read schedules |
| Incidents | read incidents |
| High / critical flags | act with admin-equivalent capabilities |
| In-progress inspections / tasks / work items | read inspections / tasks / work items |
| Agenda: inspections / tasks / incidents | see schedules / tasks / incidents |
Edit a role
- Go to Administration → Roles and select the custom role.
- Update the Role details and adjust permissions in Choose permissions.
- Select Save changes.
Seeded (system) roles cannot be edited — use Copy to create custom role instead.
Deactivate a role
To retire a custom role, select its Enabled toggle on the Roles page. Its status changes from Active to Inactive. Toggle it again to re-activate.
Limitations
- Basic cannot create custom roles. Advanced is capped at 3; Professional is unlimited.
- You cannot designate a custom role as Owner, and Billing cannot be granted on any custom role.
- Seeded roles are read-only; customise by copying them.
- Features below your plan (for example inspection rounds on lower tiers) still need the matching plan — a permission alone does not unlock them. See what each plan includes.
Frequently asked questions
Why can't I tick Billing on a custom Admin role?
Billing is owner-gated. The checkbox is shown for completeness but stays disabled; only the seeded Owner role holds Billing.
Why are Administration checkboxes greyed out?
They unlock only when Product role designation is Admin. With Other or another designation, those platform-management permissions stay unavailable.
What happens if I create a custom role on Basic?
The create form may open, but saving fails until you upgrade. Advanced or Professional is required.
Can one person have more than one role?
Yes. Assign multiple roles on the user. Their effective access is the union of those roles’ permissions.
Related articles
Was this page helpful?
