User Roles & Permissions: Team Access Control

TenancyDesk uses Role-Based Access Control (RBAC) with 5 roles: Admin, Manager, Team Lead, Agent, Property Administrator.

Subscription-Aware Role Access

Which roles are available depends on your subscription plan:

Solo Plan (149 AED/month)

• Admin only
• Intended for: Independent RERA-licensed brokers
• Cannot add other users
• When hiring first employee: Upgrade to Starter

Starter Plan (299 AED/month)

• All 5 roles (Admin, Manager, Team Lead, Agent, Property Administrator)
• Max 5 users

Pro Plan (599 AED/month)

• All 5 roles (Admin, Manager, Team Lead, Agent, Property Administrator)
• Max 20 users

Enterprise Plan (999+ AED/month)

• All 5 roles + custom roles
• Unlimited users

---

The 5 Roles

Admin - Full access

• All deal management
• Team management (invite/remove users)
• Billing & subscription
• Settings & integrations
• Reports & analytics

Manager - Company-wide operations oversight

• View and manage all deals (company-wide)
• Assign deals to any team member
• Access all company reports and analytics
• View team member names and roles (read-only)
• Cannot: Change billing, invite/remove team members, change settings

Team Lead - Hierarchical team oversight

• View own team's deals and dashboard statistics
• Assign and reassign tasks within team
• Run team performance reports (own team only)
• Full property and contact access
• Cannot: See deals outside their team, access company-wide reports, invite/remove users
• Available on: Starter, Pro, and Enterprise plans

Agent - Individual sales focus (PRIMARY revenue generator)

• Create and manage own deals
• Create properties and add contacts
• Create payment schedules for own deals
• Track own commissions
• Cannot: View other agents' deals, access company-wide reports or payments page

Property Administrator - Office Administrator (SUPPORT role)

• View all company deals, payments, tasks, and compliance
• Upload, verify, and organize documents
• Prepare Ejari / Tawtheeq registration
• View all payment schedules and track collections
• Verify tenant and owner KYC documents
• Browse all company properties and contacts
• Cannot: Create deals, create/edit properties, edit unassigned deals, access reports or team management

---

Permission Matrix

Key distinctions:

• "Full" = create, read, update, delete
• "Team" = see team members' data only
• "Own" = see only data they created or are assigned to
• "View only" = read access, cannot create or modify
• "All (read)" = see all company data, but can only edit items assigned to them
• "Assigned" = see only deals/tasks explicitly assigned to them

---

Choosing the Right Role

Admin → Business owners, senior management

• Needs: Full control, billing access
• Risk: High (can delete data, remove users)
• Recommendation: 1-2 admins max

Manager → Company-wide operations leads

• Needs: All-company oversight, reporting, team visibility
• Risk: Medium-High (sees all deals, runs reports, views team)
• Recommendation: 1 manager for company-wide operations
• Note: Can view team members (read-only) but cannot invite/remove
• Available on: Starter, Pro, Enterprise (NOT Solo)

Team Lead → Team supervisors, senior agents

• Needs: Own team oversight, team dashboard, team reporting, task assignment
• Risk: Medium (sees team deals and statistics, assigns tasks within team)
• Recommendation: 1 team lead per 3-5 agents
• Available on: Starter, Pro, and Enterprise plans
• Best practice: Use for hierarchical team management with own deal creation

Agent → Sales agents, revenue generators

• Needs: Create deals, track commissions, manage own pipeline
• Risk: Low (limited to own deals)
• Recommendation: Primary revenue role, most sales staff
• Available on: All plans except Solo

Property Administrator → Office administrators, Ejari/Tawtheeq specialists, document processors

• Needs: Full visibility into all company deals for Ejari prep, payment reconciliation, document management
• Risk: Low (full read access, but can only edit assigned deals; cannot create deals/properties/contacts)
• Recommendation: 1 Property Administrator per 5-10 agents
• Note: Cannot create deals, properties, or contacts — support role with full company read access
• Available on: All plans except Solo

---

Best Practices

1. Start Restrictive: Give minimum access, upgrade as needed
2. Multiple Admins: Always have 2+ admins (backup access)
3. Regular Review: Quarterly audit of user roles
4. Remove Promptly: Terminate access when team member leaves
5. Document Reasons: Note why specific access granted

---

Changing Roles

Settings → Team Management → User name → Change Role

Takes effect: Immediately Current sessions: User sees new permissions on next page load

Warning: Downgrading Admin to lower role removes billing access—ensure billing continuity

---

Security Tips

1. 2FA Required: Enforce two-factor authentication for Admins
2. Audit Logs: Review who accessed what regularly
3. Session Timeout: 30-minute inactivity timeout
4. Password Policy: Enforce strong passwords
5. IP Whitelist: Restrict Admin access to office IPs (Enterprise)

---

---

Next Steps

1. Review current team roles against your subscription plan
2. Ensure 2+ Admins exist
3. Assign Manager for company-wide operations
4. Use Team Lead for hierarchical team management (Starter/Pro/Enterprise)
5. Assign Agent role to sales staff
6. Use Property Administrator for administrative support