Add a staff member with limited access

Every person who works on your network should have their own login. Don’t share the owner account. Separate logins mean you can limit what each person can see and change, and you know who did what: manual connects, compensation runs and team changes are all logged against the person who made them.

Only owners and admins can add or invite team members.

Step 1: Decide on the role

Roles come in groups. Pick the narrowest role that still lets the person do their job. You can give someone more than one role.

Group	Roles	Typical use
Core Roles	Owner, Admin, Operator, Viewer	Owner: full access, and can only be changed through support. Admin: create, update and delete across the areas you allow. Operator: day-to-day updates without deleting critical things. Viewer: read-only.
Branch Roles	Manager, Branch manager, Technician, Sales rep	Staff who should only see the customers of their own branch(es).
Network Services	PPPoEs admin/reader, Hotspots admin/reader, Devices admin/reader	Staff who handle one service only.
Customer Management	Customers admin/reader	Customer care desk.
Billing & Payments	Billing admin/reader	Accounts staff.
Reports & Analytics	Reports admin/reader	Management who only need numbers.
Marketing & Promotions	Marketing admin/reader, Communications admin/reader	Promotions and SMS staff.
Administration	Team admin/reader, Settings admin, Logs reader, and others	Senior staff helping run the account.

“Admin” roles can change things in their area. “Reader” roles can only look.

Examples

Cashier / customer care: Customers admin. They get full management of hotspot and PPPoE customers, but no settings or billing.
Field technician: Technician. They can create and manage customers, view devices and work onboarding jobs, but they get no billing or settings access. Add branches (Step 3) to limit them to their area.
Branch manager: Branch manager. Full customer management and communications for their branch, plus view-only billing, reports and devices.
Accountant: Billing reader and Reports reader.

Step 2: Add or invite the person

Go to Team. You have two options:

Invite Member (recommended): enter their Email Address, pick a Member Role and click Invite. They receive an email, and once they accept it they appear in your team list. You’ll see Invitation sent successfully. Once accepted, you will see the member. Invitations that haven’t been accepted yet are listed under Pending Invites, where you can Revoke them.

Add Member: creates the login for them straight away, with a name, email, phone and password (or tick System generate password). You’ll see Member added! Share their login credentials securely. Give them the password in person or over a private channel. Never send it in a group chat.

Step 3: Restrict to a branch (optional)

If you run more than one location:

Create your branches in Settings, on the Branches card: add a Branch Name for each site.
On the Team page, under Branch Assignments, click Assign Branch and choose the member’s branch(es).

People with Branch Roles only see their assigned branches (plus records that have no branch). Core roles such as Admin are not restricted by branch.

Step 4: Fine-tune roles later

Open the member from Team to:

Change their roles with Select Roles, then Save.
Deactivate them temporarily (for example during leave) and Reactivate them later.
Reset Password. Only an owner can do this.
Delete them when they leave.
Review Login Activity and Audit Logs.