Give your staff exactly the access they need — no more

The Team page lists your members and any pending invitations. To add someone, you enter their name and email and tick the permissions they should have. They get a single-use email link, set a password, and they're in — using the same login, cookies and two-factor setup as any other staff account. Permissions are a layer on top of authentication, not a separate system.

Every section of the admin panel is its own permission, grouped the way the sidebar is — Catalogue, Reservations, Website, Customers, Configuration, Account. For most sections you grant view (can open the page and read the data) and/or edit (can also change and save). Edit implies view.

• A member without a section’s permission does not see it in the sidebar — and if they hit the underlying API directly, the server rejects it with a real 403. Hiding the page is not the security boundary; the server check is.
• Team management is itself a guarded permission — you decide who can invite or edit other members.
• Everyone can always manage their own account (name, password, two-factor) regardless of permissions.
• Cross-tenant isolation is absolute: a team member can only ever see and affect your agency’s data, never another agency’s, whatever permissions they hold.

The founding owner is protected

The person who signed the agency up is the owner. They always have full access, and there is no way — through a permission mistake or otherwise — to lock them out or strip their access. You can't edit an owner's permissions or deactivate them from the Team page.

Changes take effect on the next request

When you change someone's permissions, it applies on their very next action — no re-login needed. Their sidebar and pages update the next time they load. If you deactivate a member, their session ends on their next request.