Help centre
Accountants & advisers

Control what practice staff can do

A practice answers two very different questions about its people, and Sales Scribe keeps them deliberately separate:

Control what practice staff can do

A practice answers two very different questions about its people, and Sales Scribe keeps them deliberately separate:

  1. Who runs the firm? Who may invite staff, connect clients, build the rota, author roles, spend the firm's money? That is governed by firm roles.
  2. Who does what inside a client's books? Once someone is assigned to a client, how much of the client's grant may they actually use? That is governed by client access roles, plus optional per-client fine-tuning.

They sound similar, and mixing them up is the most common source of confusion — so here is the rule of thumb before anything else:

Note: A firm role never grants any access to any client's books, and a client access role never grants any authority over the firm. A partner with every firm permission still sees nothing of a client until they are assigned to that client; a trainee assigned to twenty clients still cannot invite a colleague.

This guide walks through both, then shows how the pieces combine, with worked examples at the end. It is written for the practice side; the client keeps their own controls, covered in Give your accountant access.

The four layers at a glance

What a practice person can do inside one client's organisation is the result of four layers. Each layer can only keep or remove things — nothing further down the list can ever add back what an earlier layer refused.

Layer Set by Where What it does
1. Access profile (the grant) The client Their Accountants & advisers panel The ceiling for your whole firm in that organisation. Nothing your practice configures can exceed it.
2. Client access role Your practice Client roles tab, applied per assignment Narrows the grant to what this staff member's job needs — the same role reused across all your clients.
3. Per-client customisation Your practice Customise, on the client's page Adjusts one person's access for one client — within the grant, never beyond it.
4. Person restrictions The client Restrict, on their panel The client's veto on a named individual. Always wins. Only the client can lift it.

Firm roles sit outside this table entirely — they decide who may operate layers 2 and 3, not what those layers contain.

Firm roles — who runs the practice

Open your practice and select the Firm roles tab.

Every practice member holds exactly one firm role, made up of up to five firm administration permissions:

  • Manage staff — invite, deactivate and reactivate members, and change their roles.
  • Manage client relationships — invite clients, and suspend, resume or end an engagement from the practice side.
  • Assign staff to clients — choose who works on which client, their client access role, and any per-client customisation.
  • Manage roles — author the practice's client access roles and firm roles.
  • Manage sponsorships — offer or cancel client subscription sponsorships (the firm's money).

Two roles are built in:

  • Administrator — all five permissions.
  • Staff — none of them. This is the default for new members, and it is not a punishment: firm membership plus client assignments is everything a working accountant needs. Staff simply cannot administer the firm.

Select New role to create your own — Partner, Manager, Junior, whatever fits how you work — ticking exactly the permissions the role should carry. Built-in roles cannot be edited; a role in use cannot be deleted until its members are moved.

Assign roles on the Members tab: each member row has a role picker — choose and select Set. Invitations carry a role too, so a new member arrives with the right authority from their first sign-in.

You cannot hand out more than you hold

Whatever your firm role allows, one rule always applies on top:

Note: You can only create, edit or assign a role whose every permission you hold yourself. Someone with Manage roles but without Manage sponsorships cannot add sponsorship authority to any role, nor assign anyone a role containing it — not even themselves. Authority in a practice flows downhill only.

If a role in a picker is greyed out, or the editor refuses a permission, this ceiling is why. Ask someone who actually holds the missing permission (or an owner) to make that change.

Ownership is not a role

Each practice has at least one owner — shown with an Owner badge on the Members tab. Ownership is structural: it is never granted by any role, cannot be included in a custom role, and moves only by explicit Transfer ownership (owner-only). An owner can do everything in the firm regardless of role.

To transfer ownership — for example when the founding partner retires:

  1. Sign in as a current owner and open the practice's Members tab. Only an owner sees the transfer control.
  2. Find the row of the member who is taking over. They must already be an active member — if they are new to the firm, invite them and let them accept first; if they are deactivated, reactivate them.
  3. Select Transfer ownership on their row and confirm.

The change is immediate, and both people move at once: they become the owner — full authority, whatever firm role they held before — and you become an ordinary member holding the Administrator role, so you keep day-to-day firm administration until someone decides otherwise. Nothing else moves: your client assignments, and everyone else's, are untouched, and — as the confirmation reminds you — billing-account authority does not move. If the new owner should also manage the firm's subscription and card, arrange that separately on the billing account, and note that closing the practice needs both (an owner who also holds billing management).

To step an owner down instead, an owner picks a role for them and selects Demote — they become an ordinary member with that role. The last active owner can never be demoted or removed: someone must always be able to run the practice.

Client access roles — what staff may do in a client's books

Open your practice and select the Client roles tab.

Without a client access role, an assigned staff member can use everything the client granted — the full access profile. That is fine for a two-person firm; in a larger one you rarely want the trainee wielding the same powers as the reviewing partner. A client access role is a named bundle — Trainee, Senior Accountant, Tax Manager — that you define once and reuse across every client.

The one rule that makes them safe:

Note: A client access role can only ever narrow what a client granted. If the role includes a permission the client did not grant, that permission simply does nothing in that client — a role is never a way around a client's decision. The same role can therefore mean slightly different things in different clients, and that is by design: the client's grant always wins.

To create one: select New role, name it, and tick the permissions it should carry. Permissions flagged Sensitive (voiding, write-offs, reversals, exports) are highlighted, and every delegated use of them is always audited — recorded before the action runs, and refused rather than left unrecorded if the record cannot be written. The built-in access profiles (Accountant, Bookkeeper, Sales adviser, Read-only adviser) also appear in the list and can be used as roles directly — they are read-only, marked Built-in.

To apply one: open the client with Manage. Each assigned staff member's row has a Works under picker — choose a role and select Set role, or choose Full access profile to remove the narrowing again. The client's audit history records every change: who can do what in their books is never silent.

In bulk: the role travels with assignment in both directions. On a client's page you can tick several members and assign them together under one chosen role; from the Members tab, Assign to clients does the reverse — one member onto many clients, again with one role choice. A bulk assignment never silently clears roles: leaving the picker on Full access profile when members are already assigned applies exactly what you chose.

Deleting a role that staff currently work under is refused — move them first. The list shows how many staff use each role, so you can see what a change would touch.

Customise one person's access for one client

Sometimes the role is right everywhere except one engagement. Next to each assigned staff member on a client's page there is Customise — a screen showing every permission the client granted, with the member's current effective set ticked. Tick or untick and Save access.

  • Additions must be within the client's grant — you cannot tick what the client never gave (the screen will tell you).
  • The result is an exception, and exceptions are never invisible: the client's page shows an N customised badge, and the Client roles tab lists every customised assignment in the practice under Customised access, so a deviation set in March is still accounted for in November.
  • Reset to role (or Reset to profile) clears the customisation and returns the person to their plain role.

Use customisation for genuine one-offs. If you keep making the same exception, that is a new role trying to exist — create it.

What the client controls

Two of the four layers belong to the client, and nothing on your side touches them:

  • The access profile — the grant itself. The client can change it, suspend the relationship, or revoke it at any time, effective on your next request.
  • Person restrictions — the client can block specific permissions for a named individual from your practice, whatever their role says. A restriction survives you unassigning and reassigning the person, and even survives the relationship ending and being re-established later. Only the client can lift it.

So if a staff member lacks a permission you are sure their role includes, check the order: did the client grant it at all, did a customisation remove it — or has the client restricted that person? The last one is only visible on the client's own panel, so it may take a phone call.

Worked examples

A trainee joins the firm. Amelia is invited from the Members tab with the built-in Staff firm role — she can administer nothing in the firm, which is correct. The practice has a Trainee client access role: customers, sales documents and banking, no sensitive permissions, no reports. She is assigned to her eight clients from her member page in one action, Works under: Trainee. In every client she sees exactly the trainee set — except one client whose grant is Bookkeeper-level and never included reports anyway; there the grant narrows her further still. Nobody had to think about that: the layers did.

Promotion, without giving away the keys. Two years on, Amelia runs the office rota. She gets a custom firm role, Practice manager: Manage staff and Assign staff to clients — but not Manage roles or Manage sponsorships. She can now invite juniors and build the rota. She cannot author roles, and the grant ceiling means she also cannot invite anyone above her own authority or hand out a role containing sponsorship powers — so there is no path from running the rota to controlling the firm's money. Her client-book access, meanwhile, has not changed at all: that still comes from her client access role on each assignment.

Year-end cover, one client only. During year-end at Mistral Ltd, Amelia temporarily needs to post journals — a permission her Trainee role does not include, but which Mistral's Accountant-level grant does. Rather than promote her everywhere, the partner opens Mistral's page, selects Customise next to Amelia, ticks the accounting permissions, and saves. The exception shows on Mistral's page and on the practice's Customised access list until February, when Reset to role puts everything back. The other seven clients never saw any change.

The client draws a personal line. One client had a difficult history with a former employee of the practice, who has since returned to the firm. Without involving the practice at all, the client opens Restrict next to that person's name on their Accountants & advisers panel and blocks the sensitive permissions for them personally. Whatever role or customisation the practice ever applies, those actions stay blocked for that individual in that organisation — and if the person is unassigned and later reassigned, the restriction is still waiting.

Troubleshooting

  • A permission in the firm-role editor won't stay ticked, or saving is refused. You are hitting the grant ceiling — you cannot put a permission you do not hold into any role. Ask an owner or a suitably-permissioned colleague.
  • I can't edit the Administrator or Staff role. Built-in roles are read-only by design — create a custom role instead.
  • I can't delete a role. It is in use. The roles list shows how many members or assignments use it; move them first.
  • A staff member can't do something in a client, and I'm sure their role includes it. Check the layers in order on the client's page: is the permission in the client's grant at all? Does a customisation remove it (an N customised badge shows next to their name)? If both look right, the client may have restricted that person — only the client can see or lift that.
  • Set role / Customise buttons are missing. They need the Assign staff to clients firm permission; the role editors need Manage roles. Check your own firm role on the Members tab.
  • I reactivated a returning member and they instantly had client access again. By design: assignments survive deactivation, so reactivation restores every client they were still assigned to. If their client list should have changed while they were away, review their assignments before (or straight after) reactivating — see when a staff member leaves.
  • I demoted an owner by mistake. Any current owner can transfer ownership back from the Members tab. If there is no other owner, the demote would have been refused — the last owner is protected.
Was this article helpful?

Help topics