Roles & Permissions

Shelf checks every authorization decision — on the web app and in the companion app — the same way: roleHasPermission({ roles, entity, action }). This page is generated by actually CALLING that function for every role, resource and action, rather than reading the raw role → permission table by eye — because the raw table, on its own, is misleading.

Why: roleHasPermission checks one thing FIRST, before it looks at the table at all — a team member with the Owner or Administrator role can do absolutely everything, on every resource, full stop. Only Self-service member and Base member are actually constrained by the table below. So a matrix built from the raw table would correctly describe those two roles and silently UNDER-report Owner and Administrator — this page can't make that mistake, because every cell it prints came from the same function the app itself calls.

Why we generate this by asking the code

Take Assets (asset). An Administrator is allowed to checkout one — but that permission does not appear in Administrator's raw entry in the permission table at all. Only the short-circuit grants it.

Reading the source table by eye would tell you an Administrator cannot do this. They can. That single case is why every cell below was produced by calling the real function rather than by transcribing the table.

Effective permissions by resource

Owner and Administrator are not in the table below because their row would just be "everything", for every resource — that's the short-circuit. What follows is the real constraint: what a Self-service member (a trusted crew member with wider access than a casual account) and a Base member (the default, most-restricted role) can each do, resource by resource.

Resource	Self-service member	Base member
Assets	view, take/release custody of	view
Asset list column/filter settings	view	view
QR codes	view	view
Bookings	create, view, edit, delete, check out, check in, export, archive, cancel, extend, manage assets on, manage kits on	create, view, edit, delete, export, manage assets on, manage kits on
Booking notes	create, view	create, view
Tags	—	—
Categories	—	—
Locations	—	—
Location notes	—	—
Custom fields	—	—
Workspace (organization) settings	—	—
Team members	—	—
Team member profiles	—	—
Dashboard	—	—
General settings	—	—
Working hours	view	view
Subscription / billing	—	—
Kits	view, take/release custody of	view
Notes	—	—
Scanning	—	—
Custody	—	—
Asset reminders	—	—
Audits (stocktakes)	view, edit	view, edit
Audit notes	create, view	create, view
Team member notes	—	—
Asset models	—	view
Clients	—	—
Call sheets	view	view
Booking crew	view	view
Vehicles	—	—
Vendors	—	—
Transport line items	—	—
Email settings	—	—
Your own account data	view, edit	view, edit
In-app update notices	view	view
Command palette (⌘K) search	view	view
Rate cards	—	—
Quotes	—	—
Client proposals	—	—
Purchase orders	—	—
Label printers / print relays	—	—
Print jobs (label print requests)	create, view	create, view
Client requests (inbound leads)	—	—