Manage staff and roles

Every person who touches Thermal — whoever answers the phone, dispatches jobs, or works a truck — gets a staff record with a role. The role decides what they can see and do; you don't configure access separately from adding the person. This guide covers adding and managing any staff member. If you're specifically bringing on a field technician, Add a technician walks the same steps with the technician's-eye view of what they land in.

The four roles

Owner — full access to everything, including Integrations. A company needs at least one; Thermal won't let you demote your last remaining owner.
Office — full access except Integrations. The right role for CSR, billing, and back-office staff who run the business day to day but shouldn't be connecting QuickBooks or Stripe.
Dispatcher — the work surface only: dispatch, jobs, customers, agreements, quotes, invoices, reports, equipment, and inspections. No Staff, Price Book, Settings, Integrations, Inventory, or Purchasing.
Technician — no office-app access at all. A technician signs in to the separate field app (/tech), scoped to their own assigned jobs, schedule, and van inventory.

The standard area-by-role access matrix is a source snapshot in Roles & permissions. Your current version, custom roles and per-person access may differ.

Custom roles and per-person access

An owner can go further than the four roles. In Settings → This company → Roles, create a custom role: it starts from Office, Dispatcher or Technician and can only take access away, so it is the way to give a group of staff less than their base role. Assign it from the person's staff form. See Roles.

A staff record also has an Access section. It shows the person's role, custom role and any exceptions. An owner can allow or remove a single permission for that one person; an office user can only remove one. Nobody changes their own access or an owner's, and each change is recorded with who made it and when.

Single sign-on is not offered. People sign in with email and password or a one-time code.

Billing administrator is a grant, not a fifth role

An org-wide owner can give a staff member the billing administrator grant from Settings → This company → Plan (the Billing section). It is a boolean on that person's staff row in this org (users.billing_administrator), not a Staff role you pick when adding someone. Technicians are not eligible.

A delegated administrator, on an org-wide session, sees the same Plan & usage finance as an owner: estimate, statement, payment method, Thermal invoices, and billing contacts. They cannot grant the role to anyone else. A branch-scoped session stays branch-scoped even with the grant — it never lifts someone into org-wide private finance. Details: Plan & usage.

Add a staff member

Open Staff and choose Add staff.
Enter their First name, Last name, Email, and Phone. The email is what they'll sign in with — leave it blank and the person is added as a record (assignable, has a name) but gets no login.
Set Role to the built-in role that matches what they should see and do (above). To give them less than that role, pick a Custom role once the person is saved (see above).
If the company has more than one branch, set their Branch — this only appears once you've set up a second branch. See Set up branches for what a home branch controls.
Optionally fill in Hire date, Base rate ($/hr), and Labor level — used for payroll and job-costing reports, not required to get someone working.
Fill in Payroll employee id if you export hours to a payroll provider (ADP Employee Id, and so on). It's optional to add the person, but a provider-format export refuses the whole file until every included employee has one. Pick the export format under Settings → Invoicing (Payroll export format — Generic CSV, or ADP RUN — Time Sheet Import). Then export from Time entries with Export payroll.
Leave Status on Active. On leave is for someone temporarily out — it doesn't remove their access, just flags their status.
Choose Add staff. If you entered an email, Thermal sends an invite — the person sets their own password from there. Until they accept it, their row shows Pending invite.

Skill proficiency

On a technician's staff record, the Skill proficiency tab grades each certification they already hold on a 0–5 scale. Grades refine dispatch suggestions among already-qualified techs — they never block a job match, and an ungraded certification scores neutral. Saving a grade keeps the prior row (who graded, when) rather than overwriting it; Clear soft-deletes the live grade.

Only Owners and Office can grade. There is no technician-facing view of these numbers in v1. Dispatch scoring is described in Schedule and assign a job.

Manage an existing staff member

Open any row from the Staff list to edit their name, role, contact info, hire date, base rate, payroll employee id, or status. A few things worth knowing:

Changing someone's role takes effect immediately — the next time they load the app, their access matches the new role. Downgrading a Dispatcher to Technician, for instance, moves them out of the office app entirely.
You can't demote your last owner. If a staff member's row shows they're the only owner left, the Role field is locked until you promote someone else to Owner first.
A blank email that gets filled in sends a fresh invite — useful for a technician you added without one who's now ready to sign in.
Adding an email or deactivating someone updates their access on Thermal's side (Clerk) automatically — there's no separate "revoke access" step beyond changing their status.

Reference

Area access by role and default branch visibility by role — generated from lib/rbac.ts and the branch-scope resolver — are in Roles & permissions.
Who can reach Staff — Owners and Office users. See the same reference for the full matrix.