Roles & Permissions
Roles control what each member can see and do in RAM. Each role contains a set of permissions, such as View assets, Edit activities, or Create alerts. Assign a role to a member when their responsibilities require additional access.
Every member begins with basic access through Agency User. Agency Admin provides complete access. Other roles add only the permissions needed for a particular responsibility, such as managing inventory or training records.
Use these companion sections when you need more detail:
- Permission Reference: every permission, as you see it on the Access Roles screen, with what it allows and what it doesn't.
- Starter Roles: the roles every agency starts with, what each allows, and worked examples for common jobs.
- Groups: shared member groups for invitations, alerts and chat. Groups are not permissions.
Every member can manage their own profile, certifications, activity log, and personal settings. No additional role is needed.
Additional permissions allow someone to manage agency information or another member's records. Permission names make this distinction clear. For example, Edit certifications for any member allows access beyond the member's own certifications.
Table of Contents
- How access works
- Agency Admin is different
- Finding the Access Roles screen
- Assigning a role to a member
- Creating and editing a role
- Checking who holds a role
- Removing access
- FAQ
How access works
Think of access as layers. Each layer adds to the access below it.
| Layer | What it gives | Who has it |
|---|---|---|
| 1. Your own records | Manage your own profile, certifications, activity log, and personal settings | Every member, always |
| 2. Agency User (the baseline role) | Look at most areas of the app: assets and storage locations, the team roster, certifications, activities, documents, chat, alerts, and map viewing | Every member, automatically |
| 3. Additional roles | Whatever those roles' permissions allow, such as editing assets or approving attendance | Members you assign them to |
| 4. Agency Admin | Everything in your agency | Members you make administrators |
A few rules follow from this:
- A permission is one specific ability. Edit assets lets someone change asset records; it doesn't let them delete a member.
- A role is a set of permissions. Assigning Inventory Manager grants all permissions included in that role.
- A member can hold more than one role. Their access is the combination of all assigned roles. Overlapping permissions don't cause a conflict.
- Roles only add, they never take away. You can't use one role to block something another role allows. To restrict someone, don't give them the role that grants it.
- Changes apply immediately. If the member already has RAM open and a page appears out of date, refresh the page or sign out and back in.
Their own records, always. Edit their own profile and settings. Add their own certifications, and until one is validated edit, renew, and delete it. Keep their own activity log, check themselves in and out of activities, keep their own gear on My Assets, return gear signed out to them, and see their own Your Qualifications card.
Agency-wide, read only (Agency User). The asset list with values, and storage locations. The team roster and member profiles. Everyone's certifications. The activity calendar. Documents, in the viewer only. Chat, including direct messages and starting group chats. The Rapid Alerts page. Incidents and lost-person subject cards without medical details. Maps.
Not included until you add it. Downloading or printing documents. The asset compliance dashboard and exports. The Qualifications tab. The animals list (a handler still opens their own animals). Anything that adds, edits, or deletes records belonging to others.
Because Agency User includes View members and View certifications, every member can open the team roster and see certification records for the whole agency, not only their own. If your agency wants to limit either area, clear that permission from the Agency User role.
- Clearing View certifications hides the Team Certifications tab. Members can still open the Certifications page and manage their own records.
- Clearing View members hides the roster and other members' profiles. Member lists used for groups, certification assignments, activity invitations, check-in, and access keys still show names and photos, but never email addresses.
Test with an ordinary member account afterward. See the permission's row in the Permission Reference for what each View permission hides.
Who can change access
| Who | What they can do with roles |
|---|---|
| Agency Admins | Create, edit, and delete roles, change which permissions a role includes, and assign roles to any member. |
| A member who holds Edit members | Change the roles of an existing member, from the member's edit page. |
| A member who holds Create members | Choose a new member's starting roles, on the Add Member form. |
| Everyone else | Can't assign roles. |
Both permissions allow a member to assign any non-admin role, including roles with broad access. They can't assign Agency Admin, change an administrator's roles, or change their own roles. Treat Create members and Edit members as powerful permissions.
Every role assignment and removal is written to the audit log.
Agency Admin is different
Agency Admin provides complete access to the agency. Unlike other roles, it does not have a list of permissions you can change. Additional roles do not give an Agency Admin any more access.
| Agency Admin | Every other role | |
|---|---|---|
| What it grants | Everything in your agency | Only the permissions selected on the role |
| Can the permissions be changed? | No, there is nothing to pick | Yes |
| Can it be renamed or deleted? | No (locked) | Starter and custom roles: yes |
| Who can assign it | Agency Admins only | Admins, and members who hold Edit members or Create members (for non-admins) |
| Where an administrator is listed as a holder | Under Agency Admin only, even if they hold other roles | Under each role the member holds |
Some tasks always require Agency Admin: creating or editing roles, assigning Agency Admin, managing billing and the agency plan, opening most Agency Settings pages, and permanently deleting archived records. If someone needs to perform these tasks, they need the Agency Admin role.
What non-admins see in Agency Settings
Members who are not administrators see only the Agency Settings pages their permissions let them use. The Agency Settings tab itself is hidden when there are none. A page is either open to them or not shown at all.
| Page | Who sees it besides Agency Admins |
|---|---|
| Groups | Manage alert groups |
| Certification Templates | Manage certification templates |
| Asset Types and Asset IDs | Edit assets |
| Audit & Logs | View the audit log (read-only; only Agency Admins can change it) |
| Everything else, including Measurement Units | Agency Admin only |
The audit log itself is the Audit Logs item in the left menu. It is unavailable for a member without View the audit log. Audit & Logs in Agency Settings is a separate page that sets how long records are kept.
The last administrator is protected
Your agency must always have at least one active administrator. RAM refuses, with a message explaining why, to:
- remove Agency Admin from the last active administrator,
- change them to a regular member from the member form, or
- suspend or disable their account.
Make someone else an administrator first, then make the change.
Taking Agency Admin away from someone
Removing Agency Admin turns the member back into a regular member. They become an Agency User plus only the roles you choose to let them keep.
While someone is an administrator, any other roles they hold do nothing (administrators already have everything), and those roles do not list them as a holder. So when you remove admin access, RAM asks what they should keep:
- A dialog titled Remove Agency Admin access? names the member and says they will become an Agency User.
- Under Choose which additional roles they should retain, each other role they hold is listed with a checkbox. All boxes are cleared to start.
- Select the roles they should keep, then choose Remove admin access. Roles you do not select are removed.
Editing the member's roles from their member form works the same way. If you clear Agency Admin, a warning lists exactly what the member will retain—Agency User plus any roles that remain selected—before you save.
Finding the Access Roles screen
Go to Agency Settings → Agency Config → Access Roles.
The roles are listed down the left, by name. Each row shows the role's name, a System role or Custom tag, how many permissions it includes, and how many members hold it. Select a role to open it on the right:
- Assigned members: everyone who holds the role, as name chips, with Add member.
- Permissions: groups of permissions, collapsed to start. Each group shows how many are granted ("3 of 7 granted").
The permission groups are listed alphabetically, as on the Permission Reference: Activities, Alerts & Devices, Animals & Animal Medical, Archives, Certifications & Training, Communications & Chat, Documentation, Inventory & Assets, Map access, Membership, Operations & Incidents, and System & Audit.
Assigning a role to a member
There are three ways. Use whichever fits what you are doing.
From the Access Roles screen
Best when you are handing one role to someone. Agency Admins only.
- Go to Agency Settings → Agency Config → Access Roles and select the role.
- Under Assigned members, select Add member.
- Pick the member from the list and select Add.
A message confirms the member was added. Administrators do not appear in the list for ordinary roles, because they already have everything.
From the member's edit form
Best when you are setting up one person's roles together. Needs Edit members.
- Open Team Roster, select the member, and open their edit page.
- Find the Access Roles field and add or remove roles.
- Save.
Agency User is always included. Only Agency Admins can add or remove Agency Admin here, or change an administrator's roles.
When adding a new member
The Add Member form has an Access Roles field too, so a new member can start with the right roles. It needs Create members. Agency User is added automatically.
Creating and editing a role
Create a role
- On the Access Roles screen, select Create access role.
- Enter a Name. Members and admins see it, so keep it short and descriptive.
- Optionally add a Description, such as what the role is for. It helps whoever reads this in a year.
- Select Save.
The new role starts with no permissions. Open it and turn on what it needs.
Faster: open an existing role and select the Duplicate this role icon. The new role starts with the same permissions, named "(copy)", ready for you to rename and adjust.
Choose the permissions
- Open the role and select a permission group to expand it (or Expand all).
- Switch individual permissions on or off. Every change saves immediately, and a message confirms it ("Inventory Manager: permissions saved").
- Use Grant all or Clear all at the top of a group to flip the whole group.
Other tools on the screen:
- Search permissions finds a permission by name or description.
- All / Granted / Not granted filters the list so you can see exactly what a role has.
- Hover over a permission to read its plain-language description.
Dependencies are handled for you. Almost every permission needs the View permission of its own group (you can't edit assets you can't see). When you switch one on, RAM switches on that View permission too. The exceptions: the Qualification permissions switch on View qualifications (not View certifications), and the Archives permissions and Map access switch on nothing. The Permission Reference lists what each permission requires.
When you switch a View permission off while others that depend on it are on, RAM asks Also remove what depends on it? and lists them. Remove all removes the View permission and everything listed. Cancel leaves everything as it was, View included.
Map access works differently. Map permissions build on each other, so a role gets one access level (No access, View, Contribute, Create / Edit map content, or Manage maps), chosen as a single option, plus separate switches for restricting map objects and sharing maps. The levels apply to agency maps: every member also keeps personal maps of their own, worked in full. Contribute is meant for field members: it adds markers and clues to agency maps, changes its own, and deletes nothing. Making agency maps takes Create / Edit map content; copying and moving them takes Manage maps. See Map access for what each level allows, including the roles on sharing links.
Rename or delete a role
- Rename or change the description: select the pencil icon on the role. (Not available for the two system roles.)
- Delete: select the trash icon and confirm. A role that members hold can't be deleted: the trash icon is unavailable with a hint, and RAM refuses the deletion. Remove or reassign its members first. Administrators don't count as holders.
Checking who holds a role
From a role: open it on the Access Roles screen. The Assigned members chips list everyone who holds it, and the count in the heading and in the role list matches. Administrators are listed only under Agency Admin, not under every role.
From a member: the member's profile has an Access Roles card listing each role they hold. Select a role to see the individual permissions it grants; hover over a permission for its description. The card spells some permission names differently from the Access Roles screen (for example "Activities — Generate QR"). They are the same permissions. On the member's edit page, the Access Roles field shows the same roles as chips.
Members can see their own roles but cannot change them.
Removing access
| You want to… | Do this |
|---|---|
| Take one role away from a member | Open the role on the Access Roles screen, select the x on the member's chip, and confirm. They keep every other role and their own basic access. |
| Change someone's roles in one go | Edit the Access Roles field on their member form and save. |
| Take away administrator access | Remove them from Agency Admin (the dialog asks which other roles they keep), or clear Agency Admin on their member form. |
| Take a permission away from everyone with a role | Open the role and switch the permission off. It leaves every member who held it through that role (unless another of their roles grants it too). |
| Retire a role | Remove its members, then delete the role. |
| Stop someone using RAM at all | Change their member status or deactivate them. See Team Management. |
Switching a permission off on a role affects everyone who holds it. If someone also gets that permission from another role, they keep it. Open the role and check Assigned members first.
FAQ
What's the difference between an Agency Admin and a member with lots of roles?
An Agency Admin has full access to everything, including billing and most agency settings. A member with every other role still cannot reach the admin-only areas. If someone needs to manage the agency itself, give them Agency Admin rather than trying to rebuild it from other roles.
Can a member have a permission without a whole role?
There is no screen for granting one permission to one member. Create a small custom role with just that permission and assign it to them. It keeps things consistent and easy to audit.
What happens if I delete a role?
You cannot delete a role while members hold it. Remove or reassign them first. If you want to keep their access, build the replacement role and assign it before removing the old one.
How do I give someone read-only access to equipment?
They already have it: Agency User includes View assets. For something Agency User doesn't cover, such as the asset compliance dashboard, create a custom role with that permission (View asset compliance). The screen switches on View assets with it, which Agency User already holds.
A member's access looks wrong after I changed their role.
Changes take effect for new actions immediately, but a screen the member already has open may not update until they refresh. If something still looks off, ask them to sign out and back in.
Can I stop a specific member from receiving emergency alerts?
Receiving an alert on a phone depends on that device's license, not on roles. Manage which devices are licensed from Rapid Alerts.
Is there a record of who changed which role?
Yes. Role assignments and removals, including who was taken off Agency Admin and what they kept, are written to the audit log (the Audit Logs item in the left menu).
Related Documentation
- Permission Reference: every permission and what it does
- Team Management: adding and managing members
- Agency Setup Guide: initial configuration
- Agency Settings: feature configuration
- Rapid Emergency Alerting: alerts and devices
- Activity Sign-In Sheet: check-in and check-out