# Recommended Gladstone 360 Roles and Permission Levels

HTML version: [Recommended Gladstone 360 Roles and Permission Levels](https://support.gladstonesoftware.cloud/gladstone360/recommended-gladstone-360-roles-and-permission-levels)

## Problem
Administrators need to decide which Gladstone 360 roles to create and what each role should allow, so front-of-house staff can serve customers while sensitive actions stay with supervisors and administrators.

## Resolution

1. **Choose your role levels**
   - Each module has roles such as **Admin** (usually everything allowed) and **Standard** (lowest level): Access, Contacts, Point of Sale, Security admin, Prospects, Operator. Create extra roles (for example **Supervisor** for Access, POS and Contacts) for a middle tier.
   - Most sites consolidate their Plus2 permission groups into three levels:

   | Level | Typical user | Principle |
   |---|---|---|
   | **Standard** | Front-of-house operator | Routine customer service and sales only |
   | **Supervisor** | Shift leader, duty manager | Authorisations, controlled overrides, cancellations, cash-up |
   | **Administrator** | System owner | Full configuration and security |

2. **Configure the Standard role first**
   - Configure **Standard** first, then build Supervisor and Admin above it. Changes can be flipped later.

3. **Give each user one role per area**
   - Areas: Access, Contacts, Home, POS, Plus2 and Operator (usually *Operator limited*, which gives read-only access to Centre Management).
   - Never give two roles in the same area (for example Contacts standard **and** Contacts admin): the one with **least access** wins.
   - Entries named *service* (BPM, Windows service, access application/service) are for no users.

4. **Set the Point of Sale Standard role**

   | Permission | Typical Standard setting |
   |---|---|
   | POS login, member search, view sales history, view basket | Allow |
   | POS readings (**User Shift**, **Terminal**, **X**, **Z Reading**, **Archived Readings**) | Supervisor, or allow user-shift readings if staff cash up their own shift. Z to designated closing staff. **Show Full POS Reading** is needed to see the variance. |
   | Chip and PIN (customer present/not present), **Reprint last transaction**, **Submit Chip & PIN offline transactions**, print/reprint receipt | Allow |
   | Remove basket items/memberships from basket | Allow |
   | **Refund** vs **Process refund** | Allow *Refund* only, so staff start the refund and a supervisor enters their password to process it. There is no value limit option. |
   | **Pay Later** | Deny (it parks sales and confuses staff) |
   | **Find Invoice**, **Pay Invoice** (pay invoices or booking-account payments at the desk) | Allow if used |
   | **Pay Invoice For Others** (for example one person pays for a couple's swims, each recorded on their own record) | Allow if used |
   | No sale | As policy |
   | Cancel / move bookings | Supervisor |
   | **Apply Membership Discounts (one-off fees only)**, basket discounts (**Apply Discounts**) | Supervisor, unless front of house discounts |
   | **Apply Cashless**, **Apply Loyalty** | Deny (legacy, not supported by Go) |
   | Recent usage, write/view event history | Allow |
   | Documents: add, open general/sensitive | Allow; **delete** and **edit** (for example valid-until date after adding) Deny. Documents aren't deleted automatically for GDPR: admins with delete permission remove them, and Sisense can report on documents held. |
   | Notes, reception and office messages: add, edit, **pass to contacts** | Allow; **delete** Deny |
   | Resend correspondence emails, view correspondence history | Allow |
   | Record attendance, debt alerts | Allow |
   | **Download Installer**, **Automatic Update** (hardware service) | Deny |
   | **View PC Settings** | Allow for the first weeks after go-live (so staff can fix a wrong hardware service), then Deny |
   | **Add / Edit / Delete Till**, **Edit PC Settings**, configuration | Deny |
   | Make bookings, search activities/classes/courses, reprint tickets, access events | Allow |
   | Override waiting (alert) list | As policy |

5. **Set the Contacts Standard role**
   - Turn off the built-in **quick add workflows** (their fields can't be changed) and use your own workflows instead.
   - Contacts login, view memberships, add contact, links, marketing preferences, personal details, contact details, online account (send password reset), cards and ID tokens, user fields: **Allow**.
   - Edit memberships (upgrade/downgrade), edit bank details (triggers a new AUDDIS instruction), status, price level: allow if front-of-house staff do these.
   - Freeze, edit/delete scheduled actions, cancel memberships, cancel in cooling-off, change join or start dates: **Supervisor/Admin**. Standard staff can view scheduled actions.
   - Merging, deleting and structural changes: trained users only.
   - Configure workflows, loyalty: **Deny**.

6. **Set the Access Standard role**
   - Check member allowed entry, view screen layouts, search classes, view booking lists: **Allow**.
   - Add/edit/delete layouts, PC settings, access configuration, entry-point profiles: **Deny** (Access standard: deny PC settings, screen configuration and layouts).
   - **Apply entry overrides** (let someone through after a denial): usually **Deny**, so staff fix the underlying issue instead.
   - **Record multiple attendances** (for example count 50 swim-school children through a gate at once): allow once trained.
   - Heartbeat is a legacy setting.

## Notes

- **Tiles**: without Access, Contacts and POS roles, users don't see those tiles when they log in. To hide a tile nobody uses (for example the old IQ reporting), remove its permission. Home screen tiles are shown alphabetically. Extra roles can cover special cases, for example read-only access for instructors.
- **Alternative approach**: replace Admin/Standard for Contacts and POS with roles that mirror your staff structure, for example **System administrator**, **Contact centre** and **Front of house** (create each separately for Contacts and for POS). Set System administrator to allow everything, then deny everything on the old Admin and Standard roles so they aren't used by mistake. Keep Admin/Standard for **Access**, which has few permissions. Avoid creating lots of roles.
- **Governance**: apply least privilege; don't grant configuration access to avoid a training issue; separate preparing a transaction from approving it; review permissions when staff change role; keep an approved permission matrix; test both allowed and denied actions; remove temporary elevated permissions after go-live.
- **Refunds**: front of house can start a refund and a duty manager authorises it at the same PC without logging in. Keep refunds in 360 rather than Plus2 so till readings stay correct.
- **GladstonePay refunds**: online payments (Go bookings, Go Join memberships, RCP, Pay by Link) are refunded in the **GladstonePay portal**, not with 360 refund permissions. Portal access is a separate login.
- **Leavers**: locking a user in Operator blocks **every** product. Lock the account or remove their roles; don't delete the user. See [Managing Gladstone 360 User Accounts and Passwords](managing-gladstone-360-user-accounts-and-passwords.md).
- Receptionists commonly need freeze and cancel permissions, plus refund (to refund and re-sell when the wrong payment method was used). Decide this per site.
- The **Access module** has two uses: a reception screen showing allowed/denied swipes, and a **class search/register** showing who is booked on each class. The register can run on a tablet in a studio. See [Access Control – Entry Points and Entry Point Profiles](access-control-entry-points-and-entry-point-profiles.md).
- The Operator Centre Management and Block Booking permissions matrix is in [Block Booking Permissions in Go Operator](../gooperator/block-booking-permissions-in-go-operator.md); a summary is in [Gladstone 360 Access, Operator and System Role Permissions](gladstone-360-access-operator-and-system-role-permissions.md). Every individual permission is listed from the [Gladstone 360 Permission Reference Overview](gladstone-360-permission-reference-contacts-pos-and-check-in.md).
- How to assign and edit roles: [Assigning and Creating Security Roles in the GMC](assigning-and-creating-security-roles-in-the-gmc.md).