Roles & permissions

Roles & permissions

The Property module ships with 24 fine-grained permissions and a pre-built Property Manager role. Tenants who want different defaults can adjust everything through the Roles UI under Settings → Roles.

The 24 permissions

For each of the six entities — Property, Renter, Lease, Lease payment, Property legal case, Property reminder — there's:

• view_any_* — see the resource in the sidebar and on the index page
• view_* — open a single record's edit page
• create_* — add a new record
• update_* — edit an existing record
• delete_* — soft-delete a record (it goes to the recycle bin and can be restored within 30 days)

There's no separate download_document permission — document download is gated by the parent record's view_* permission. If you can view the property, you can download its documents. Whether you can upload new documents is gated by update_property (or the lease/renter equivalent).

Default role grants

When you toggle the property feature on, three roles get the full set:

• Owner — every tenant has one Owner; this is the account that signed up.
• Admin — typically the IT team or HR head. Same property powers as Owner.
• Property Manager (auto-created) — for staff whose job is the property book. Has all 24 permissions; nothing else from the wider HR system.

Granting to existing roles

If you have a custom role like "Operations" or "Finance" and want them to see properties:

1. Go to Settings → Roles in the sidebar.
2. Open the role.
3. Tick the property permissions you want them to have. The list is grouped under "Property" so you can grant the whole group with a single header click.
4. Save.

Spatie's permission cache picks up the change on the next request — no log-out needed.

Read-only access

A useful pattern: give an auditor or board-member role just the view_any_* and view_* permissions across all six entities. They can browse properties, leases, payments, legal cases, and read documents — but can't change anything.

Where to next

• Property module overview
• General docs on the Roles & permissions page