Roles and permissions: Jobs module

concorbit ships four role presets for the Jobs module that cover the four people who touch field-service work day-to-day. These are starting points: the role master lets you clone or edit any preset to match how your team actually operates.

The four presets

Field Engineer

The engineer on a tablet. Can work a job end-to-end from arrive → start → complete, fill on-site forms, and issue certificates they're qualified for (CP12, EICR, PAT, etc.). They can't create new jobs, reassign, or see the contracts tab: scheduling is someone else's job.

Gets:

• jobs.view, jobs.edit, jobs.complete

• jobs.forms.view, jobs.forms.edit

• jobs.certificates.view, jobs.certificates.issue

Doesn't get: dispatching, create, delete, settings, reports, contracts management, invoicing.

Pair this with the mobile-only seat (£12/month) for engineers who never touch the web UI. The seat enforces /api/mobile/* only, so even a stolen bearer token can't reach the web surface.

Dispatcher

Runs the dispatch board and the live map. Can create jobs, assign technicians, reschedule, and approve customer-portal service requests. Sees compliance (expiring certs) but can't issue certificates or manage job types / labour rates (that's ops).

Gets: everything Field Engineer has, plus:

• jobs.create, jobs.dispatch

• jobs.contracts.view (read-only visibility of PPM contracts)

• crm.view, helpdesk.view (so they can pull context on the customer)

Doesn't get: jobs.settings, jobs.invoice, jobs.contracts.manage.

Ops Manager

Runs the field-service business. Everything the Dispatcher has, plus the keys to the module: job type configuration, labour rates, PPM contract management, operational reports, and invoice generation.

Gets: everything Dispatcher has, plus:

• jobs.delete, jobs.invoice, jobs.settings

• jobs.contracts.manage (create / pause / resume / cancel / renew)

• jobs.reports.view (operational dashboard)

• jobs.certificates.delete

• billing.view

Doesn't get: jcp.view. JCP is the money side (revenue, labour cost, margin per job). That's a separate permission reserved for directors / owners. See JCP overview for the split.

Office

The back-office invoicer. Doesn't do field work, handles the invoicing flow once a job closes. Can see completed jobs to confirm billable status, run the invoice generator, and own the billing module. No dispatch, no edit, no field activity.

Gets:

• jobs.view, jobs.invoice

• jobs.certificates.view (look up cert status for the customer)

• jobs.contracts.view

• jobs.reports.view

• crm.view, billing.view, billing.edit

Doesn't get: any edit permissions on jobs themselves.

Onboarding a new engineer

1. Settings → Users → Invite user. Enter their name + work email + pick Field Engineer from the role dropdown. Set mobile-only on the seat if they never need web access (saves £18/month vs a full seat).

2. The invitation lands in their inbox with a magic link + the concorbit mobile app QR code.

3. Once they accept and log in on mobile, go to Jobs → Settings → Technicians on the web and fill in:

   • Reg numbers (Gas Safe / NICEIC / NAPIT / F-Gas): used as the engineer's signature line on certificate PDFs

   • Skills: free-form tags (gas, electrical, heat-pump, fire-alarm, etc.); the dispatcher's skill-match warning uses these

   • Service area: postcode + radius, used by the dispatch-board auto-suggest

   • Max daily jobs: capacity check so the dispatcher can't over-book them

4. Assign them their first job from the dispatch board. They'll see it appear on mobile + get a push notification.

Swapping a role later

Roles are reassigned from Settings → Users → pick user → Roles. The change takes effect on their next login (or immediately if they're online, since the session re-checks permissions on every request).

Don't demote a Dispatcher to Field Engineer mid-shift. In-flight jobs they were assigned don't lose their assignment, but new jobs they created won't appear in their list once jobs.create is revoked.

Reseeding the presets

If you've edited a preset and want to restore the defaults, run:

php artisan db:seed --class=Database\\Seeders\\RoleSeeder

This is idempotent: it upserts the four roles per tenant and doesn't touch any custom roles you've created. If you've renamed one of the presets, the seeder recreates it with the default name alongside your renamed copy.

Custom roles

The four presets are is_system = false: they're seeded as starting points, not immutable. Use Settings → Roles to clone any of them, tweak the permission checkboxes, and save under a new name. Common custom roles:

• Senior Engineer: Field Engineer + jobs.certificates.delete (can retract a cert they issued in error)

• Trainee Engineer: Field Engineer minus jobs.certificates.issue (can work jobs but can't sign off compliance)

• Regional Ops Manager: Ops Manager plus jcp.view (for directors running the ops P&L)

• Accounts Receivable: Office plus jobs.reports.view (for customer profitability analysis)

Permission reference