The money question
Two separate switches, because they're two separate questions
An engineer might reasonably see neither. An office administrator needs the first and not the second. That distinction simply isn't available in software that ships three tiers.
Switch one
What this job is worth
Prices, line totals and document totals on quotes, invoices and job sheets. Turned off, they can work the document without seeing what it's worth.
Hidden in all three places
- In the listno totals column
- On the document on screenlines without prices
- And on the PDF it generatesthe one others leak
That last one is where other systems fall over: the screen hides the price and the PDF they email the customer doesn't.
Switch two
What the company is worth
Turnover, paid, owed, overdue and the trend chart on the dashboard. Turned off, they keep the dashboard and lose every company-wide total on it.
Their dashboard, with it off
Every switch, all 116
A permission called “View dashboard” tells you nothing
You already know what happens when it's on. The only thing you actually need to know is what happens to that person when it's off — so every switch in OnPoint says so.
View dashboard
OFF gives them the simplified Today screen — their own jobs for the day and nothing else. The sidebar and every other permission are unaffected.
See prices on documents
OFF lets them work the document without seeing what it is worth.
View the reminder queue
OFF hides the 30-day look-ahead of chase emails and renewal reminders — with the customer, the amount owed and the address on each one.
View the calendar
The master switch for the diary. OFF hides the calendar and every view inside it, whatever the individual view permissions say.
Nobody should have to invite a real person and then ask them what they can see.
That's the difference between a settings screen you can use and one you experiment on for a fortnight until somebody complains.
Try it before you invite anyone
View the app as one of your own roles sees it
So you can check what an engineer gets before there's an engineer to ask. Turn a switch off, look at the result, and adjust it — rather than finding out three weeks later that somebody can't see the diary.
And the property that makes it trustworthy: a preview can only ever hide things. It can never grant a permission the person previewing doesn't already hold — so it's safe to hand to a manager, and it can't become a back door.
Their sidebar
The four rules underneath
These are what make the switches mean something rather than merely look like something.
Nobody can grant what they don't hold
Someone allowed to manage roles shapes access within their own. They cannot build a role more powerful than themselves and then step into it.
The owner always holds everything
Enforced on the server rather than assumed by the interface, so it isn't possible to configure yourself out of your own business.
Hiding a button is not a rule
Every permission is checked on the server as well as in the interface. A switch that only hid a menu item would be a suggestion — the check behind it is what makes it a boundary.
Renaming a permission never silently changes what a role can do
Roles you saved outlive the code that created them, so old spellings keep working deliberately rather than by accident.
An example of what that costs us: when the week view got its own permission, it would have been easy to treat it as satisfied by the day-view permission and skip a migration — but then un-ticking it would have done nothing. A switch that does nothing is worse than the work of doing it properly.
The team itself
Suspending is not the same as removing
Someone who's left mid-dispute, or a phone that's gone missing, needs access stopped now — without erasing who did what on which job.
Invite people
Into a role you've already checked with the preview.
Change someone's role
An apprentice becoming an engineer is one change, not a re-setup.
Suspend
Access stops immediately; the record of their work stays intact and still reads properly.
Remove
For when they're genuinely gone. Their name stays on the jobs they did.
£9
a month to add someone, after the £19 first seat
There is no tier where permissions are the upgrade
Which is worth saying plainly, because gating access control behind an enterprise plan is the industry norm — and it's the reason small firms end up sharing one login. Every feature is on every plan here, from the first seat. See pricing.
Straight answers
On what's hidden, and from whom.
01Can I stop engineers seeing prices?
Yes — one switch. With it off they can still complete the job, take the photographs and issue the certificate; they just don't see prices, line totals or document totals on quotes, invoices or job sheets.
02Does that hide prices on the PDF too?
Yes. It applies in all three places the price appears: the list, the document on screen, and the PDF it generates. Hiding it on screen and leaking it on the PDF would make the switch pointless.
03Can I hide company turnover but still let someone raise invoices?
Yes — they're two separate switches. Document prices and company-wide figures are different questions, so an office administrator can price and raise invoices without seeing turnover, paid, owed, overdue or the trend chart.
04Can I make my own roles, or is it fixed tiers?
Your own. You build a role from the individual switches and name it whatever your firm calls that job — rather than picking the least wrong of Admin, Manager and Staff.
05How many permissions are there?
116, and every one of them carries a line describing what happens when it's off.
06Can I see what a role looks like before inviting someone?
Yes. You can view the app as one of your own roles sees it, so you can check what an engineer gets before there's an engineer to ask. A preview can only hide things — it never grants a permission you don't already hold.
07Can a manager create a role more powerful than their own?
No. Nobody can grant what they don't hold, so someone allowed to manage roles shapes access within their own and can't build a bigger one and step into it.
08Can I lock myself out?
No. The owner always holds everything, and that's enforced on the server rather than assumed by the interface — so it isn't possible to configure yourself out of your own business.
09Can I suspend someone without deleting their history?
Yes — suspending stops access immediately and leaves the record of their work intact, which is what you want when someone's left mid-dispute or a phone has gone missing. Removing is separate, and even then their name stays on the jobs they did.
10What does an extra person cost?
£9 a month, after the £19 first seat.
11Is access control on every plan?
Yes. All 116 switches, custom roles and the role preview are on every plan from the first seat — there's no tier where permissions are the upgrade. See pricing.
Build the engineer role, then look at it yourself.
14 days free, no card. Turn the two money switches off, preview the app as that role, and see exactly what your engineer would get before you invite one.