Skip to main content
Help Centre Support Contact
Partners
Create Free Account
Create Free Account Book a Demo

Roles & Permissions

Give a Branch Manager Admin Rights. Over Their Clients Only.

A contractor with six branches and 40 Clients should not choose between one overloaded national admin and giving every regional manager the keys to the whole account. A Restricted Admin has full admin rights over the Clients they are assigned to, and no visibility of the rest.

Book a Demo See What It Covers
  • Large Contractors
  • Labour Hire
  • Facilities
  • IT & Security
Full admin rights, scoped to assigned Clients only

What a Restricted Admin Is.

A Restricted Admin is a ComplyFlow user type for large contracting businesses. They carry full administrator rights, including managing Workers, plant, licences, and site access, but only for the Clients they have been assigned to. The rest of the contractor’s account is invisible to them.

  • Full rights, narrow scope. Not a cut-down admin who has to escalate. Everything an administrator does, over the Clients they own.
  • Set on the person, in two ways. Change a Worker’s user type, or assign it automatically when someone registers with a matching ABN and email domain.
  • It solves a real handover problem. A new contractor administrator can be working the same day rather than waiting on a support request.
  • Workers, plant, and site access, all of it. Add Workers, manage their licences and categories, and handle the site access their Clients require.

What It Covers

What a Restricted Admin Can Do, and Where It Stops.

Everything below is in the product today and documented in the Help Centre.

What They Can Do

Where It Stops

  • Other Clients are not visible

    Not restricted from editing them; not shown them at all.

    • Scoped

  • No account-wide settings, opens the Help Centre in a new tab

    Company-level configuration stays with the full account administrator.

    • Account level

  • Other Clients’ Workers are not visible

    Workers linked to a Client they do not hold stay out of their view.

    • Per Client

  • Every action is attributable

    The audit trail records who did what, which is the point of scoping in the first place.

    • Audit trail

How It Is Assigned

  • Change a Worker’s user type, opens the Help Centre in a new tab

    The direct route: promote an existing Worker to Restricted Admin and name their Clients.

    • Manual

  • Automatic on matching ABN and email domain

    Someone registering with a matching ABN and company email domain can be assigned the role automatically.

    • Automatic

  • Same day, no support ticket

    A new contractor administrator is working immediately rather than waiting on a request.

    • Immediate

  • Reassigned when people move

    Change the Clients on the role when a manager changes region; nothing else has to move.

    • Per Client

  • Works with parent and child sites, opens the Help Centre in a new tab

    Where a Client runs a parent and child site structure, scope follows it.

    • Site structure

Every item links to the Help Centre article that documents it.

How It Works

The Problem, the Role, and What Nobody Sees.

Three screens on a contractor with six branches.

One National Admin Is a Bottleneck and a Risk.

The usual arrangement is one head office administrator for the whole contracting business. Every new Worker in every branch waits on that person, and when the business gives a regional manager access to unblock it, that manager can now see and change every Client the business holds.

  • Every branch queued behind one person
  • Or one person with far more access than their job needs
  • Neither is a position anyone chose deliberately

Full Admin Rights, Over the Clients They Actually Serve.

Promote the branch manager to Restricted Admin and name their Clients. They add Workers, manage licences and categories, handle plant, and sort out site access, for those Clients. Nothing about their day requires an escalation to head office.

  • Workers, plant, licences, and site access
  • Assigned by user type or automatically by ABN and email domain
  • Working the same day, with no support request

Staff Permissions Overview

The Other Thirty-Four Clients Are Not There.

A Restricted Admin is not shown the Clients they do not hold, or the Workers linked to them. The people they can see are the people they look after, and the audit trail still records every action against the person who took it.

  • Not visible, not merely read-only
  • Workers linked to other Clients stay out of view
  • Every action attributable in the audit trail

Staff Permissions Overview

What You Get

What the Restricted Admin Role Changes.

Large contractors get their branches moving without handing over the whole account.

Branches Stop Queueing

A regional manager adds a Worker on Monday morning instead of emailing head office and waiting until Wednesday.

Access Matches the Job

The person who runs the Sydney contract can administer the Sydney contract. They cannot see what the business does in Perth, because they have no reason to.

Handover Takes Minutes

A new contractor administrator is promoted and scoped on the spot. The old arrangement needed a support request and a wait.

An Audit Trail Worth Having

When access is scoped to the person’s actual job, the record of who changed what is meaningful rather than a list of things the one shared admin account did.

Growth Does Not Break the Model

Adding a seventh branch adds a seventh Restricted Admin, not a seventh reason to widen somebody’s access.

Your Security Team Can Sign It Off

Access scoped to the Clients a person serves, every action recorded against them, and single sign-on with Microsoft or Okta.

Questions

Questions About the Restricted Admin Role.

What can a Restricted Admin actually do?

Everything an administrator does, for the Clients they are assigned to: add and manage Workers, manage their licences and categories, manage plant items, upload documents in bulk, and handle the site access those Clients require. It is not a cut-down role that has to escalate.

Can a Restricted Admin see our other Clients?

No. Clients they have not been assigned, and the Workers linked to them, are not visible to them at all, rather than visible and read-only.

How is somebody made a Restricted Admin?

Two ways. Change an existing Worker’s user type and name the Clients they cover, or let it be assigned automatically when a person registers with an ABN and email domain that match the contracting business.

Why does this exist?

Large contracting businesses run several branches and dozens of Clients. Without it they either put every branch behind one head office administrator, or they give regional managers account-wide access to unblock the queue. Neither is a decision anyone would make deliberately.

Is the audit trail still complete?

Yes. Every action is recorded against the person who took it. Scoping access actually improves the trail, because actions stop being attributed to one shared administrator account that several people use.

More Features

Three More Things ComplyFlow Does That Nobody Asks About in a Demo.

All WHS features

Map Your Branches to Roles in Half an Hour.

A 30-minute session on your own structure: which managers hold which Clients, what each of them should be able to do, and what nobody outside head office should see.

Book a Demo Speak to Us
  • ISO 27001
  • Hosted on AWS
  • Microsoft & Okta SSO
  • API & MCP
  • Data in Australia

Compliance you can prove, instantly.