Permissions that fit the role

More people work in a building than just the manager: a receptionist, someone for finance, a facilities colleague, perhaps an external bookkeeper. Doory has fine-grained admin permissions with templates such as Finance Controller and Operations Lead, and an approval workflow for sensitive actions.

Why a single admin account doesn't work

Yet that is how many buildings work: one login that everyone uses, or everyone a full admin. As a result, the receptionist can access the contracts and the rents, and when a mistake is made you can't see who made it. When an employee leaves, the password is changed and everyone gets the new one.

What a role determines

What someone sees and what someone is allowed to do. A receptionist needs today's visitors, the parcels and the room calendar, and nothing from the contracts or the invoices. A finance role needs the billing runs, the payments and the reminders, and doesn't need access to the access groups. An Operations Lead sits in between.

The templates are a starting point, not a straitjacket. You start with Finance Controller or Operations Lead and adjust whatever works differently in your building. Permissions apply per building, so someone who manages one location doesn't see the other buildings.

The approval workflow

For actions with consequences, you can require a second pair of eyes. A renewal with a discount, a refund, a credit correction: these then don't go through with a single click. Who requested it and who approved it is on record. For renewal decisions, this is the four-eyes principle that also features in renewal monitoring.

This isn't meant to distrust your team. It is meant so you can show an owner or accountant how a decision was made.

Why this matters for small teams too

If you work with three people, this may seem excessive. Until someone is ill, someone new starts or someone leaves. Roles turn onboarding and offboarding into a one-minute task, and together with the audit log you can always see who did what.

What you need to do once

Decide who gets which role, and which actions are sensitive. Set aside half an hour for this during onboarding, with the people who do the work.