Staff & roles

Staff are the humans on your side of the tenant — owners, managers, support agents, contractors. Each staff record carries an email, optional avatar, department membership, and a Role that resolves to a permissions bundle (read/write/admin per resource type). The Settings → Roles screen lets you clone the built-in templates (Owner, Manager, Staff, Read-only) and tweak permissions at a per-resource granularity. Department membership combined with role gates row-level visibility — e.g. a Sales-department user with Manager role only sees opportunities owned by their department.

Two-factor authentication is enforced per tenant policy; staff enroll TOTP on first sign-in when policy requires it.

Related endpoints

• GET /api/tenant/staff — list members.
• POST /api/tenant/staff — create (does not send invite — see Invite your team).
• PATCH /api/tenant/staff/:id — update role / department.
• POST /api/tenant/staff/:id/disable — soft-disable; preserves audit trail.
• GET /api/tenant/roles — list role templates.

See the source at apps/web/src/app/(tenant)/staff and apps/api/src/staff. Permission resolution lives in packages/permissions.