Permissions
What each role can do, and what role you need to do a given thing.
Permissions are the most common source of confusion in Novapulse. "Why can't I see this button?", "Why does the inbox look different on my colleague's screen?", "Who's allowed to delete a voicemail?" — almost every answer comes down to: what role do you have, and at what scope?
This page explains both sides of that:
- What every role can do (forward lookup).
- What role you need to do a specific task (reverse lookup).
The interactive tool at the bottom of this page lets you ask either question directly.
The mental model
Three concepts decide what any user can do:
- Scope — the layer of the hospital their role applies to. There are four scopes from widest to narrowest: Hospital (the whole organisation), Practice (one department), Workgroup (one team), and Own (just their personal data).
- Level — within that scope, how much they can do. There are three levels: Admin (everything, including delete), Staff (create / read / update — no delete), and Read-only (look but don't touch).
- Membership — for non-hospital scopes, the role only applies to the practices or workgroups the user is actually a member of. A Practice Admin in Cardiology has full control over Cardiology and zero authority over Pediatrics.
A role is the combination of a scope and a level — written as {scope}:{level} in the system, like practice:admin or org:staff. You'll never have to type these strings; the app shows you a friendly label like "Practice Admin." They're listed here so the labels you'd see and the strings you might overhear from our team line up.
The nine roles at a glance
| Role | Scope | Can delete? | Best fit for |
|---|---|---|---|
Hospital Admin (org:admin) | Whole hospital | Yes | The hospital owner / operations lead. |
Hospital Staff (org:staff) | Whole hospital | No | Senior office staff who configure but don't decommission. |
Hospital Read-only (org:user) | Whole hospital | No (view only) | Executives, auditors, anyone who needs a view across practices. |
Practice Admin (practice:admin) | One practice | Yes (inside the practice) | Department lead. |
Practice Staff (practice:staff) | One practice | No | Day-to-day practice staff. |
Practice Read-only (practice:user) | One practice | No (view only) | Consultants or part-time staff who only need to see things. |
Workgroup Lead (workgroup:admin) | One workgroup | Yes (inside the workgroup) | Team leads (head receptionist, surgical lead). |
Workgroup Member (workgroup:staff) | One workgroup | No | Team members. |
Basic User (user) | Their own data | Yes (own only) | Self-service / external collaborators. |
Hospital Admins can do everything Practice Admins can. Practice Admins can do everything Practice Staff can. The hierarchy is strict — each row above subsumes the row below within the same scope.
How the hierarchy works in practice
Authority cascades down the pyramid — a role at any tier can do everything the tiers below it can, within its scope. The apex is the broadest reach (the whole hospital); the base is the narrowest (just your own data).
Broadest authority at the top, narrowest at the base — each tier subsumes the ones beneath it.
A few specific behaviours worth understanding:
Higher scope beats lower scope. A Hospital Admin doesn't need to be added to a practice to administer it — they can manage every practice. A Practice Admin doesn't need to be added to a workgroup to manage it, but they only manage workgroups inside the practice(s) they're a member of.
Workgroup roles imply a small read on the practice. Workgroup Leads and Members can see the list of workgroups in their practice (so they can pick which workgroup to operate inside). They cannot edit the practice itself.
"Basic User" is the floor. Every authenticated user, no matter what other role they hold, can manage their own profile and the voicemails they're assigned to or @-mentioned in. The Basic User role is what's left when only those things apply.
Custom permission sets exist but are rare. Almost everyone falls into one of the nine roles above. If a user has a hand-edited mix that doesn't match any preset, the app labels them as Custom. Only Hospital Admins can create or change a custom permission set.
Explore permissions interactively
Pick a role to see what it can do, or pick a task to see who's allowed to do it.
Whole hospital, full control · org:admin
- Browse the practice voicemail inbox
- See voicemails you're assigned to or mentioned in
- Assign a voicemail to someone
- Mark a voicemail as closed
- Change a voicemail's priority or category
- Delete a voicemail
- See a voicemail's activity history
- See your own mentions
- Add a comment to a voicemail
- @-mention a teammate or workgroup
- Reply to a patient (send the magic link)
- Create a new practice
- View practice settings
- Edit practice settings
- Request a practice deletion
- Approve a practice deletion
- View workgroups in a practice
- Create a workgroup
- Add or remove workgroup members
- Edit a workgroup's priority and category tables
- Delete a workgroup
- View the hospital-wide user list
- View users in a practice
- Create a new user
- Add an existing user to a practice
- Change someone's role
- Remove a user from the hospital
- View phone numbers in a practice
- Add a phone number to a practice
- Delete a phone number
- View schedules and greetings
- Create or edit a schedule
- Upload a greeting
- Set up coverage for yourself
- Set up coverage for someone else
- View a practice Desk dashboard
- View the hospital-wide Desk
- Edit your own profile
- Edit hospital-wide settings
- Update Twilio credentials
Common patterns
A few setups that work well for most hospitals:
- Small practice (1–10 staff). One Practice Admin (the lead), everyone else as Practice Staff. Skip workgroups unless you need group mentions.
- Mid-sized practice (10–40 staff). One Practice Admin, a small set of Workgroup Leads (one per team), Workgroup Members for everyone else. Use this when day-to-day delegation is more important than top-down control.
- Large hospital with many practices. Two or three Hospital Admins, a Hospital Staff for the operations team, then one or two Practice Admins per practice. Most clinical staff are Practice Staff or Workgroup Members.
- External collaborators (locum doctors, on-call specialists). Basic User. They see what they need to see (their mentions, their assignments) and nothing else.
Changing someone's role
Only a Hospital Admin can change a role. See Users → Changing what someone can do.