Team
Two scopes of access — organization roles that cascade to every event, and event roles granted one event at a time — plus the built-in system roles.
Bookitive's access model has one elegant idea: two scopes. Organization roles apply everywhere; event roles apply to a single event. That's how the same system gives a co-owner the keys to everything and gives a one-night volunteer scanning rights to exactly one door — and nothing else.
The two scopes
- Organization roles cascade. An org Admin can manage every event automatically; they never need to be added to events one by one.
- Event roles are single-event. A Scanner granted on Saturday's concert can check in that concert and can't even see the rest of your organization. This is the mechanism for trusted-but-limited helpers.
Roles add up. Give someone both Box office on one event and Scanner on another and they hold each where you granted it; permissions never subtract.
The system roles
Six built-in roles cover the common shapes; their grants are fixed:
| Role | Scope | What they can do |
|---|---|---|
| Owner | Org | Everything — the full organization. |
| Admin | Org | Everything except deleting the organization and managing billing. |
| Member | Org | View access to events, sponsors, customers, and reports — but not exporting customer data. |
| Event manager | Event | Every action on one event. |
| Box office | Event | Sell and manage orders for one event — but not refund. |
| Scanner | Event | Check in one event. Deliberately no reports. |
Need something in between? Build a custom role from the full permission catalog.
Where team management lives
- Settings → Members — organization members and their org roles.
- Settings → Roles — the role catalog, including custom roles.
- Event settings → Team — per-event staff.
- Settings → People — the people directory merging all of the above into one view.
A thoughtful boundary: refunds need the orders.refund permission, which Box office doesn't have — so "can sell tickets" never silently means "can move money back out of your account." Several such lines are drawn on purpose; the permissions reference lists them all.
Related
Sending & compliance
Your own SMTP/IMAP mailboxes for sponsor outreach, the suppression list, the footer opt-out, AI refusal detection, and the legal stance behind cold-contact rules.
Members and invitations
Invite people to your organization by email, how acceptance creates an account and grants roles, and the token-based invite that needs no prior account.