Team, roles & floor accounts
When somebody leaves On Lab → Team, press Deactivate next to them. They lose access immediately — their open session stops as well as any future sign-in — and Reactivate brings them back if they return. It deactivates and never deletes. Their name stays on case history, the piece-work ledger and the audit trail, and their assigned cases stay assigned, which is what you need the morning after somebody walks out. You cannot deactivate yourself (use Delete my account for that) and the lab always keeps an admin. A doctor’s portal account is not a team member and is not listed here — it is managed on Office → Dentists. Roles your lab invents. Lab → Roles → + New role builds one from the permission list, each permission scoped to the whole lab, the person’s own rows, their team, or named accounts. A custom role can be somebody’s PRIMARY role — pick it when you invite them, or change it later — not just a second hat. The five roles every lab starts with (Technician, Front office, Billing, Office admin, Manager) are ordinary rows too: edit them, or leave them alone. Changing someone’s role. Lab → Team → the role beside their name is a picker; promoting a technician to manager takes one change. The admin’s own role cannot be changed, only an admin can change a manager’s, and every change is written to the audit log. Roles Admin, manager, technician, front office, billing, office admin. Invite people from Lab → Team (+ Invite team member, pick the role). Every role except admin is reshapeable, and you can add your own — see Roles you build yourself below. (There is also a quick flat list at Production → Workflow → Roles & permissions; it edits the same roles, but only Lab → Roles can set how much of the lab a permission covers.) Roles you build yourself Lab → Roles is the list of jobs in your lab and what each one is allowed to do. The built-in roles (admin, manager, technician, front office, billing, office admin) can be reshaped, and you can add your own — "Ceramist lead", "Shipping clerk" — instead of adjusting people one at a time. The admin role is fixed: whoever runs the lab can always reach everything. How much of the lab a permission covers Each permission on a role carries a scope, which is the part v1 could not express: Everything in the lab — the default, and how every role starts. Only their own work — cases assigned to them, their own numbers. This is how a technician checks their own piece-work earnings without seeing the payroll. Their team’s work — the team they belong to. Create teams at Production → Workflow → Teams (a shift, a department, a cell), then pick each person’s team from the dropdown on their row on Lab → Team. Until a team exists and someone is on it, this scope shows them nothing — which is correct, and worth knowing before you grant it. Named practices only — a territory. An account manager who handles Riverbend and Oakhill sees those two practices’ invoices and no others. Scoping applies to reading a single record too, not only to lists: a case or invoice outside someone’s scope is not found, whether they reach it from a list or by pasting the link. Scopes bound the data, not just the buttons: a scoped person’s list pages return their slice, they are not shown everything with some of it hidden. A second, bounded role Someone’s day-to-day role is on their Team row. A second role can be added on top — "also handles the Riverbend account" — without changing their primary one. An assignment can only ever narrow what the role offers, never widen it, so a bounded role stays bounded however it is handed out. To add one: Lab → Team → the person’s row → Roles. Pick the role, optionally pick how much of the lab it covers, and Add role. The same panel removes one. Per-person permissions Any member's row on the Team page has a Permissions button — grant or revoke individual abilities on top of their role, then Save permissions (Reset to role defaults undoes it). The Preset: Scan only button limits someone to check-in/check-out and nothing else (subscription, migrations, workflow and team admin can't be granted per person). Someone without a permission sees "You don't have access to this page" if they open that page directly. Someone signed in with Google and asked to join A person can sign in to Casetop with Google or Microsoft before they belong to any lab. They land on a setup page with two choices: start their own lab, or ask to join yours — by giving your email address, the one you use for Casetop. If it matches, you get an email and they appear under Asked to join at the top of Lab → Team, with whether they say they are on your bench or a doctor sending you work. We ask for your address rather than your lab’s name on purpose. A lab’s name is public — it is in directories and on the web — so if the name were enough, anyone could work down a list and put mail in your inbox. An address you already gave someone reaches nobody new. If your lab has more than one admin, any of their addresses works. They can see nothing of yours in the meantime. A request is a message, not a key: press Invite on their row and it pre-fills the normal invite (you still pick the role), or Dismiss to clear it. They join only once you invite them and they accept — exactly the same path as anyone else on your team. Dismissing tells them nothing, so a stranger who guessed your lab’s name learns nothing either. Floor accounts — no email needed For technicians who work at a bench and don't use email: Lab → Team → + Floor account (PIN). You set a name and a 4-6 digit PIN; new floor accounts default to Scan only — untick the box if they should also see cases and the queue. They sign in on any shared device at app.casetop.io/floor: enter your lab's 6-character floor code (shown in the Floor accounts — PIN sign-in section of the Team list and in the create panel), tap their name, type their PIN. Scans and case work attribute to the person — no inbox required. Five wrong PINs locks the account for 15 minutes; admins and managers can Reset PIN from the person's row anytime. Deactivated members Someone who is deactivated — or who deletes their own account — moves to a dimmed Deactivated — no access section below the staff list and holds no role, so you can always see at a glance who still has a way in. Reinstating them is an invite, which keeps their history attached to the same person. Productivity & piece rates Casetop credits finished work to the person holding the stage when it closes — 3 units of finishing to Dana, not "a case moved". Office → Insights → Productivity shows units per technician for any date range, with a per-stage breakdown and a CSV export you can hand to payroll. It is worth reading even if you pay hourly: the unit counts answer "who did how much" on their own, and work finished with nobody assigned is called out rather than quietly dropped. If you pay by the piece, set the rates at Production → Workflow → Piece rates: a rate per unit for a stage, with the technician left blank for the lab-wide rate. Add exceptions above it — "finishing is $4.00, except Dana gets $6.00" — and the more specific rate wins. Rates apply to work finished from then on: a period you have already paid never re-prices itself, even if you change or delete the rate afterwards. Sign-in options Email + password, Google sign-in, Microsoft sign-in, or floor PIN. Two-factor (TOTP) is at Lab → Settings → Security — you get 10 single-use recovery codes when you enable it.
This page uses JavaScript to render its full interactive content. Enable JavaScript, or continue reading at
https://casetop.io/docs/team-and-permissions.