Bilflo Team Member Permissions Guide

For admins managing internal back-office staff (recruiters, account managers, billing, payroll, admins). Team members are internal users — different from contractors (who get a contractor portal) and client contacts (who get the approver portal).

Before you start

You need:

• Administrator role (Role 2) — required to create team members and edit permissions
• The new team member’s full name and work email
• A clear answer to: what role do they need (recruiter, AM, biller, payroll, admin)? That drives which permissions to check

---

The model — read this once

Bilflo permissions work on three layers. Understanding them avoids hours of trial-and-error:

Layer	What it controls	Examples
Role	Broad category — sets the type of user	Administrator, Production
Navigation permissions	Granular menu/feature access	Can see Billing, can create Invoices, can access Settings
Super User flag	Override switch — unlocks everything	One toggle, used sparingly for owners/leads

A team member needs both a role AND navigation permissions to do anything useful. Setting a role alone gives them login access but an empty sidebar.

Roles for internal team members

The roles that matter for back-office staff:

Role	When to use
Administrator	Most back-office staff: recruiters, AMs, billing, payroll, ops
Production	Limited access: timecard review, PTO, production dashboard. Use for floor supervisors or timecard-only roles

---

Step 1 — Create the team member

1. From the sidebar, click People → Team Members.
2. Click + Create New (or New) at the top of the list.
3. You land on the Team Member Detail screen (URL: /people/team-members/new).

Fill in the form:

Section	Required fields	Notes
Personal Information	First Name, Last Name	Email is needed if you want them to log in
Team Member Type	W2, 1099, or None	Pick None for back-office team members; pick W2/1099 if you’re also paying them through Bilflo
Taxes	State/Federal filing (W2 only)	Skip if Team Member Type = None
Work Status	Full Time / Part Time / Term + effective dates	Affects reporting, not permissions
Compensation	Hourly / Salary / Burden	Only matters if you’re paying them through Bilflo
Active / Registered	Checked by default	Uncheck Active to disable login

4. Click Save.

The team member exists but can’t see anything yet — no role and no permissions.

---

Step 2 — Assign a role

From the team member’s detail page (or the Team Members list, click their row), open their profile and set the Role dropdown.

For most internal back-office staff: pick Administrator.

For timecard-only / floor supervisor roles: pick Production.

Save the profile.

---

Step 3 — Set navigation permissions

This is where you control what they actually see and can do.

1. From the Team Members list, click the Permissions button (or icon) next to the team member’s row.
2. You land on the Permissions screen (URL: /people/team-members/permissions/{userId}).

You’ll see:

• Super User checkbox at the top — leave unchecked for normal staff; check only for owners/leads who need to bypass all permission gates
• Receive Approval Notifications — appears if Super User is checked
• A hierarchical checkbox tree of features grouped under: Billing, People, Reports, Tools, Settings, Production, Approvals

Check the boxes for what they need. Each parent reveals child permissions; each child can reveal grandchildren.

3. Click Save.

Important: the team member must log out and back in for new permissions to take effect (JWT token caching).

---

Common role recipes

Use these as starting points — adjust per individual.

Recruiter / Account Manager

Goal: see their book of business, set up jobs, approve time, view reports.

• People → Clients, Contractors
• Billing → Jobs (Setup, Approval), Contract (Setup, Starts, Overview, Approve Time, Missing Time)
• Reports → Dashboards, Contract Summary, Sales & GP

Billing Clerk

Goal: generate, deliver, and track invoices; check time before billing.

• Billing → Contract (Approve Time, Missing Time, Bulk Time), Invoices (Create, Deliver, History)
• Billing → Accounting (Sync, Export) if they push to QuickBooks
• People → Clients, Contractors (read-only is fine — they need to look records up)
• Reports → Sales & GP, Custom Field

Payroll Specialist

Goal: review approved timecards, prep payroll exports.

• Billing → Contract (Overview, Missing Time)
• Billing → Accounting (Sync, Export, Payments)
• Reports → Payroll, Census, Work Comp
• Settings → Burden (read-only if just viewing)

Operations / Production Supervisor

Goal: approve timecards, manage PTO requests, watch the production dashboard. Use Role: Production here.

• Billing → Contract → Approve Time
• Production → Dashboard, Timecards
• Approvals → all
• Paid Time Off

Back-office Admin / Lead

Goal: everything plus settings, integrations, burden config.

• Check Super User OR
• Grant all of Billing, People, Reports, Tools, Settings, Production, Approvals
• Settings → Company, Pay Bill Items, Custom Fields, Global Lists, Benefit Time Rules, Email, Invoicing, Burden, Billing, Integrations

---

Settings permissions worth special care

These can change company-wide config that affects every invoice, payroll, or contractor. Restrict tightly:

Permission	What it touches
Settings → Burden	Company-wide burden rates — wrong number changes every GP calc
Settings → Pay Bill Items	The catalog of pay/bill items used on every Contract Job
Settings → Recalculate B-GP	Triggers a company-wide recalc — heavy and irreversible
Settings → Integrations	API credentials for Bullhorn, QuickBooks, Everee, etc.
Settings → Billing	Invoice template, numbering, defaults
Accounting → Import / Sync	Pushes/pulls financial data to/from QuickBooks

Keep these to leads and admins only.

---

Updating a team member’s permissions

1. People → Team Members → click their row → Permissions button.
2. Check or uncheck what’s needed.
3. Save.
4. Tell them to log out and back in — token cache is the #1 reason people think permissions “didn’t save.”

---

Deactivating vs. removing a team member

What	Effect	When to use
Active unchecked on their profile	Soft-disable; they can’t log in, record stays in reports	Leave of absence, short-term suspension, history retention
Remove role	Strips all access but keeps profile	Demoting someone or rebuilding access from scratch
Delete (Actions → Delete on the detail page)	Hard delete	Only if the record was created by mistake; otherwise prefer Inactive

Don’t delete a team member who has ever approved a timecard, generated an invoice, or owns a Contract Job — you’ll orphan history. Use Inactive instead.

---

Common pitfalls

Issue	What to do
New team member logs in and sees a blank sidebar	They have a role but no navigation permissions — go to People → Team Members → Permissions and check the boxes for what they need
Changed permissions but the team member still can’t see the new menu	They need to log out and log back in for the JWT token to refresh
Accidentally removed your own admin role	If no other Administrator exists, you’re locked out — contact Bilflo support; ensure at least one other Administrator always has full access
Can’t find the Permissions button	Only Administrators see this button — confirm your own role
Team member can see menus they shouldn’t	Check the Super User checkbox on their Permissions page — if it’s on, they bypass all granular gates. Uncheck it if not intended
SSO-provisioned user has Bilflo login but no sidebar	SSO auto-creates the user but doesn’t auto-assign navigation permissions — go to their Permissions page and check the right boxes
Permission shows in tree as available but they still get an “access denied” page	Some pages do server-side role checks in addition to navigation checks — confirm they have the right role (Administrator vs Production matters here)
Removed someone’s role but they can still see menus	Sidebar caches client-side until next login; force a logout

---

Permission cheat-sheet (most-used)

The full system has ~67 navigation permissions. The ones you’ll touch most:

Permission	Unlocks
Billing	Billing parent menu
Contract Jobs (Create)	Create new Contract Job
Approve Time	Approve timecards
Missing Time	Missing Time list
Direct Hire (Create)	Create Direct Hire placement
Invoices → Create	Create invoices
Invoices → Deliver	Deliver invoices
Invoices → History	Invoice history
Accounting → Sync / Export / Import	Push/pull with QuickBooks
People	People parent menu
Clients	Clients list & creation
Contractors	Contractors list & creation
Team Members	Team Members list & creation (needed to manage other team members)
Reports	Reports parent menu
Reports → Dashboards / Sales & GP / Payroll / Work Comp / Census	Specific reports
Settings	Settings parent menu
Settings → Company	Company-level config
Settings → Pay Bill Items	Pay/bill item catalog
Settings → Integrations	Bullhorn / QuickBooks / Everee credentials
Settings → Invoicing	Invoice templates and defaults
Settings → Burden	Burden rates and items