Team and permissions

Team and permissions decides who can see and send what in Messages. Ministry leaders work only with their own ministries; the communications lead looks after church-wide messages; a few admins manage the access itself. Everything follows the church's ministry leader data-sharing policy, which is still proposed and waits for leadership's approval.

When to use this

• A new ministry leader needs to write to their ministry.
• Someone's role changes, or they step down.
• A permission's review date has come round.
• A leader asks "why can't I see that list?", and you want to see exactly what they see.

Roles

Every staff account has one role:

Role	What they can do in Messages
Super admin	Everything an admin can, plus manage other admins and use View as.
Admin	Assign roles and ministry permissions (except to admins), review the logs, manage lists.
Communications lead	Write to any list that isn't sensitive, send church-wide messages, and approve or decline leaders' messages.
Ministry leader	Work with their own ministries only, using the switches given for each one.
Viewer	See list names, sizes and sent messages for lists that aren't sensitive. No people, no contact details, no sending.

To change someone's role, select them in Staff and choose a new Role. Nobody can change their own role, and only a Super admin can change an admin's.

Super admin

Super admins are kept to two or three people, appointed by leadership in writing, and they sign in with a second factor. They're the only people who can make or change admins and use View as. Super admin is a role you assign here, never a name in the system's code.

Give a leader a ministry

A ministry leader starts with nothing: no lists, no people. To give them their ministry:

1. Select them in Staff.
2. Under Ministry permissions, choose the ministry in Add a ministry….
3. Select Add permission. It starts with the policy's defaults (below).
4. Adjust the switches if their work needs it, and check What they can see underneath.

Every change is written to the audit trail with your name. To take a ministry away, select × at the end of its row.

The permission switches

Each ministry a leader holds has seven switches:

Switch	Default	What it allows
Members	On	See who is in this ministry's lists.
Email	On	Write emails to this ministry's lists.
Texts	Off	Write texts. Texts cost money and feel more personal, so they're given separately.
Sub-lists	On	Save a smaller list made only from this ministry's members.
No approval	Off	Send without waiting for the communications lead. Without it, each message goes to Approvals.
Guardians	On	For children in this ministry, see their guardians' email and mobile.
Download	Off	Download the member list as a file. It also needs Allow downloads on in the sharing settings, and every download is logged.

Whatever the switches say, a leader never sees other ministries' membership, and never sees giving, medical, custody, screening or pastoral information.

Review dates

Every permission has a review date: 12 months after it's given (or 6, if the church chooses), and always 6 months for a sensitive ministry. After that date the permission stops working until someone reviews it. A permission past its date shows Overdue in red.

To review one, check the leader still serves in that ministry and still needs each switch, then select Mark reviewed. The next review date is set for you.

Sharing settings

The policy's main choices are settings here, so leadership can decide differently without new software:

• Leaders see their own ministry's contact details. On: leaders see email and mobile in full for their own people. Off: they see them masked, and Reveal shows one person at a time, logged.
• Allow downloads (CSV) for leaders. Recommended off.
• Sensitive ministries hidden from the communications lead and admins. Recommended on.
• Permission review period: 12 or 6 months.

Each shows Recommended while it matches the policy, or Changed if it doesn't.

Sensitive ministries

A sensitive ministry is one where simply being a member is private: recovery, grief support, care or counselling-type groups, and any ministry leadership chooses to mark. For a sensitive ministry:

• its membership shows only to people with a permission for that ministry, even admins and the communications lead (with the recommended setting);
• its lists don't appear in anyone else's audience picker, except as a locked entry for the communications lead;
• its permissions are reviewed every 6 months, and contacts can be masked even for its own leader with Mask contacts.

Mark a ministry sensitive under Sharing settings, in the per-ministry table. If you give yourself a permission for a sensitive ministry, it's logged and comes up in the monthly review.

What this person can see

The What [name] can see card shows, for the selected person, every list they can use and, for each one, whether they see members, see contacts (shown or masked), can email, can text and can download, plus whether they approve messages, manage permissions, see the logs or use View as. Locked lists show the reason. Lists not shown are hidden from them entirely.

Use it every time you change a permission: it's the quickest way to be sure you gave what you meant to give. To see the actual screens as they see them, a Super admin can use View as.

The audit trail and access log

Admins see two logs at the bottom of the page:

• Audit trail: every send, test, approval, decision, list, permission and setting change, with who did it, in which role, for which list, and which permission allowed it.
• Access log: every View as session (start with its reason, each page viewed, end), every revealed contact and every download.

An admin who isn't the person being reviewed reads through them once a month, checking that downloads were expected, reveals and sensitive-ministry permissions had a reason, View as sessions stayed within their purpose and 30 minutes, and overdue permissions were renewed or removed.

Good to know

• Consent always wins. A permission to send never overrides someone's opt-out, and children under 13 never receive messages of their own.
• In the sandbox, the Signed in as box at the top lets you switch between synthetic staff accounts to try each role. In the live system you are who you sign in as.
• In production, permissions are checked by the database on every request, not just by the screen.

Top tips

• Start every new leader with the defaults and add switches only when they ask for a reason; it's much easier to give than to take back.
• Put the monthly log review in a calendar with a named role beside it, so it never depends on someone remembering.
• When you mark a permission reviewed, glance at What they can see at the same time: two minutes, and you know the access still fits the job.

Troubleshooting

A leader says their list has disappeared. Their permission is probably past its review date. Check for Overdue and select Mark reviewed if it should continue.

I can't change someone's role. Nobody changes their own role, and only a Super admin changes admins. The hint under Role says which applies.

Download stays greyed out for a leader. Downloads need both the leader's Download switch and Allow downloads in the sharing settings.