Admin
Full setup, settings, billing, import/export, user, and integration control.
Shared access model
Roles And Permissions
All current Ovion apps use role-based access patterns. Keep this shared setup light, then use each app's module pages for product-specific permission names and workflows.
Leastprivilege by default
Manager
Operational oversight, approvals, assigned records, reports, and team workflow control.
Staff
Daily work surfaces with restricted settings and record visibility.
Portal
Client, employee, patient, or customer access depending on the product.
Safe Rollout
- Create the first admin during installation.
- Review the generated permission catalog before adding real staff.
- Clone roles for managers and staff instead of editing admin permissions directly.
- Test portal/client access with a seeded demo user before inviting real users.
- Limit integration, webhook, payment, payroll, and export permissions to trusted administrators.
App-Specific Permission Areas
| App | High-risk permissions |
|---|---|
| OvionDesk AI | AI settings, knowledge training, billing, workspace/license operations, Envato verification, webhooks, inbox exports, and widget domain control. |
| AttendPro | Payroll, attendance corrections, device/API capture, reports, employee data export. |
| SupportDesk | SLA changes, automations, public support, AI actions, organization contracts. |
| Operix | EMR, billing, pharmacy, patient data, clinic tenancy, AI review. |
| BookFlow | Tenant settings, wallet/payment changes, no-show controls, staff calendar, program credits. |
| RevenuePilot CRM | API clients, webhooks, invoices, payment gateways, portal files, AI operator actions. |
| Metrivo AI | Accounting periods, journals, tax controls, stock corrections, import/export, POS overrides, payment settings, and permissions catalog changes. |
| SupportHub | Automation playbooks, public support, organization contracts, AI copilot actions, reports, API clients, delivery diagnostics, and case file exports. |