Manage access roles

What each person sees and can do on the web is decided by the access role on their contract. Roles are reviewed and edited in the institution’s settings, and assigned in each contract. New roles are created by duplicating an existing one. In the iPhone and Android apps, the tabs are the same for everyone, whatever their role.

See someone’s role

Go to People › Administration › Contracts and open their contract.
The Specialty and position card shows their Access role.

Check what each role allows

Go to Settings › General settings › Team › Access Roles. This card only appears if your access role lets you edit roles.
You’ll see the Predefined roles, which Weikos maintains and can’t be edited, and your institution’s Custom roles.

The predefined roles allow:

Administrator: managing everything in their institution, including access roles.
Administrative: people, contracts, projects, finances and the time records of the whole institution, and all settings except access roles.
Production: the same as Administrativo, with two differences: under expenses and income they only see the ones assigned to them, either as the person responsible or as the one who recorded them, and of the time records they only see their own, not the team’s. They also see other people’s personal contract data trimmed, so they don’t generate or download those contracts’ documents: see Limit personal contract data.
Musician: their calendar, their projects and the sheet music for their instrument, their contract, their leaves and their time tracking. They don’t see the team or the general settings.
Conductor: the same as Musician, with all the sheet music for their projects.
Basic user: the role for people without a current contract. It doesn’t appear in the list.

Create a role

In Access Roles, open the role closest to the one you need and click the Duplicate icon in the action bar, at the top right.
Enter the name and description, and click Create role.
In the new role, choose each section on the left and tick its Actions with their Scope.
Click Save, in the action bar. It saves the whole role, with all its sections, not just the one you have open. The change affects everyone who has that role.

A predefined role has nothing to save: its action bar only has the Close cross, which takes you back to the list, and Duplicate.

Always leave Overview and Calendar ticked. They are the two sections people land on: a role missing either of them leaves the person on You don't have access to this section as soon as they sign in, with no side menu and no way to go anywhere.

In Blocks and fields, almost every block is for information only: it shows the level the actions give, No access, View only or View and edit. Personal contract data is the exception: you choose it separately.

With the Their ensembles scope, the role only works with what belongs to the person’s ensembles: the one in their contract or, if the contract has no ensemble, the ones included in their department. For services, in the projects that include their ensemble they see all of them and can change the ones that include their ensemble and the ones with no ensemble, such as setups or load-outs. Services that only belong to other ensembles can be checked but not changed, and they never select or remove ensembles that aren’t theirs. For documents, they see their ensemble’s and the institution-wide ones, but only upload, edit and delete their ensemble’s, and of personal documents, only those for their people. If you give this scope to someone whose contract has no ensemble and no department with ensembles, the contract warns you: they wouldn’t see anything in those sections.

With the Their department scope, in Contracts, Leaves, Collective leaves and Time tracking, the role works with the people whose contract is in their department or in one of their department’s ensembles. If the person has no department in their contract, the contract warns you too.

In Team performance there is also the Their instrument scope: the person sees the performance of whoever plays their instrument, or one of its family, in their ensembles. Seeing the performance and Compare people are granted separately from seeing the team; See and compare team performance explains it.

Assignment by service also has Their instrument: the person sees the assignment of their instrument in the project roster, and in percussion the whole section’s, whatever their ensemble. Assign musicians to each service explains it.

Limit personal contract data

You can decide, block by block, how a role sees the identity, contact and bank details in other people’s contracts. Everyone always sees their own data in full.

In the role, choose the contracts section on the left and scroll down to Blocks and fields.
In Identity data, Contact details or Bank details, choose No access, Masked, View only or View and edit. The last one is only available if the role can edit contracts.
Expand the block to see how each piece of data reaches the role: Always visible, like the first name and surnames; Last 4 characters, like the ID number; Hidden, like the address; or Not sent, like the date of birth.
If you move a block from viewing or editing to masked or no access, you’re asked to confirm in This role will no longer see personal data in full: the role will no longer be able to generate or download the contract, the basic copy or the certificate, because they carry that data in full. Click Mask to go ahead.
Click Save.

With masked data, the role sees it trimmed in the contract record, with a padlock, and can’t copy or change it. The same goes for exports, such as the staff census or the roster’s participant list.

Restrict the amounts of some contracts

Contract amounts (salary, fee, services, per diem and total) can also be limited by role, in the Economic conditions block. Some contracts are also handled separately, such as those of conductors and soloists, whose fees are negotiated by management: these are restricted contracts.

Each contract block has a second line, In restricted contracts, with its own level. For example, a production role can see the amounts of every contract except restricted ones.
Only those with «Ver y editar» on the amounts of restricted contracts see and change the Restricted contract switch on the contract, in «Detalles del contrato». For everyone else, the contract shows without its amounts and without any mark.
Which specialties start as restricted is set in contract preferences, under «Por especialidad», with Starts as restricted. Conductor, soloist, teacher, composer, soloist ensemble and collaborating ensemble come selected.

Assign a role to someone

Open their contract and, on the Specialty and position card, click Edit. Click Next to go to Position and details.
Choose the Access role. If you’re also changing the Job position, choose it first: choosing a job position applies its default role.
Click Apply and save the contract with Save.
Ask the person to reload the page to see the changes.

Deactivate or delete a role

To stop offering a role, turn off Active. People who already have it keep it, with its permissions.
To delete it, click the bin › Delete role. It’s only possible if it isn’t assigned to any contract, including contracts that have already ended.

If it doesn’t work

They sign in and only see You don't have access to this section, with no side menu. Their role is missing “Visión general” or “Calendario”. Edit the role, tick both, save and ask them to reload.
With the Their ensembles scope they can’t change a service. That service only belongs to other ensembles: they see it but can’t change it. Ask someone with institution-wide scope to do it, or add their ensemble to the service.
They could export or save something and now they can’t. Since 29/09/2026 three things ask for their own permission, and what’s missing is that permission: exporting the staff census asks for the “Exportar” action on contracts; exporting a project’s equipment with prices and ownership asks for the inventory permission (the simple list, the one for handing out and loading, does not); and saving a contract’s generated document into its file asks for permission to edit that contract, while downloading it still only asks for the download permission.
A menu doesn’t appear for your colleague. Their role doesn’t include viewing that section, and the menu hides what they can’t see. If they have a custom role, add the permission; if they have a predefined one, assign them another role or duplicate theirs and adjust it.
They see You don't have access to this section. Their role doesn’t include that page, even if they reach it from a link or from a General settings card. Review their role.
They have several contracts. What they see depends on what they choose at the top in Role and Contract. Ask them to choose a single contract.
With All they can’t create anything. This happens when they have contracts in several institutions or several in the same one: the add button is disabled or An active contract is required appears. Ask them to choose a contract in Contract; see Work with several institutions.
You can’t find Access Roles. It only appears if your access role lets you edit roles. Talk to the person who manages your institution.
You cannot change the access role of your own contract. An administrator must do it. appears. Another administrator has to change it. If Only an administrator can change this access role appears, the current role allows managing roles and only an administrator can change it.
You changed the job position and the role changed. Choosing a position applies its default role. Choose the role again after the position.
You want to stop using a predefined role. Its Active switch deactivates it only for your institution: people who already have it keep it, and it’s no longer offered for new contracts. If it’s the default role for a specialty, you’ll be asked which role new contracts will get from now on.
When you delete a role, Cannot delete appears. The role is still assigned to some contract, even if it has ended. Assign another role to those contracts.
You want someone to see a person’s record but not their bank details. In contracts you can: choose Masked or No access in Bank details, as explained in Limit personal contract data. In other records, what each role sees is decided by whole section, with its Actions.
They can’t generate or download someone’s contract. Their role sees that contract’s personal data trimmed, and the documents carry it in full: in the record, the documents card only shows a notice. Ask someone who sees the data in full to generate it, or change that block in their role.

If, with the right role, a single contract selected and the page reloaded, the person still can’t see the section, sees more than they should or sees data from another institution, write to us at help@weikos.io with the name of the role and the section.

We will never ask you for your password or bank details by email. If you receive a message asking for them on behalf of Weikos, don’t reply and write to us at help@weikos.io.