Roles and permissions

What the owner can do, what an agent can do, and the complete permission catalogue.

Prestafolio has two roles, and only two:

Owner. You, the business owner. Can do everything, no exceptions, and is the only one who manages agents and billing.
Agent (collector). Has no fixed bundle of permissions: they have the ones you grant, one by one. Two collectors in the same business can have completely different permissions.

Granting and revoking permissions

When you invite a collector you tick their initial permissions. Afterwards, in Agents → row menu → Edit permissions, you can change them whenever you like.

Important: editing permissions replaces the whole set, it does not add to it. Whatever stays ticked is exactly what they will have. If you untick everything, they end up with no permissions (they can sign in, but do nothing). And the change is immediate: if the agent is working right then, their session refreshes to apply the new permissions.

Two rules the system always enforces, no matter what you tick on screen:

An agent can never manage agents. Agent-management permissions cannot be delegated to anyone: that is the protection against a collector escalating their own privileges or inviting people on their own.
You cannot grant permissions from a module your plan does not include. If you try, you will see Some of those permissions are not available on your plan.

What an agent sees with no permissions at all

Even if you grant nothing, an agent who has accepted can:

Sign in and see their own dashboard: what they collected today and this month, their assigned portfolio, their services and their cash shift. These are their figures, never the whole business's. See Collector performance.
Look up the list and detail of clients and loans (reading them requires no permission; what is controlled is creating, editing and deleting).

Everything else must be granted.

Complete permission catalogue

These are the system's real permissions, grouped by module. The Permission column is the technical identifier you will see in the app and in error messages.

Clients

Permission	What it allows
`clients:create`	Create clients.
`clients:update`	Edit clients (including uploading and deleting their files).
`clients:delete`	Delete clients.
`clients:stats`	View client statistics.

Loans

Permission	What it allows
`loans:create`	Create loans (and renew them).
`loans:update`	Edit loans, archive them and mark them uncollectible.
`loans:delete`	Delete loans.
`loans:updateArrears`	Change the loan's arrears.

Payments

Permission	What it allows
`payments:create`	Record a payment.
`payments:createMultiple`	Record payments in bulk.
`payments:updateInterest`	Change a payment's interest.
`payments:updateArrears`	Change a payment's arrears.
`payments:makeUncollectible`	Mark a payment as uncollectible.

Arrears

Permission	What it allows
`delays:create`	Record the collection of an overdue amount.
`delays:createMultiple`	Record arrears in bulk.
`delays:updateInterest`	Change arrears interest.
`delays:updateArrears`	Change arrears days or rate.
`delays:makeUncollectible`	Mark an overdue item as uncollectible.

Recurring services

Permission	What it allows
`services:read`	View services and their charges.
`services:write`	Create and edit service contracts.
`services:collect`	Record the collection of a charge.
`services:cancel`	Pause, reactivate or cancel a service.
`services:override-mora`	Waive the arrears on a charge when collecting it.
`services:partial-payment`	Accept a partial (incomplete) payment on a charge.

The last two are exception permissions: they let the collector take less than what is owed. Grant them only to someone you genuinely trust with that call.

Cash

Permission	What it allows
`cash:read`	View the cash drawer.
`cash:stats`	View whole-business cash statistics (lent/collected), not just the shift.
`cash:open`	Open the cash shift.
`cash:close`	Close the shift (count).

Accounting

Permission	What it allows
`accounting:read`	View the accounting summary (the ledger).
`accounting:write`	Create, post and reverse manual journal entries.
`accounting:close-period`	Close a fiscal period.
`accounting:provision`	Set the allowance target for uncollectibles.
`accounting:coa.manage`	Create, edit and deactivate chart-of-accounts accounts (Premium).

Reports, documents and others

Permission	What it allows
`reports:read`	View the business reports (Gold and Premium).
`legal:create`	Create legal persons and documents (promissory note).
`legal:update`	Edit legal persons and documents.
`legal:delete`	Delete legal persons.
`calculator:read`	Access the calculator.
`request:read`	View loan requests (Gold and Premium).

Never delegable

Permission	Why it never shows up in the picker
`agents:create`, `agents:update`, `agents:delete`	Managing collectors is owner-only. No agent can receive them.
`billing:manage`	The Prestafolio subscription and payment are managed by the owner alone.

Your plan matters too

Even if a permission exists in the catalogue, you can only grant it if your plan includes that module. For example, reports:read and request:read require Gold or Premium; the agents module itself already requires it. Permissions your plan does not enable simply do not appear in the picker. See Plans and billing.

Common errors

Message	What happened
Some of those permissions are not available on your plan	A permission from a module your plan lacks was included. None of the batch is applied: fix it and retry.
You do not have permission to perform this action	The agent tried something you did not grant. If they should be able to, tick it in Edit permissions.
Owner only	An agent tried to open the Agents section. It is not grantable: it belongs to the owner, period.