People join Onyx One by invitation, each with a role. The role is not a label; it decides what that person can see and do, enforced in the database rather than hidden in the interface.
The six roles
- Owner: everything, including the money views only owners get.
- Admin: runs the business day to day, manages people and settings.
- Office: quotes, invoices, customers and the paperwork.
- Dispatcher: the schedule, the board and who goes where.
- Tech: their jobs, their time, their safety forms. Never prices, costs or margins.
- Contractor: like a tech, scoped to the work they are given.
Why the boundary matters
A tech's login, and any AI connected with it, cannot read a price even if asked nicely. That is the same boundary the client portal and the MCP connection inherit, which is why one decision at invite time covers every door into the system.
Tightening sign-in
Anyone can turn on two-factor codes for their own account, and a business can require MFA for everybody. On a shared site tablet, untick remember-me at sign-in and the session ends when the browser closes.
Keep reading
- Your first week on Onyx OneWhat to set up on day one, what to leave until later, and how to get the crew running real jobs without a training day.
- Connect Claude or ChatGPT to your businessA two-minute setup, what your AI can and cannot do once connected, and why that boundary is enforced in the database.