Users, roles, and permissions

Two roles, Admin (full access) and Employee (daily CRM functionality). You invite team members, manage their accounts, and the RBAC system determines who can do what.

Click to enlarge

Settings → Users.

When do you use this?

• A new agent joins, invite
• A team member leaves, deactivate account
• Promote an Employee to Admin

The overview

Settings → Users in the sidebar. Table with:

Column	Description
Name	Full name (or email if no name)
Email	Email address
Status	Active / Inactive / Pending
Role	Admin or Employee
Job Title	Job title
Created At	Creation date
Last Login Date	Last login

Searching and filtering

• Search text: first name, last name, email, job title
• Status filter: Active, Inactive, Pending, or all

---

Two roles

Admin

Full access. Admins can:

• View and edit all modules and data
• Invite and manage users
• Configure company settings
• Import and export
• Manage subscriptions and billing

Employee

Daily CRM functionality. RBAC determines exactly:

• View and manage properties, contacts, leads, deals
• Send and receive emails
• Manage tasks and meetings
• Own personal settings

Tip

Difference in perspective on data, see Tesoro as a Management Tool.

---

Inviting a new user

1. Settings → Users.
2. Click Invite User.
3. Select role: Admin or Employee.
4. Enter email address(es). Multiple are allowed, comma-separated. Each must be unique and valid.
5. Click Invite User → the system sends an invitation email per address.

Upon acceptance: the user follows the link, registers a password, and gains access.

---

Managing an existing user

Click a user in the overview → detail page + actions:

Action	Description
Edit	Name, role, job title, contact details
Deactivate	Status → Inactive (cannot log in)
Reactivate	Status back to → Active
Resend Invitation	When Pending, new email

---

Deleting a user

Requires careful management

Deletion can have permanent data effects. Deleted users lose access; assigned records must be transferred. Consider first Deactivate.

For permanent deletion: first transfer all assigned records (leads, contacts, deals, properties) via Mass Edit Assign To.

---

RBAC: Role-Based Access Control

Per role, which actions are allowed. Examples:

Resource	Admin	Employee
Properties	Full	Full
Contacts + Leads	Full	Full
Deals	Full	Full
Imports	Yes	No
Settings	Yes	Own Personal Settings
Users	Yes	No
API Keys	Yes	No
Webhooks	Yes	No

Specific actions per resource can be checked in admin settings. Some actions (Mass Delete, permanently delete land registry history) are always Admin only.

---

Common mistakes

Invitation not received

• Check spam folder
• Request to Tesoro or check that email settings are correct in Settings → My Company → Email
• Resend the Resend Invitation

User cannot log in

• Check if status is Active?
• Invitation accepted? If Pending, not yet.
• Forgot password? Use “Forgot password” on the login page.

Transfer records when team member leaves

• Mass Edit Assign To on all records belonging to this team member, before deactivation or deletion.

---

Next step

Subscription Number of users in your plan + upgrades.