HOA Roles and Permissions

This guide documents HOAfy's current association roles and their effective permissions. Role names are fixed; associations cannot create custom roles or permission sets.

How Access Works

Every association membership has one role. Permissions are calculated for that role within the selected association, and the backend API enforces them. A user may have a different role in each association. Changing the selected association changes the membership and permissions used for that workspace.

The table below lists effective permissions: it includes permissions granted directly and those implied by another permission. A permission is not an unconditional promise that every related record or feature is available. Unit assignment, ownership, record visibility, member status, subscription limits, provider configuration, and endpoint-specific rules can further restrict an operation. Unit assignment is a separate gate for applicable personal and self-service actions; association-wide administrative actions, such as managing units, are gated by their own permissions and do not require the caller to be assigned to a unit.

Association Roles

Effective Permission Reference

Role names in each row are the roles that receive that permission, including through an implication listed below.

Association and administration

Finance and accounting

Communications

Community operations

Documents, website, vendors, and work orders

Permission Implications

Some permissions include related read access. The effective-permission table already reflects these implications:

Unit, Ownership, and Vendor Boundaries

• A role permission does not replace unit assignment. Self-service operations such as personal requests, payments, and ballot casting may require the member to be linked to a unit.
• Vote eligibility also depends on the vote's audience, unit, ownership, and joint-owner rules. Vote Without Primary Ownership changes only the primary-owner check for roles that already qualify; it does not itself make a person eligible or give them Vote.
• Document visibility, record ownership, status, subscription limits, provider setup, and specific endpoint rules can further limit access. The API remains the authorization authority; frontend menus and controls are not security boundaries.
• A Vendor association role is not the same as a Vendor User role. Vendor Mode access is based on a separate vendor membership and is restricted to the vendor's own records and assigned association work. The backend recognizes Vendor User role values owner, estimator, and field-tech; authorization specifically restricts business-profile updates to owner, while other actions use vendor-membership and assigned-work checks rather than additional role-specific grants.

For vendor onboarding, assigned work, and current vendor-workflow limits, see HOA Vendor Management and Work Orders. For member administration and voting workflows, see HOA Community Management.