# Staff Management — Roles, Permissions & 2FA
ClinIT uses a role-based access model with optional per-user permission overrides.
---
Roles Overview
| Role | Typical User | Default Access |
|---|---|---|
| CLINIC_OWNER | Practice owner / manager | Full access to everything |
| DOCTOR | Attending physician | All clinical + own schedule |
| RECEPTIONIST | Front desk | Appointments, patients, billing (no clinical notes) |
| NURSE | Clinical assistant | Pre-session, vitals, lab orders |
| LAB_TECHNICIAN | Lab staff | Lab orders module only |
---
Adding a New Staff Member
- Go to Settings → Staff → + Invite Staff.
- Enter email address, first/last name, role, and phone.
- Click Send Invite.
- The staff member receives an email with a setup link to set their password.
For doctors, a doctor profile is created automatically. Complete the profile from Staff → Doctors → [Name] → Edit Profile.
---
Editing a User's Role
- Settings → Staff → [Name] → Edit.
- Change the Role dropdown.
- Save.
> ⚠️ Role changes take effect at the user's next login.
---
Custom Permissions
For fine-grained control, click Advanced Permissions on any user's profile:
- Override specific feature access (e.g. allow a nurse to view invoices).
- Restrict a doctor from accessing billing (e.g. pure clinical-only account).
---
Deactivating a Staff Member
When a staff member leaves:
- Settings → Staff → [Name] → Deactivate.
- All their refresh tokens are revoked immediately.
- Their historical records (sessions, prescriptions, etc.) are preserved.
---
Two-Factor Authentication (2FA)
### Enforcing 2FA Clinic-Wide
Settings → Security → Require 2FA for all staff.
When enabled, all staff users are prompted to set up 2FA on next login.
### Setting Up 2FA (Per User)
Each user can enable 2FA from their profile:
- Avatar → My Profile → Security → Enable 2FA.
- Scan the QR code with Google Authenticator, Microsoft Authenticator, or Authy.
- Enter the 6-digit code to confirm setup.
### Disabling 2FA
A user can disable from their profile, or an admin can disable from Settings → Staff → [Name] → Disable 2FA.
---
Login Audit
All staff logins (including 2FA events) are recorded in Audit Log → Staff Login Logs:
- Timestamp, IP address, device/browser, success/failure.
Accounts are automatically locked after 5 consecutive failed login attempts.
---
Password Policy
- Minimum 8 characters.
- Staff can reset via Forgot Password on the login page.
- Admins can trigger a forced password reset from the staff management screen.