> ## Documentation Index
> Fetch the complete documentation index at: https://help-loyalife.xoxoday.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Control overview

> Manage who can access Loyalife and what they can do with roles, permissions, approval workflows, and a full audit trail.

Access Control governs every aspect of who can log in to Loyalife and what they are permitted to see or do. Loyalife uses a **role-based access model**: every user holds one or more roles, and each role carries a defined set of permissions across the platform's modules.

## Why access control matters

| Goal           | How access control helps                                                                                                                            |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Security**   | Protects sensitive data — member PII, financial liability, transaction records — from unauthorized access                                           |
| **Governance** | The Maker-Checker workflow prevents any single person from making unilateral changes to member accounts, rule configurations, or partner onboarding |
| **Compliance** | Every access and action is logged in the Audit Trail, providing a non-repudiable record for auditors and regulators                                 |
| **Efficiency** | Role-based permissions ensure users can complete their responsibilities without navigating unnecessary restrictions                                 |

## Accessing Access Control

Select **Access Controls** from the left sidebar.

## Modules within Access Control

<CardGroup cols={2}>
  <Card title="Manage team" icon="users" href="/user-guides/access-control/manage-team">
    Invite users, assign roles, reset passwords, lock/unlock accounts, and create custom roles with granular permissions.
  </Card>

  <Card title="Approval workflow" icon="check-square" href="/user-guides/access-control/approval-workflow">
    Configure and manage the Maker-Checker process for point adjustments, member status changes, partner onboarding, and rule activations.
  </Card>

  <Card title="Audit trail" icon="clock" href="/user-guides/access-control/audit-trail">
    Review a complete, tamper-evident log of every administrative action — who, what, when, and from where.
  </Card>
</CardGroup>

## Role structure

Loyalife comes with built-in roles for common team functions. You can also create custom roles with any combination of per-module permissions.

**Example role structure for a retail loyalty program:**

| Role               | Typical permissions                                                  |
| ------------------ | -------------------------------------------------------------------- |
| Customer Support   | View Members, View Transactions — no edit access                     |
| Marketing Manager  | View and Create Campaigns, View Segments, View Communications        |
| Program Admin      | Full access except Access Control management                         |
| Compliance Officer | View Reports, View Audit Trail — read-only across all modules        |
| Super Admin        | All permissions including User Management and Custom Report creation |

## Permission levels

For most modules, permissions follow a hierarchy:

| Level      | What it allows                                                                              |
| ---------- | ------------------------------------------------------------------------------------------- |
| **View**   | Read-only access to the module — can see data but not change anything                       |
| **Edit**   | Can modify existing records (includes view access)                                          |
| **Create** | Can create new records, modify existing ones, and typically delete (includes view and edit) |

Some modules have additional granular permissions — for example, **Approve Assigned Invoices**, **Verify Onboarding Requests**, or **PI Data Access**.

## Maker-Checker governance

For sensitive actions — manual point adjustments, member status changes, partner onboarding — Loyalife enforces a two-step approval process:

1. A **Maker** initiates the action
2. A **Checker/Approver** reviews and authorises it before it takes effect

This is configured in **Approval Workflow** and can be enabled or disabled per action type. See [Approval workflow](/user-guides/access-control/approval-workflow) for details.

<Warning>
  Once the Suspension Actions toggle is enabled in the Approval Workflow, it cannot be reversed. Plan this configuration carefully.
</Warning>