This article lists every permission available in Cubby, what it allows, and how its scope changes depending on whether it is assigned at the organisation level or the facility level. Use it as a reference when building custom roles or troubleshooting access issues.
For how to assign permissions to users, see User Management and User Roles.
In this article:
Org level vs facility level
Every permission in Cubby is assigned at either the organisation level or a facility level:
Organisation level — the permission applies across all facilities in your organisation. Use this for administrators or managers who need the same access everywhere.
Facility level — the permission applies only to the specific facility it is assigned for. Use this to give a team member access at one location without granting it org-wide.
Some permissions can be assigned at either level — but their scope changes depending on which level they are granted at. These are called out explicitly in the Permissions that behave differently by level section below.
In the tables below, the Level column uses:
Org — only meaningful at organisation level
Facility — scoped to the assigned facility
Org or Facility ⚠️ — can be either; scope or behaviour changes by level (see bottom of article)
Core access
Permission | What it allows | Level |
All permissions | Applies every permission listed in this article to the user in one step. Typically reserved for administrators. | Org |
Can only read | Read-only access to Facilities and Pricing. Users can view rental and tenant data but cannot take any actions. This does not include reports — to let a read-only user run or download them, also grant Can use reports page from the Reports & analytics section below. | Org or Facility ⚠️ |
Can manage facilities | The foundational permission for any Site Manager. Enables access to the core Facilities section: units, leads, rentals, auctions, merchandise, walkthroughs, payment history, and facility preferences. Required before most other facility-level permissions are useful. | Facility |
Can edit existing customer details | Change a customer's name, phone, email, mailing address or ID once they are already on record. Without it, a user can still fill in details that are blank, but cannot change them afterwards, and can only add (not edit or remove) alternate phones and emails. Locked fields show why, and suggest asking the customer to update them in the tenant portal or in writing. Selecting Can manage facilities selects this too; every role that had it on release was given this permission, so nobody lost access. | Org |
Facilities & units
Permission | What it allows | Level |
Can edit facility details | Edit the facility's general info, contact info, address and mailing details, operational hours, and marketing phone numbers. | Facility |
Can edit units | Create, edit, or archive units. | Facility |
Can edit sitemap | Edit a facility's sitemap: move and place units, landmarks, lines, and floor images. Includes read access to the facility's units, including customer names and balances. Does not allow adding or editing units, and gives no access to settings. It doesn't need Can manage facilities, so you can give it to someone who only looks after the map. Can edit facility/org settings also includes sitemap editing; every role and user that had that permission (or All permissions) was given Can edit sitemap on release, so nobody lost access. | Facility |
Can edit rentability for vacant units | Change a unit's rentability status, but only when the unit is vacant and not reserved. Cannot manually set a unit to Reserved. | Facility |
Can edit rentability for any unit | Change a unit's rentability to any state regardless of current occupancy. Supersedes the vacant-only restriction above. | Facility |
Can add / remove unit overlock | Add and remove overlocks on units. | Facility |
Can manage locks | Full lock management: add or bulk import locks, edit lock details, delete, view history, and mark locks as missing, available, or damaged. | Facility |
Can use gate access page | Full access to the Gate Access page: edit tenant gate access codes, enable or disable access, and export the gate access table. | Facility |
Rentals & leases
Permission | What it allows | Level |
Can change rent rate | Change the rent rate on an existing lease or remove a scheduled rent change. | Facility |
Can set custom rate | Set or change a custom rent rate during new lease creation or when transferring a tenant to another unit. Not needed to complete a rental at a custom rate someone else already saved on the lead or reservation; that rate is shown read-only. | Facility |
Can edit lease dates | Edit move-in, move-out, and unit transfer dates on a lease. | Facility |
Can transfer prepaid balance | Transfer a tenant's prepaid balance between leases at the same facility. | Facility |
Can edit imported balance | Edit a tenant's imported balances (outstanding, prepaid, deposit) that were carried over during migration from a previous system. | Facility |
Can move unit to another auction | Move auctioned units that have not yet been settled to a different auction date, via Auctions > Move to another auction. | Facility |
Can merge customers | Merge duplicate customer records into a single contact. | Org |
Can manage delinquency exemptions | Add, edit, or delete delinquency exemptions on individual leases. Exemptions selectively pause automated delinquency actions — including delinquency fees, overlock, lien eligibility, and collections messages — for specific tenants. | Facility |
Can override auction settlement | Unlocks two administrator-only auction actions: completing an unpaid auction unit from Needs payment directly to Settled (Sold) without first collecting payment, and undoing a settlement from Settled (Sold) state. Only available to the Administrator role. | Facility |
Payments & billing
Permission | What it allows | Level |
Can reverse payments | Refund credit card or ACH payments, or mark a payment as failed regardless of payment method. | Facility |
Can waive charges | Waive any charge from a tenant's balance — fees, due rent, coverage, security deposit, and so on. | Facility |
Can take partial payments | Process a payment for less than the full outstanding balance. | Facility |
Can refund move-out balance | Approve or reject balance refund requests on move-out leases. | Facility |
Can write off move-out balance | Write off an outstanding balance on a moved-out lease as bad debt, or approve/reject write-off requests from other users. | Facility |
Can issue credit | Issue a credit to a tenant's account. | Facility |
Pricing & rates
Permission | What it allows | Level |
Can manage & analyze prices | Change rent prices on individual leases, manage standard rates on pricing groups, and view competitor pricing history and recommendations. | Org or Facility ⚠️ |
Can manage pricing groups | Create and edit pricing group details: name, size, rates, features, assigned discounts, and assigned units. | Org or Facility ⚠️ |
Can create/delete pricing groups | Create a new pricing group, or delete one that has no units under it and is not in use by the Storefront builder. | Org or Facility ⚠️ |
Can manage market competitors | Add or remove market competitors that power rate recommendations and competitor data in the Pricing section. | Org |
Walkthroughs
Permission | What it allows | Level |
Can perform walkthrough | Perform facility walkthroughs. During a walkthrough, the user can manage combination locks, apply or remove overlocks, change unit availability status, log tasks, and send preset walkthrough messages. | Facility |
Can manage walkthrough preferences | Manage the facility's unit walkthrough order and the preset walkthrough messages. | Facility |
Communications & calls
Cubby has several call-related permissions. They are often confused — see the callout below for how they work together. Some only exist for organizations on Calls+ (calls answered inside Cubby); organizations on Spoke answer calls in the Spoke app.
Permission | What it allows | Level |
Can send messages | Access to the Messages section. Allows reading and sending two-way messages or message templates to tenants at the assigned facilities. At org level, grants full access to all tenant conversations across all facilities. | Org or Facility ⚠️ |
Can handle calls | Makes the user an agent in your call center. Required for anyone who receives inbound calls. On Spoke, it adds them to Spoke's call queue; on Calls+, it gives them the Call panel and dialpad in Cubby, and each person with it counts as a Calls+ agent on your account. | Facility |
Can manage calls | Full access to the Calls section in Cubby (Live activity, call records, recordings and transcripts). Required to view and work with call history. AI scores and transcript summaries are shown only for calls the person handled themselves. Does not make the user an agent — that requires Can handle calls. | Org or Facility ⚠️ |
Can supervise communications | Supervisor-level capabilities: monitor live calls, view team dashboards, and see everyone's AI call scores and transcript summaries. On Calls+, they can also change a team member's status from Live activity. It includes call handling, so supervisors can take calls too. Intended for managers overseeing call centre performance. | Org or Facility ⚠️ |
Can use a desk phone for calls | Calls+ only. Answer inbound calls on the store's desk phone and choose it when placing outbound calls. Needs Can handle calls or Can supervise communications as well. Give it for each store where the person answers the desk phone. | Facility |
Can choose facilities to accept inbound calls from | Calls+ only, and only shown when your organization has this option turned on. Lets staff who cover several stores pick which stores they take inbound calls from each time they go online, using Choose facilities in the Call panel. | Org or Facility |
Can manage scheduled calls | Calls+ only, and only shown when your organization has scheduled calls turned on. Sits under Can manage calls. Schedule calls by hand, edit or delete calls scheduled by hand, and place or resolve scheduled calls. | Same as Can manage calls |
Can edit workflow-created scheduled calls | Calls+ only. Sits under Can manage calls. Edit or delete scheduled calls that a workflow created. | Same as Can manage calls |
Can pause scheduled calls | Calls+ only. Sits under Can manage calls. Pause or resume a customer's scheduled calls. Pausing deletes the customer's current scheduled calls. | Same as Can manage calls |
Can apply call center discounts | Apply discounts set to Call center only to leads, reservations and rentals. Without it, those discounts don't appear in the discount dropdown, though a discount already quoted on a lead is kept when anyone converts it. Give it only to call center staff. See Choose where a discount is offered. | Facility |
Can configure calls | Add and edit Voice AI configurations, IVR settings, and call centre configuration for the organisation. | Org |
How the call permissions work together: A typical site manager answering calls needs Can handle calls (to receive calls in Spoke or Calls+) and Can manage calls (to view call history in Cubby). On Calls+, add Can use a desk phone for calls for stores with a desk phone. A supervisor who monitors the team but does not personally take calls needs Can manage calls and Can supervise communications. Can configure calls is a separate admin-level permission for setting up Voice AI and IVR — most operators will not need it.
Reports & analytics
Permission | What it allows | Level |
Can use reports page | Access the Reports page. A role can be granted all reports or specific reports — pick individual reports to hand-pick exactly which ones a role can run or download, or grant all of them at once. The Reports page only shows the reports the role is actually allowed to view, and scheduled report recipients who lose access to a report are automatically dropped from that schedule. | Org or Facility ⚠️ |
Can schedule reports | Schedule reports for recurring automated delivery (e.g. daily email of a specific report). | Org or Facility ⚠️ |
Can view analytics | Access the Analytics section. At org level, shows data across all facilities. At facility level, shows data for the assigned facility only. | Org or Facility ⚠️ |
Can use GL mapping | Use the GL Export Mapping tool to customise how Journal Entry data maps to your organisation's general ledger accounts. | Org |
Settings & configuration
Permission | What it allows | Level |
Can edit facility/org settings | At org level: full access to the Settings section across the organisation, including Settings → Tax regimes, where tax regimes are created once and assigned to facilities. At facility level: limited edit access scoped to the facility's Preferences tab — document templates, facility details, message templates, discounts, and similar items. Also includes editing the sitemap. To let someone edit the sitemap without settings access, give them Can edit sitemap instead. | Org or Facility ⚠️ |
Can edit users | Access to the Users tab under Settings. Enables adding and editing users, deactivating or reactivating users, managing their facility or org-level access, and duplicating access from one user to another. | Org |
Can use storefront builder | At org level: full access to the Storefront Builder portal. At facility level: limited access to view and edit the Facilities, Pricing Groups, Collections, and Variants tabs in the Content section — scoped to the assigned facility only. | Org or Facility ⚠️ |
Can manage workflows | Create, edit, publish, unpublish, duplicate, and delete automation workflows. | Org |
Inventory & merchandise
Permission | What it allows | Level |
Can manage merchandise | Edit access to the Product Catalog (Settings > Merchandise) — creating and editing products, pricing, and facility assignments — plus access to the per-facility Inventory page. Covers both areas in one permission. | Org |
Can add inventory | Record stock you have received on the Inventory page, using Add inventory. Cannot lower quantities or change costs. | Facility |
Can manage inventory costs | Everything in Can add inventory, plus edit stock quantities and costs, and import/export that facility's inventory. Previously called Can manage inventory. Does not grant access to the Product Catalog — that requires Can manage merchandise at org level. | Facility |
Can create manager specials | Create and sell manager specials directly from the Shop tab on a tenant's rental. | Facility |
Permissions that behave differently by level
The following permissions are frequently misunderstood because their scope or behaviour changes meaningfully depending on whether they are assigned at org level or facility level.
Can edit facility/org settings
At org level: Full access to the entire Settings section — user management, communication templates, document templates, fee library, tax regimes, integrations, and all organisation-wide configuration.
At facility level: Limited to the facility's Preferences tab only — document templates, message templates, facility details, discounts, and similar facility-scoped items, plus editing the sitemap. Does not expose org-level settings.
Can use storefront builder
At org level: Full access to the Storefront Builder portal, including all facilities, portfolios, collections, pricing groups, and variants.
At facility level: View and edit access to the Facilities, Pricing Groups, Collections, and Variants tabs — but only for the specific facility assigned. Cannot manage portfolios or other facilities.
Can send messages
At org level: Full access to all tenant conversations in the Messages section, across every facility in the organisation.
At facility level: Access only to conversations with tenants at the assigned facility.
Can view analytics
At org level: Access to portfolio-level, organisation-level, and all facility-level analytics views.
At facility level: Access to the facility-level analytics view only for the assigned facility.
Can use reports page
All reports: the role can run or download every report on the Reports page, same as before this permission became per-report.
Specific reports: hand-pick which individual reports the role can see. The Reports page only lists the reports the role has been granted — everything else simply doesn't appear as an option.
If a user has a permission at both org level and facility level, the org-level assignment takes precedence and grants the broader scope.