Roles, Staff & Audit Log
This page covers three connected things under Access & Audit: Roles (what a kind of staff member may do), Admin Users (your staff accounts) and the Audit Log (a record of what they did).
The problem it solves
As you grow you will hire people: someone to answer support tickets, someone to check payments. You do not want them to change prices, see your gateway keys or delete clients. Roles let you give each person only the pages they need, and the Audit Log lets you see who changed what.
1. Roles
A role is a name plus a list of tick-boxes called permissions. Examples: Support (answers tickets) or Finance (payments and refunds).
Open Access & Audit → Roles. You will see one card per role with its description, how many people hold it and its permissions.
- Super Admin is built in. It can do everything and cannot be edited or deleted. The person who installed Threadline has it.
- A Support role is created for you as an example. It can only view clients.
- Click New role to make your own. Give it a name, a description and tick what it may do.
- You can only give permissions that you have yourself.
- A role cannot be deleted while people still hold it.
What staff with a role see. The top of their sidebar shows Owner Panel with their role's name, for example "Helpdesk access", instead of the switch to your own workspace: staff only ever work in the Owner panel. The Owner dashboard shows them only the figures their role covers. Revenue, MRR, payments and churn need View payments; subscriptions and plans need View subscriptions; clients need View clients; AI spend needs View AI usage. The setup checklist is shown only to roles that can change settings.
The permissions
Permissions are fixed in the app, so a role can never contain one that does nothing.
| Area | Permission |
|---|---|
| Clients | View clients |
| Add, edit, suspend clients and manage their users | |
| Log in as a client | |
| Billing | Manage pricing plans |
| Manage payment gateways | |
| Manage currencies | |
| Manage coupons | |
| Manage tax rates | |
| View subscriptions | |
| Grant, cancel and resume subscriptions | |
| View payments and invoices | |
| Record refunds | |
| Content | Edit site content and site settings |
| Support | View support tickets |
| Reply to and manage support tickets | |
| Configuration and system | Manage AI, storage and sign-in settings |
| Manage the mail server and email wording | |
| Use cron, backups, updates and maintenance | |
| Watch and retry background jobs | |
| View AI usage across clients | |
| Access and audit | Manage roles |
| Manage platform staff | |
| View the audit log |
If someone opens a page they do not have permission for, they see a "not allowed" page. The link is also hidden from their sidebar.
2. Admin Users (your staff)
Access & Audit → Admin Users lists the people who can sign in to the Owner area. These are your team, not your customers. Customers are on the Clients page.
Add a staff member
- Click Add staff.
- Enter their name and email.
- Choose a Role.
- Click Send invite. They get an email to choose their own password.
Change or remove
- Use Edit to change the name, email or role, or to switch Active off. An inactive person cannot sign in.
- Use Delete to remove them for good ("They will no longer be able to sign in").
- You cannot deactivate or delete yourself, and the last Super Admin cannot be removed or demoted. This keeps you from locking everyone out.
Platform staff never appear in any client's team list.
3. Audit Log
The Audit Log is a diary of what happened in the Owner area. Each line says who did it, what, when, from which address, and which fields were changed.
What is recorded
- Every change made in the Owner area: plans, gateways, coupons, tax rates, currencies, clients and their users, subscriptions, refunds, roles, staff, settings, backups and updates.
- Signing in, signing out, failed sign-ins, password changes and two-factor changes.
- When someone starts and ends Log in as a client.
Secrets are never stored. The log keeps the names of fields that changed, never their values. A password or API key can not leak through it.
Finding an entry
- Action starts with — type the start of an action name, for example
admin.plansfor everything about plans, orauthfor sign-ins. - From and To — pick a date range.
- Export CSV — downloads exactly what the filters show.
How long it is kept
Under Platform Settings → Advanced, Keep the audit log for sets the days. 0 keeps it forever. Otherwise older entries are deleted every day.
Common questions
I locked myself out. You cannot demote the last Super Admin from inside the app, so this should not happen. If you forgot your password, use "Forgot password" on the login page.
A teammate says a link is missing. Their role does not include that permission. Edit the role and tick it.
Who changed that price? Open the Audit Log and type admin.plans in Action starts with.