Signing in
Two ways in: Continue with Microsoft (SSO — the account must already exist and be bound to your Microsoft identity; nothing is auto-created) or email and password. Forgotten passwords and first-time setup both go through a one-hour, single-use emailed link.
Two kinds of user
Practice users are your team: they can hold any feature permission, see the Practice band, and access the clients they’re given. Client users are a client’s own people: the same app, radically narrowed — only their own company, never the Practice band, never another client. What they can usefully do: see their deadlines, use chat, and act on file approvals from their side.
Feature permissions
Access is a per-user grid of feature grants — Bills (view / publish / unpublish), Financials, AML (read / write), Automations, Settings areas, API credentials and so on — managed in Settings → Users. A person has exactly the verbs they were given; sensitive verbs (publishing to Xero, revealing vault secrets, rotating API credentials) are separate grants from viewing.
Client access
Independently of features, each user is scoped to clients: either all of them, or a named list. New-client auto-grant is available for the people who should always see everything. Feature × client scope together answer every “can they?” question.
Company roles
Separate from permissions, company roles describe what a person isto a client — manager, bookkeeper, reviewer — and drive things like role-held task assignment (“assign to whoever is this client’s manager”).
Inviting people
Invites are emailed links (single-use, hashed at rest — a copied link can be re-issued but never re-read). Practice invites carry feature defaults; client invites bind the person to their company. The claim flow covers “I exist but have no password yet”.
Your own profile
Each user manages their signature, their personal send-as-me mailbox (Microsoft, delegated), their send preference and their password in Profile.