Why can't a user see a record, section or form?
Work through Areas, the Default Working Site, Groups, Section and Form permissions, Denies, record permissions and Rights to find why a user can't see or add a record.
Key Points
Check in this order: the record's Area and the user's Areas, the user's Default Working Site, their Groups, the Section and Form permissions, any Deny, the record's own permissions, then Rights.
A user only sees records in the Areas they're assigned to, even if their Group can read the whole Section.
A Default Working Site in My Profile limits the user to one Area. Set it to All, save, then log out and back in.
A missing Add New button, or the message "You are not permitted to create records of the requested type", means none of the user's Groups has Add access to that Form.
A Deny always beats an allow. If a user still can't see something after a change, ask them to log out and back in.
Is the record in one of the user's Areas?
Areas are the first check. A user can only see a record if they're assigned to the Area the record is in.
Open the record and look at Primary Area in the top right. This is the record's Area.
Go to System Menu > Users, open the user and check the Areas they're assigned to.
If the record's Area isn't one of theirs, either add the Area to the user or move the record to an Area they have.
If no users are assigned to an Area, no one can see the records in it.
A record in an Area that is no longer Active can't be opened. Move it to an active Area.
For how to add Areas and assign users, see How do I control access with Areas?
Is the user's Default Working Site hiding other Areas?
Each user can set a Default Working Site in My Profile. If it's set to one Area, they only see records in that Area, even if they're assigned to more. This is a common reason a user can see some clients but not others.
Ask the user to click their name in the top right and select My Profile.
On the General tab, under Default preferences, set Default Working Site to All.
Click Save Preferences.
Log out and back in.
Is the user in the right Groups?
Groups decide what a user can do. A user who isn't in a Group with access to a Section can't see its records. For example, a new support worker who hasn't been added to your support worker or Staff Group usually can't see clients or add shift notes.
Go to System Menu > Users, open the user and check their Groups. Compare them with a colleague in the same role who can see the record. A user in several Groups gets the combined access of all of them.
Can the user's Groups read the Section and Form?
Each Section, and each Form inside it, has its own permissions. A Group can have Read, Edit or Add access. You set these under System Menu > Sections: the main Form in Access Control, and the other Forms under Tab Forms. For the steps, see How do I set permissions on Sections and Forms?
Read Own and Edit Own only cover records the user created. If a user's only access is Read Own, they won't see records other people added. This often explains "she can see her own notes but not anyone else's".
A Tab is hidden when the user's Groups can't read, edit or add any Form on it. If one Form on a Tab is missing, check that Form's permissions.
A single field can be hidden with field permissions, even when the user can read the rest of the Form.
Is a Deny blocking the user?
A Deny overrides any allow. If any of the user's Groups is denied access to a Section, Form or record, the user is denied, even if their other Groups allow it. This applies to admins too.
To fix it, remove the Deny, or remove the user from the Group that is denied. Where you can, remove a Group from an access rule instead of using a Deny, so you don't lock people out by accident.
Why is the Add New button missing?
The Add New button only shows when one of the user's Groups has Add access to that Form. If the user tries to add a record without it, for example a shift note, FlowLogic shows a security alert:
You are not permitted to create records of the requested type
To fix it, add the user to a Group that has Add access to the Form, or give their Group Add access in System Menu > Sections.
Does the record have its own permissions?
A single record can have permissions that override the usual set-up, such as a Deny for one Group or user. If a user sees every record except one, check the record's own permissions.
Open the record and click Record Permissions.
Find the user or their Group. The information icon next to each one shows their Group membership and Area access.
A Deny shows in red. To remove an override, click it and choose reset.
For how overrides work, see How do I give or block a user's access to a single record?
I've locked everyone out of a record
Denying a broad Group such as All or Staff on a record can lock out everyone, including you. If someone who can still open the record can reset the Deny, ask them to. If no one can open it, contact our Support team with the record's UID.
Does the feature need a Right?
Some features, such as the Drive, Reports, the Roster Schedule or the Quick Quoter, are controlled by Rights rather than Section permissions. If a whole menu item or button is missing, the user's Groups may be missing a Right. To find the Right for a task, see the Which Right do I need to...? section in What does each Right in FlowLogic do? Rights are given to Groups. An administrator can add it, otherwise ask FlowLogic Support.
Ask the user to log out and back in
Some changes, such as new Rights and a new Default Working Site, only take effect after the user logs out and back in. If your change looks right but the user still can't see the record, ask them to do this before checking anything else.
How can I see who can read each client?
Run the Client Permission Summary report. It shows which staff can read each client.
The Area access column shows access that comes from Areas. This is the column to check in most cases.
The Record Access column only shows permissions set on that client's record. "No" there just means no record permission has been set.