User Roles and Their Permissions

Shelf uses fixed roles (sometimes called user types): you assign each person one of four roles instead of building permissions from scratch. Here's the whole model in three lines — then a picker that tells you exactly which role to use.

Restricting who can see or book specific equipment

The most common question — especially for universities and multi-department teams — is "can I stop certain people from seeing or booking equipment that isn't theirs?" You have three levers, no custom setup required:

1. Gate gear behind approval — give the group the Base role. They can only request equipment; an admin reviews and releases it. Nothing leaves without a yes.
2. Hide other people's gear — leave custody visibility and booking visibility off (the default) and Base/Self-service users see only what they're involved with. Flip them on when you'd rather everyone see who has what. Both live in Settings ▸ Workspace ▸ Permissions — no need to leave this for another page, though there's a full walkthrough with screenshots if you want it.
3. Separate departments entirely — give each department its own workspace. Assets, members, and roles are fully isolated between workspaces.

Asset notes stay with Admins and Owners regardless of those toggles. Base and Self-service users can open an asset and see its details, including every custom field that has a value, read-only. Being unable to manage custom fields is about creating and editing definitions in Settings, not about reading what an asset records. What is not shown to them is the Activity tab, which holds the notes and the last-scan record. Audit activity is different: every role can read audit notes, so the Activity tab on an audit stays visible.

The roles in detail

Owner

The Account Owner has complete access to everything in the workspace. They are effectively an Administrator with two extra powers: the workspace's plan runs on the Owner's subscription, and only the Owner can create or delete workspaces. There is only ever one Owner at a time, and the Owner cannot be removed.

Administrator

Administrators have comprehensive access to the workspace across all locations. Their permissions include:

• Managing assets: create, update, archive and delete equipment; manage categories, tags, custom fields and locations; and oversee custody transfers.
• Managing users: invite other users to the workspace and adjust the roles of existing users.
• Team member notes: add private, workspace-scoped notes to any team member's profile. Notes are only visible to Admins and Owners. See Admin Notes on Team Members.
• Managing bookings: create, update and fulfil (check in/out) bookings, including those started by other users.
• Running audits: create, manage, archive and delete audits, in addition to performing them.
• Managing settings: full access to the workspace's settings and configuration, including the permission toggles that control what Self-service and Base users can see.

Self-service

Self-service users sit between Base and Administrator. They have more autonomy than Base users — they can run their own check-outs and check-ins — without gaining control over the wider workspace:

• Assets: view equipment listings, but cannot create, update, or delete equipment, manage flags, change locations, or handle other people's custody.
• Custody: self-assign and self-remove custody of assets.
• Bookings: book assets for themselves and check them out and back in on their own — no admin needed.
• Audits: can be assigned to audits and perform them — scanning items and adding audit notes — but cannot create, archive, or delete audits.
• Settings: view and edit their own account details only. They cannot invite or manage other team members.

Base

Base is the foundational role — ideal for the widest group of users, such as students or occasional borrowers:

• Assets: view equipment listings, but cannot create, update, or delete equipment, manage flags, change locations, or handle custody.
• Bookings: create booking requests for themselves. They cannot check out or check in gear themselves — only an Administrator can complete the hand-off on their behalf. This makes Base the right role when you want a person to reserve equipment but an admin to approve and release it.
• Audits: can be assigned to audits and perform them — scanning items and adding audit notes — but cannot create, archive, or delete audits.
• Settings: limited to their own account details. They cannot invite or manage other team members.

NRM (Non Registered Member)

An NRM is a person recorded in Shelf without login credentials. They act as a placeholder to assign custody and keep tracking records accurate — useful when you need to attribute equipment to specific individuals who don't need access to the platform. This keeps accountability intact while limiting who can log in and see workspace data.

Full permissions reference

Every checkmark is what the role can actually do in Shelf today.

Related articles

• Changing User Roles in Shelf
• Configure What Self-service and Base Users Can See
• Admin Notes on Team Members

Note: Inviting team members is a Team plan feature.