TEAM

TEAM MANAGEMENT

The Team Management module is the operating layer that allows a real estate company to delegate work without giving every employee full landlord access. It combines company-scoped roles, granular permissions, staff records, polymorphic assignments, task and schedule management, performance records, communication logs and multiple runtime access guards.

Leaseora Jul 30, 2026 43 min read 16 views

LEASEORA

TEAM MANAGEMENT

Detailed User and Technical Operations Guide

Roles • Permissions • Staff Invitations • Assignments • Workload • Tasks • Schedules • GPS Attendance • Performance • Communications • Middleware • SuperAdmin Oversight

For real estate companies, corporate and private landlords, property managers, department heads, HR and operations teams, staff members, security administrators and authorised platform administrators

Version 1.0 | July 2026

Purpose of this guide

This guide explains how a real estate company uses Leaseora's Team Management module from role and permission design through staff account creation, invitation acceptance, property and asset assignments, workload review, task execution, scheduling, check-in and check-out, performance measurement, communication intelligence, runtime access enforcement and SuperAdmin oversight. It also provides a detailed technical reference based on the supplied models, controllers, services, events, notifications, middleware and console commands.

1. Purpose, Audience and Scope

Item	Description
Primary users	Landlords, real estate company directors, team administrators, HR and operations managers, department heads, staff members and SuperAdmins.
Role scope	Custom company roles, canonical role variants, role duplication, role export and role validation.
Permission scope	Grouped permissions, permission matrix, AI review, exports, events and middleware enforcement.
Staff scope	Invitation, verification, profile, role, department, status, assignment and deletion or deactivation.
Work scope	StaffAssignment, StaffTask, StaffSchedule, time logs, approvals, recurring work and workload views.
Intelligence scope	Performance metrics, communication analysis, AI insights, conflict detection and workload optimisation.
Operational boundary	Leaseora supports team operations and access control. It does not replace employment contracts, payroll law, workplace safety, employee consultation, union rules, professional licensing or jurisdiction-specific labour requirements.

Data-source basis

This guide is based on the workflow and backend references supplied for Leaseora. Where production behaviour is not defined, the guide identifies it as a matter to confirm rather than silently inventing a rule.

2. Complete Team Management Lifecycle

Figure 1. Complete Team Management lifecycle

Stage	Business outcome
Design roles	Translate job responsibilities into a company role.
Map permissions	Grant only the system actions required for the role.
Create staff	Create the user, department, title and invitation.
Assign assets	Define which properties, units, leases or tasks the staff member may manage.
Balance workload	Compare assignments, active tasks, schedule and capacity.
Execute work	Allow authorised staff to start, update, time-log, complete or escalate work.
Measure	Review timeliness, quality, cost, satisfaction, compliance and communication.
Govern access	Enforce company, staff, role, permission, department and assignment scope.
Improve	Use human review and AI suggestions to adjust permissions, workload and development.

3. Roles and Responsibilities

Role	Main responsibility	Control expectation
Landlord / Company Owner	Owns the company team context and final delegation decisions.	Should not use a staff account as a substitute for landlord ownership.
Team Administrator	Creates roles, permissions and staff records.	Should not grant high-risk permissions without approval.
Department Manager	Assigns work and reviews workload.	Should remain within department and property scope.
Staff Member	Performs authorised work and records progress.	Should access only permitted modules and assigned resources.
Security Reviewer	Reviews role design and access conflicts.	Should be independent from routine permission administration where possible.
Performance Reviewer	Reviews metrics and coaching actions.	Should consider context, sample size and human factors.
SuperAdmin	Maintains platform-level roles, permissions and oversight.	Overrides should be authorised, reasoned and audited.

Separation of duties

The staff member who creates payments should not automatically approve them; the person who assigns work should not be the only person rating high-impact completion; and the administrator who changes high-risk permissions should not be the only reviewer.

4. Before You Configure Team Management

☐ The landlord company profile and company identifier are correct.

☐ Canonical roles and platform permissions have been reviewed by SuperAdmin.

☐ The landlord has a written team structure and department list.

☐ Each job title has a responsibility description.

☐ High-risk permissions have identified approvers.

☐ Property and asset ownership data are complete.

☐ Staff invitation email delivery is configured.

☐ Staff account activation and deactivation rules are documented.

☐ Task, schedule, GPS and communication privacy rules are documented.

☐ AI-generated suggestions require human review.

Pilot before full rollout

Create one test role and one test staff member, verify role assignment, property scope, dashboard visibility and route enforcement, then expand gradually.

5. Phase 1 - Create a Custom Role

1	Open Team -> Roles and Create the Role Primary actor: Landlord team administrator

Landlord\Shared\RoleController@create displays the role form. @store creates a Spatie Role scoped to the landlord company.

Field	How it is used
name	Professional role name such as Property Manager, Maintenance Supervisor, Leasing Agent or Finance Officer.
guard_name	Usually web; must match the authentication guard used for permission checks.
company_id	Automatically links the role to the landlord company or permissions team.
created_by	Records the landlord user who created the role.

Use a responsibility-based role name

A role name should describe the work, not the person. Avoid names such as JohnAccess or TemporaryFullAccess.

6. Write the Role Purpose and Boundaries

☐ State the main business purpose.

☐ List the modules the role must use.

☐ List the actions the role must not perform.

☐ Identify the department and reporting line.

☐ Identify whether the role handles payments, personal data or approvals.

☐ Identify property or region restrictions.

☐ Identify temporary or contractor limitations.

The supplied Role fields do not explicitly list a description field, but the controller provides AI description generation. Confirm where the generated description is stored in production - for example, role metadata, a related table or a configuration record.

7. Use AI Role Assistance Carefully

AI endpoint	Purpose	Review requirement
aiSuggestName	Suggests a professional role name from responsibilities.	Check naming standards and duplicates.
aiGenerateDescription	Drafts a role description.	Confirm actual duties, authority and exclusions.
aiSuggestPermissions	Suggests a permission set.	Review every permission and remove unnecessary access.

AI cannot approve access

AI suggestions are advisory and may over-grant or omit critical controls. The landlord remains responsible for the final role and permission set.

8. Role List, Detail, Edit and Delete

Operation	Purpose
index	Lists roles created in the landlord company context.
show	Displays role details, assigned permissions and users.
edit / update	Changes role name or permission associations.
destroy	Deletes a role only when no staff are assigned.
duplicate	Clones the role and all permissions.
checkName	AJAX validation for duplicate names.
export	Exports role data as CSV or PDF.

Do not delete an assigned role

Reassign or deactivate affected staff first. Historical audit records should retain the prior role name and assignment context.

9. Duplicate a Role Safely

1. Open the source role and review its current permissions.

2. Select Duplicate.

3. Provide a new unique role name.

4. Remove permissions not needed for the new role.

5. Add any department-specific permissions.

6. Run the AI or human security review.

7. Test the role with a non-production staff account before assignment.

Cloning copies risk as well as convenience

A copied role can retain high-risk permissions that are not obvious from its new name.

10. Role Model and Helper Functions

Method / service	Purpose
scopeExcludingSuperAdmin	Prevents the SuperAdmin role appearing in landlord-manageable lists.
users	Many-to-many users assigned to the role.
hasSpecificPermission	Checks a named permission on the role.
attachPermissions	Bulk-attaches permissions.
company / creator	Company and creator relationships.
RoleHelper::getLandlordRoles	Returns landlord-type roles.
getRolesByCategory	Filters roles by category.
getDisplayName	Produces a formatted display label.
getRoleVariants	Returns naming variants for a canonical role.
validateRole	Checks recognised role names.
enhancedRoleCheck	Checks multiple role variants.
userHasCrmAccess	Checks whether the user role permits CRM access.

11. Phase 1 - Create and Group Permissions

2	Define Granular Permissions Primary actor: Landlord security administrator

Landlord\Shared\PermissionController@create and @store create Spatie Permission records. Permissions should be action-based and grouped by business domain.

Field	Example	Purpose
name	view-properties	Machine-readable action identifier.
group_name	Properties	Logical category for the permission matrix.
guard_name	web	Authentication guard used by Spatie.

Recommended group	Example permissions
Properties	view-properties, create-properties, edit-properties, archive-properties.
Clients	view-client-data, invite-clients, manage-kyc, view-screening.
Leases	view-leases, create-leases, approve-leases, terminate-leases.
Payments	view-payments, process-payments, verify-bank-transfer, approve-refund.
Maintenance	view-maintenance, assign-vendor, complete-maintenance, approve-cost.
CRM	access-crm, manage-leads, send-campaigns, export-crm.
Reports	view-reports, generate-reports, schedule-reports, export-reports.
Team	view-staff, manage-staff, assign-work, manage-roles, manage-permissions.

12. Design Permissions Using Least Privilege

☐ Use view, create, edit, approve, export and delete as separate actions where risk differs.

☐ Separate payment initiation from payment approval.

☐ Separate sensitive Client data from general property access.

☐ Separate staff management from permission management.

☐ Separate report viewing from raw-data export.

☐ Limit destructive actions such as delete and archive.

☐ Use department and assignment scope in addition to module permission.

Permission names should be stable

Changing a machine permission name can break middleware, menu visibility and tests. Prefer creating a new permission and migrating assignments under control.

13. Manage the Permission Matrix

PermissionController@index groups permissions by category. @saveAssignments stores the entire role-permission matrix in bulk.

1. Select the role column.

2. Review each permission group.

3. Grant only required actions.

4. Review high-risk combinations.

5. Save the full matrix.

6. Confirm PermissionUpdated is fired.

7. Refresh or invalidate permission caches.

8. Test the affected staff account.

Bulk save must be transactional

A partial matrix save can leave a role with unintended access. Confirm database transaction and cache invalidation behaviour.

14. Permission Operations and Exports

Operation	Purpose
show	Displays the permission and all roles that hold it.
edit / update	Changes permitted metadata.
destroy	Deletes an unused permission.
saveAssignments	Stores the permission matrix.
export	Exports the matrix as CSV or PDF.
PermissionExportController@exportCsv	Detailed CSV export.
exportExcel	Excel permission matrix.
exportPdf	PDF permission matrix.
analytics	Shows used and unused permissions.

15. AI Permission Recommendations and Security Analysis

AI method	Output
recommendPermissions	Suggested permissions based on role name, responsibilities and intended access level.
getOptimizationInsights	Over-privileged roles, redundant groups and orphaned permissions.
getSecurityAnalysis	High-risk combinations, escalation risks and separation-of-duty recommendations.
PermissionController@getAIInsights	Portfolio view of permission structure issues.

Do not automatically apply AI permission changes

Every recommendation should identify the affected role, current access, proposed change, risk, reviewer and final decision.

16. High-Risk Permission Combinations

Combination	Why it is high risk	Suggested control
Create payment + approve payment	One person can create and release funds.	Separate approval or require dual approval.
Manage staff + manage permissions	Administrator can create a user and grant access.	Independent permission review.
View Client data + export all data	Large privacy exposure.	Restrict exports and record purpose.
Create vendor + approve vendor payment	Conflict in procurement and settlement.	Separate vendor and finance authority.
Edit lease + waive payment	Can change obligations and remove debt.	Manager approval and audit.
Delete audit records	Can conceal activity.	Do not grant to normal staff.

17. PermissionUpdated Event

PermissionUpdated is fired whenever role permissions are modified. Downstream listeners can refresh caches, write audit records, notify security reviewers or trigger validation.

☐ Event contains company, role, actor and changed permissions.

☐ Old and new permission sets are preserved or reconstructable.

☐ Permission cache is refreshed.

☐ Notification failure does not roll back a valid authorised change unless policy requires it.

☐ Repeated event processing is idempotent.

18. Role and Permission Architecture

Figure 2. Role, permission and team-scope architecture

Company context must be established first

A role named Property Manager in Company A must not grant access in Company B. SetPermissionsTeam and the team resolver must execute before role or permission checks.

19. Phase 2 - Create a Staff Member

3	Open Team -> Staff and Add the User Primary actor: Landlord team administrator

Landlord\Shared\LandlordStaffController@create displays the form. @store creates a User with is_staff = true and created_by = landlord ID.

Field	Purpose
name	Staff member display and contact name.
email	Unique login and invitation address.
password	Auto-generated or set through invitation acceptance.
is_staff	Distinguishes the user from landlord and Client accounts.
staff_role	Human-readable job-role label.
staff_department	Department assignment.
staff_title	Professional title such as Senior Property Manager.
created_by	Landlord employer/owner relationship.

20. Check the Staff Email Before Creation

LandlordStaffController@checkEmail is an AJAX endpoint that checks whether the email is already registered.

☐ Email is normalised before checking.

☐ The result does not expose unnecessary account information.

☐ Existing users are handled through a safe linking or invitation policy if supported.

☐ A duplicate request cannot create two staff records.

☐ The company confirms authority to invite the address.

Do not disclose account existence broadly

The validation response should be designed to reduce user-enumeration risk.

21. Assign the Staff Role

After the User is created, $user->assignRole($roleName) assigns the selected Spatie role in the correct team context.

☐ The selected role belongs to the landlord company.

☐ The role is not SuperAdmin or another protected platform role.

☐ The role permissions match the staff responsibilities.

☐ The team resolver is set before assignment.

☐ The assignment is logged.

22. Send Staff Verification and Invitation

CustomVerifyStaffEmail extends VerifyEmail and includes a creator reference so the message identifies the inviting landlord. StaffVerifyEmail is an alternative verification notification.

1. Create the staff account in an inactive or unverified state.

2. Generate the signed verification or invitation link.

3. Send CustomVerifyStaffEmail to the staff member.

4. Include the landlord or company name and role context.

5. Provide an expiry and support contact.

6. Record notification delivery status where supported.

Invitation email should not contain a reusable password

The staff member should set a password through a signed, time-limited invitation flow.

23. Staff Member Accepts the Invitation

4	Set Password, Accept Terms and Activate Primary actor: Invited staff member

Auth\AcceptInviteController@show displays the invitation page. @store records the password and acceptance, then activates the account.

☐ Invitation is valid, signed and not expired.

☐ Invitation is single-use.

☐ The staff member sets a strong password.

☐ Required terms and privacy notice are accepted.

☐ Email verification is recorded.

☐ The account becomes active only after completion.

24. View the Staff Register

LandlordStaffController@index lists User records where created_by is the landlord and is_staff is true.

Column	Meaning
Name / email	Staff identity and login contact.
Role	Assigned Spatie role.
Department	Operational grouping.
Title	Professional title.
Status	Active or inactive account state.
Assigned properties	Count or list of active StaffAssignment records.

Ownership filter is essential

A landlord must not view or manage staff created by another landlord, even when email, role or department names are similar.

25. View and Edit the Staff Profile

@show displays personal information, roles, permissions, StaffAssignment records, workload and performance. @edit and @update change permitted profile fields.

☐ Staff record belongs to the landlord.

☐ Email changes require verification.

☐ Role changes show a permission preview through getRolePermissions.

☐ Department changes review resource scope.

☐ Title changes do not silently change permissions.

26. Preview Role Permissions Before a Role Change

getRolePermissions($id) returns the permissions assigned to the selected role for an AJAX preview.

Preview is not enforcement

The final save must validate company scope, role eligibility and current permission data on the server. Do not trust a browser preview alone.

27. Activate or Deactivate Staff

5	Change the Account Status Primary actor: Landlord team administrator

toggleStatus activates or deactivates the staff account. Deactivation should block login while preserving records.

☐ Confirm the correct staff member and company.

☐ Record the reason and effective time where supported.

☐ Review active tasks and assignments.

☐ Reassign urgent work before deactivation.

☐ Revoke active sessions and tokens.

☐ Preserve audit, task, communication and performance history.

28. Delete or Remove a Staff Member

destroy removes the staff member and cleans associated StaffAssignment records according to the supplied scenario.

Prefer deactivation for historical users

Hard deletion can damage audit history, task ownership, time logs, communications and approvals. Confirm whether destroy performs soft deletion, anonymisation or reassignment before production use.

29. Phase 3 - Assign Staff to Properties and Assets

6	Create a StaffAssignment Primary actor: Landlord or authorised manager

LandlordStaffController@assign creates a polymorphic StaffAssignment.

Field	Purpose
staff_id	Assigned staff member.
assignable_type	Property, Unit, Lease, MaintenanceRequest, Inspection or another supported entity.
assignable_id	Identifier of the assigned entity.
role_in_assignment	Specific responsibility for this assignment.
assigned_by	Landlord or authorised manager.
assigned_at	Assignment timestamp.
status	Active or inactive.
notes	Instructions and limitations.

30. Assignment Eligibility Checklist

☐ Staff account is active and verified.

☐ Staff role includes the required module permission.

☐ Department is appropriate for the resource.

☐ Assignable entity belongs to the landlord.

☐ role_in_assignment is clear.

☐ Workload and schedule are reviewed.

☐ Conflicts of interest are considered.

☐ The assignment does not duplicate an existing active record unintentionally.

Permission and assignment are both required

A user may have manage-maintenance permission but should still be restricted to maintenance requests for properties or departments they are assigned to.

31. Assignment Types and Examples

Assignable type	Example role_in_assignment	Typical access
Property	Property Manager	Property overview, leases, maintenance and approved reports for that property.
Unit	Caretaker	Unit inspections and maintenance status.
Lease	Leasing Coordinator	Lease communication and approved lifecycle actions.
MaintenanceRequest	Maintenance Lead	Assignment, vendor coordination and completion review.
Inspection	Inspector	Inspection checklist, evidence and outcome.
Other supported entity	Configured role	Only the actions supported by the relevant policy and middleware.

32. Unassign Staff from an Asset

7	Deactivate the Assignment Primary actor: Landlord or authorised manager

LandlordStaffController@unassign sets StaffAssignment.status to inactive. StaffPermissionMiddleware should then remove resource access.

☐ Assignment belongs to the landlord.

☐ Outstanding work is reassigned or closed.

☐ The status change is immediate for route and query access.

☐ Cached permissions or resource lists are refreshed.

☐ The inactive assignment remains available for history.

33. Phase 4 - Portfolio Workload Overview

8	Open /staff/workload Primary actor: Landlord or team manager

LandlordStaffController@workload() without an ID queries staff created by the landlord and eager-loads active StaffAssignment records.

The view users.landlord.staff.workload-overview displays each staff member's name, role, department, active assignment count, active task count and performance indicators.

Figure 3. Workload, task, schedule and performance flow

34. Interpret Workload Carefully

Indicator	What it shows	Limitation
Active assignments	Number of active StaffAssignment records.	One property can be more complex than five small units.
Active tasks	Pending and in-progress workload.	Task effort varies.
Overdue tasks	Tasks beyond due date.	May reflect blocked dependencies.
Schedule hours	Planned shifts and activities.	Does not prove productive work.
Actual hours	Time recorded or check-in/out.	Requires accurate time capture.
Performance grade	Computed summary.	Should not replace detailed review.

Do not balance work by count alone

Use assignment complexity, priority, geography, skill, schedule, estimated hours, wellbeing and legal working-time limits.

35. Individual Staff Workload

9	Open the Staff Workload Detail Primary actor: Landlord or manager

workload($id) groups active assignments by assignable_type, loads StaffTask counts, StaffSchedule information and StaffPerformanceMetric records. workloadSummary($id) provides AJAX refresh data.

Workload section	Content
Assignments	Properties, Units, Leases, Maintenance Requests and Inspections.
Task queue	Pending, In Progress, Overdue and Completed Today.
Schedule	Today, upcoming shifts and conflicts.
Performance	Completion, response, quality, cost and health indicators.

36. Workload Rebalancing Procedure

1. Identify staff with urgent, overdue or excessive active work.

2. Review task priority, due dates and estimated hours.

3. Review schedule conflicts and leave.

4. Review skills and assignment permissions.

5. Identify a suitable staff member with capacity.

6. Reassign tasks or asset responsibilities under authority.

7. Notify affected staff and update due dates only where justified.

8. Monitor the next workload refresh.

AI can suggest rebalancing, not decide employment consequences

A manager should consider operational context, reasonable adjustments and human factors before changing workload or performance conclusions.

37. Phase 5 - StaffTask Model and Task Creation

StaffTask stores task information for general staff workload and supports polymorphic targets, property and Client context, maintenance and inspection links, approvals, ratings, recurrence and AI metadata.

Field group	Key fields
Target and owner	assignable_id, assignable_type, assigned_by.
Context	property_id, tenant_id, maintenance_request_id, inspection_id.
Task detail	title, description, type, priority.
Lifecycle	status, due_date, started_at, completed_at.
Time	estimated_hours, actual_hours.
Completion	completion_notes, attachments, cost, currency.
Approval	requires_landlord_approval, approved_by_landlord, approved_at.
Rating	completion_rating, rating_notes, rated_by.
Recurrence	is_recurring, recurrence_pattern, next_occurrence_date, parent_task_id.
AI	ai_generated, ai_suggestion_reason, ai_metadata.

38. Task Status and Approval Flow

Figure 4. Staff task status, approval and recurrence flow

Status	Meaning
pending	Created and not started.
in_progress	markAsStarted has recorded the start.
completed	Work and completion details have been submitted.
overdue	Due date has passed and task is not complete.
cancelled	Task ended with an authorised reason.

Blocked status requires confirmation

The staff controller supports start, complete and block, while the supplied StaffTask status list does not include blocked. Confirm whether blocked is a status, a separate field or a task-comment convention.

39. Task Lifecycle Methods and Computed Values

Method / attribute	Purpose
markAsStarted	Sets In Progress and started_at.
markAsCompleted	Sets Completed, records notes and actual hours.
createNextOccurrence	Creates the next recurring task.
isOverdue	Due date is past and task is not completed.
hoursRemaining	Estimated minus actual hours.
progressPercentage	Configured completion percentage.

Task methods must be idempotent

A repeated mobile or browser request must not create duplicate completion records, recurring tasks, costs or performance updates.

40. Task Scopes

Scope	Purpose
Pending / InProgress / Completed / Overdue	Status filters.
HighPriority / Urgent	Priority filters.
DueToday / DueThisWeek	Date filters.
ForProperty	Property-level filter.
AiGenerated	AI-created task filter.
RequiresApproval	Tasks awaiting landlord approval.
Recurring	Recurring tasks.

41. Staff Views and Manages Assigned Tasks

10	Open My Tasks Primary actor: Staff member

Staff\StaffTaskController@myTasks loads assigned PropertyDevelopmentTask records, prioritised critical, high, medium and low, then ordered by due date.

Operation	Purpose
show	Full task details.
updateStatus	Start, complete or block the task.
addComment / deleteComment	Progress updates.
logTime / deleteTimeLog	PropertyDevelopmentTaskTimeLog management.
reassignTask	Transfers the task when permitted.
getLandlordUsers	Returns eligible reassignment users.

Two task models are referenced

The workload section uses StaffTask, while the staff controller operates on PropertyDevelopmentTask. Confirm how they are related, synchronised or separated in production.

42. Start a Task

1. Open the task and confirm it is assigned to you.

2. Review priority, property, due date and instructions.

3. Check required approvals, access and safety conditions.

4. Select Start.

5. Record started_at on the server.

6. Add an initial comment if the work has dependencies.

43. Log Time and Progress

☐ Time entry belongs to the authenticated staff member and task.

☐ Date and duration are plausible.

☐ Description explains the work.

☐ Duplicate time logs are controlled.

☐ Deletion retains audit history or authority.

☐ Actual hours update only under the configured aggregation rule.

44. Complete a Task and Request Approval

1. Confirm all required work is complete.

2. Add completion notes and attachments.

3. Enter actual hours.

4. Record cost and currency where relevant.

5. Submit the task as Completed.

6. If landlord approval is required, leave approved_by_landlord false until review.

7. The landlord reviews evidence and records approved_at.

8. The reviewer may add a completion rating and notes.

Completed and approved are separate concepts

A staff member can finish work, but a landlord or manager may still need to validate quality, cost or compliance.

45. Recurring Tasks

☐ recurrence_pattern is supported and validated.

☐ next_occurrence_date is correctly calculated.

☐ parent_task_id links the series.

☐ createNextOccurrence runs once for each completed cycle.

☐ Cancelled series do not continue.

☐ Assignment, property and instructions are copied intentionally.

46. Phase 6 - Staff Schedule Management

StaffSchedule supports shifts, on-call periods, meetings, inspections, maintenance, training, recurrence, attendance, approval, compensation, AI optimisation, conflict detection and availability.

Field group	Key fields
Owner and type	staff_id, staff_type, type.
Description	title, description.
Time	start_time, end_time, all_day, scheduled_hours.
Location	property_id, location, location_notes.
Status	scheduled, active, completed, cancelled.
Recurrence	is_recurring, recurrence_pattern, recurrence_days, recurrence_end_date, parent_schedule_id.
Attendance	actual_start_time, actual_end_time, actual_hours, overtime_hours, break_minutes.
GPS	check_in_location, check_out_location, checked_in_at, checked_out_at.
Approval	requires_approval, is_approved, approved_by, approved_at, approval_notes.
Reminder	send_reminder, reminder_minutes_before, reminder_sent_at.
Compensation	hourly_rate, overtime_rate, total_compensation, currency.
AI and conflicts	ai_optimized, ai_optimization_reason, ai_suggestions, has_conflict, conflicts.
Availability	availability_status, unavailability_reason.

47. Create a Staff Schedule

1. Select the staff member and schedule type.

2. Enter title, date, start and end time.

3. Select the property or enter the location.

4. Check active assignments and permission scope.

5. Set recurrence if required.

6. Set reminder timing.

7. Run conflict detection.

8. Review scheduled hours and legal working-time considerations.

9. Submit for approval if required.

48. Schedule Scopes and Views

Scope	Purpose
Today	Schedules for today.
Upcoming	Future schedules.
Active	Currently active.
Scheduled	Planned and not started.
Completed	Completed schedules.
RequiresApproval	Pending schedule approval.
Recurring	Recurring schedule records.
WithConflicts	Schedules with detected conflicts.
ForProperty	Schedules linked to a property.

49. Conflict Detection and AI Schedule Optimisation

☐ Overlapping start and end times are detected.

☐ Travel time between properties is considered where configured.

☐ Blackout dates and availability are considered.

☐ Required skill and assignment scope are considered.

☐ Rest and overtime rules are considered.

☐ AI suggestion records the reason and affected schedules.

☐ A human approves material schedule changes.

AI scheduling can create unfair outcomes

Do not optimise only for maximum utilisation. Consider accessibility, reasonable adjustments, caring obligations, safety, travel and labour requirements.

50. GPS Check-In and Check-Out

☐ The staff member understands when location is collected.

☐ Location is collected only for legitimate field attendance purposes.

☐ Check-in and check-out timestamps are server-controlled.

☐ The app distinguishes failed GPS from non-attendance.

☐ Manual correction requires authority and reason.

☐ Precise location retention is limited.

☐ GPS is not used for continuous tracking unless separately authorised and lawful.

GPS evidence is not absolute proof

Device accuracy, signal, spoofing, shared devices and failed connectivity can affect results. Use it as one attendance indicator.

51. Compensation Tracking

StaffSchedule contains hourly_rate, overtime_rate, total_compensation and currency fields. These can support operational costing, but the supplied scenario does not describe payroll calculation, tax, deductions, payslips or payment processing.

Do not present schedule compensation as payroll

Confirm the approved source, labour rules, payroll integration, currency and authorisation before using these values for payment.

52. Phase 7 - Staff Performance Metrics

StaffPerformanceMetric stores daily, weekly, monthly, quarterly or yearly performance records with task, communication, quality, operational, productivity, compliance and AI fields.

Figure 5. Staff performance and communication intelligence

53. Task and Timeliness Metrics

Metric	Meaning / control
tasks_assigned	Tasks assigned in the period.
tasks_completed	Tasks completed in the period under the defined date rule.
tasks_overdue	Tasks overdue under due-date logic.
tasks_cancelled	Cancelled tasks, ideally grouped by reason.
task_completion_rate	Completed divided by eligible assigned tasks.
on_time_completion_rate	Completed on or before due date divided by eligible completed tasks.
average_task_completion_time	Average start-to-completion or assignment-to-completion duration; definition must be clear.
average_response_time	Average time to acknowledge or start work; definition must be clear.

54. Communication and Quality Metrics

Metric group	Fields
Communication	total_communications, tenant_interactions, landlord_interactions, communication_response_rate.
Ratings	average_task_rating, total_ratings_received, positive_ratings, negative_ratings.
Satisfaction	tenant_satisfaction_score.

55. Operational, Cost and Productivity Metrics

Metric group	Fields
Operational	properties_managed, maintenance_requests_handled, inspections_completed, emergency_responses.
Cost	total_costs_incurred, average_cost_per_task, budget_adherence_rate.
Productivity	productivity_score, efficiency_rating, utilization_rate, overtime_hours, working_hours.

56. Compliance and Safety Metrics

Metric	Review requirement
complaints_received	Count with severity and context.
complaints_resolved	Resolution outcome, not just closure.
policy_violations	Validated violations under a published policy.
safety_incidents	Safety events with appropriate investigation and privacy.

Do not create automated disciplinary decisions

Performance metrics can contain errors and context gaps. Use a transparent human review process and allow correction or explanation.

57. AI Performance Fields

Field	Purpose
ai_insights	Generated observations from performance data.
ai_recommendations	Suggested coaching or workload actions.
ai_predicted_next_period_score	Forecast score for the next period.
ai_analysis_summary	Narrative analysis.
ai_analyzed_at	Analysis timestamp.

Predicted scores can amplify bias

Review input completeness, role differences, leave, disability, assignment complexity, geography and data quality before using predictions.

58. Performance Grade, Health and Comparison

Attribute / scope	Purpose
performanceGrade	A, B, C, D or F based on productivity_score.
overallHealth	Excellent, Good, Needs Improvement or Poor.
peer_comparison_percentile	Position relative to the configured peer group.
improvement_from_last_period	Period-over-period change.
HighPerformers / LowPerformers	Configured performance filters.
Improving / Declining	Trend filters.
WithIssues	Records with configured issues.
ForPeriod / Daily / Weekly / Monthly	Period filters.

Peer groups must be comparable

Do not compare a field caretaker, finance officer and senior project manager as if they perform the same work.

59. Performance Review Procedure

1. Select the review period and confirm the data cutoff.

2. Review task counts and the underlying tasks.

3. Review schedule, leave, conflicts and workload.

4. Review ratings and communication context.

5. Review cost and compliance exceptions.

6. Review AI insights as advisory.

7. Discuss the results with the staff member.

8. Record agreed actions, support and deadlines.

9. Correct inaccurate source data.

10. Approve the final review under company policy.

60. Phase 8 - Staff Communication Log

StaffCommunicationLog records email, phone, SMS, WhatsApp, meeting and in-person communications with business context, response timing, urgency, AI analysis and escalation.

Field group	Key fields
Parties	staff_id, initiated_by, recipient_id, recipient_type, direction.
Context	property_id, task_id, maintenance_request_id, inspection_id, lease_id.
Content	subject, message, attachments.
Timing	sent_at, delivered_at, read_at, replied_at, response_time.
Response	requires_response, response_received, response_due_by, follow_up_due.
Priority	is_urgent, is_emergency, priority.
Calls	call_duration_seconds, call_outcome, call_notes.
Meetings	meeting_location, attendees, minutes and action items.
AI	sentiment, score, keywords, complaint, praise, summary, insights and actions.
Escalation	escalated, escalated_to, escalated_at, escalation_reason.
Feedback	communication_rating, feedback, rated_by.
Control	confidential, template_id, automated, automation_trigger.

61. Log a Staff Communication

1. Select the channel and direction.

2. Select the property, task, maintenance, inspection or lease context.

3. Record the parties and time.

4. Add a factual subject and summary.

5. Record whether a response is required and due.

6. Mark urgency or emergency only when justified.

7. Set confidential where access must be restricted.

8. Save attachments under approved file controls.

62. AI Communication Analysis

The communication log can store sentiment, sentiment_score, keywords, complaint or praise indicators, AI summary, AI insights and suggested actions.

☐ AI does not replace the original message.

☐ Sentiment is treated as uncertain.

☐ Sensitive communications are excluded from unapproved AI processing.

☐ Suggested actions are reviewed by a human.

☐ The staff member can correct inaccurate classification where policy allows.

☐ Automated escalation has defined thresholds and human review.

Sentiment analysis can misread tone, culture and language

Do not use sentiment score alone for performance, discipline or Client-risk decisions.

63. Escalation and Follow-Up

☐ Escalation reason is recorded.

☐ The recipient has authority to act.

☐ Emergency items use the correct operational channel, not only a log entry.

☐ Follow-up due date is set.

☐ Resolution is linked to the original communication.

☐ Confidential items remain restricted.

64. Communication Scopes

Scope	Purpose
Inbound	Communications received by staff.
Outbound	Communications sent by staff.
Urgent	Communications marked urgent.

65. Phase 9 - Staff Dashboard

11	Log In to the Permission-Driven Dashboard Primary actor: Staff member

Staff\StaffDashboardController@index reads getAllPermissions(), roles and the landlord employer context. It loads task statistics, urgent tasks, recent activities and user currency.

Dashboard area	Source / behaviour
Modules	Only sections supported by the staff permissions.
Role title	User role and access level.
Employer context	User found through created_by.
Task statistics	Total, Pending, In Progress, Completed and Overdue.
Recent tasks	Five most urgent, ordered by priority and due date.
Recent activities	Task updates, comments and time logs.
Currency	CurrencyService user currency and symbol.

Dashboard visibility is not sufficient security

A hidden card or menu does not stop a direct URL or API request. Middleware, query scope and controller validation must enforce access.

66. Module Visibility Examples

Staff profile	Expected dashboard visibility
Maintenance-only staff	Maintenance tasks, assigned properties, permitted vendors and related schedules; no finance or lease administration.
Leasing agent	Permitted listings, applications, Client communication and leases; no payment approval unless separately granted.
Finance officer	Permitted payment, accounting and reports; no unrestricted KYC or maintenance access.
Property manager	Assigned property operations across permitted modules; no other properties.

67. Phase 10 - Defence-in-Depth Middleware

Figure 6. Defence-in-depth staff access enforcement

Middleware / utility	Purpose
PermissionMiddleware	Requires hasPermissionTo.
RoleMiddleware	Requires hasRole.
RoleOrPermissionMiddleware	Allows either the configured role or permission.
StaffPermissionMiddleware	Requires is_staff and the permission.
DepartmentStaffAccessMiddleware	Limits resources to the assigned department.
SetPermissionsTeam	Sets the Spatie company/team context.
RoleBasedRedirect / RoleRedirect	Routes the user after login.
RoleBasedRouting	Routes requests according to role.
RoleHelper	Normalises and evaluates role variants.

68. Runtime Access Decision

1. Authenticate the user.

2. Confirm the account is active.

3. Set the landlord company permissions team.

4. Confirm is_staff for staff-only routes.

5. Check required role or permission.

6. Check department scope.

7. Check active StaffAssignment or resource scope.

8. Check controller or policy ownership.

9. Allow or deny the action.

10. Log high-risk decisions where appropriate.

69. Role-Based Redirect and Routing

☐ A staff user is redirected to the staff dashboard, not the landlord dashboard.

☐ A user with multiple roles follows a defined priority rule.

☐ Role name variants are normalised.

☐ A missing or invalid role fails safely.

☐ Redirect loops are prevented.

☐ TestStaffRedirect validates expected routes.

70. Team Resolver and Multi-Tenant Isolation

LeaseoraTeamResolver and PermissionsTeamResolver determine the Spatie permissions team context. The correct team should be resolved from the landlord company relationship before permissions are checked.

The most serious Team Management risk is cross-company access

Test staff, role, permission, assignment, dashboard, exports and APIs with two landlord companies that use identical role names.

71. Phase 12 - SuperAdmin Staff Management

12	Monitor Staff Across the Platform Primary actor: SuperAdmin

Operation	Purpose
index	Platform-wide staff list.
show	Full staff profile.
create / store	Create staff on behalf of a landlord.
edit / update	Edit staff details.
destroy	Delete under platform rules.
assignToDepartment	Link to SupportDepartment.
removeFromDepartment	Remove department membership.
analytics	Distribution, roles, departments and performance.
workload	Platform workload overview.
performance	Platform performance summary.

Platform-wide access must be purpose-limited

SuperAdmin visibility should be logged and restricted to support, security, compliance and authorised administration.

72. SuperAdmin Role Management

Controller / operation	Purpose
SuperAdmin RoleController@index	All roles.
create / store / show / edit / update / destroy	Platform role lifecycle.
assignRoles / updateRoles	Assign roles to any user.
validationReport	Roles with missing or conflicting permissions.
RoleManagementController@getStandardizedRoles	Canonical role definitions.
updateUserRoles	Extended user-role update.

73. SuperAdmin Permission Management

Operation	Purpose
index	All platform permissions.
landlordIndex	Landlord-scoped permission view.
landlordCreate / landlordStore	Create landlord-scoped permission.
landlordShow / Edit / Update / Destroy	Manage landlord-scoped permission.
create / store / show / edit / update / destroy	Platform permission lifecycle.
saveAssignments	Bulk permission matrix.

74. Console Commands and Support Classes

Component	Purpose
AssignMenuToRole	Assigns navigation items to a role.
AssignRolesToUsers	Bulk role assignment for migration or setup.
TestStaffRedirect	Tests role redirect routing.
LeaseoraTeamResolver	Custom Spatie multi-tenant team resolver.
PermissionsTeamResolver	Alternative resolver.
RoleBasedController	Shared role-based routing base controller.

Commands require dry-run and company scope

Bulk assignment commands can create platform-wide access errors if company context is omitted.

75. Phase 13 - Property Development Project Teams

PropertyDevelopmentTeamMember is a separate project-specific team model managed through Landlord\Shared\PropertyDevelopmentTeamMemberController. It supports roles such as architect, engineer, project manager and quantity surveyor.

AI / notification	Purpose
aiRoleSuggestions	Suggests project roles based on development type.
aiTeamAnalysis	Identifies project team gaps.
aiSkillRecommendations	Suggests required skills by project phase.
PropertyDevelopmentTeamMemberAddedNotification	Notifies a newly added project team member.
PropertyDevelopmentTeamMemberRemovedNotification	Notifies a removed member.

Project membership is not the same as general staff access

Confirm whether a project team member must also be a User, StaffAssignment holder or Spatie role holder before system access is granted.

76. Project Team Onboarding Procedure

1. Select the development project.

2. Review required roles and phases.

3. Use AI suggestions as a planning aid.

4. Select or invite an authorised team member.

5. Record project role, responsibilities and access.

6. Send the added notification.

7. Review assignments at phase changes.

8. Remove access and notify when participation ends.

77. AI-Powered Features in Team Management

AI feature	Source	Purpose
Role name suggestion	RoleController@aiSuggestName	Professional role names.
Role description	aiGenerateDescription	Draft responsibility description.
Permission recommendation	aiSuggestPermissions / recommendPermissions	Suggested permission set.
Permission optimisation	getOptimizationInsights	Over-privilege, redundancy and orphaned access.
Security analysis	getSecurityAnalysis	Risk combinations and separation of duties.
Performance analysis	StaffPerformanceMetric AI fields	Insights and next-period prediction.
Communication analysis	StaffCommunicationLog AI fields	Summary, sentiment and suggested actions.
Schedule optimisation	StaffSchedule AI fields	Conflict and workload suggestions.
Task generation	StaffTask AI fields	Suggested tasks from operational patterns.
Project team analysis	PropertyDevelopmentTeamMemberController AI methods	Project role and skill gaps.

78. AI Governance Controls

☐ AI output is labelled as advisory.

☐ Human approval is required before granting permissions.

☐ Human review is required before performance consequences.

☐ Sensitive communication content is redacted or processed under approved controls.

☐ Prompts and output are scoped to the landlord company.

☐ Input data quality and period are visible.

☐ Accepted and rejected AI suggestions are auditable.

☐ Bias, accessibility and reasonable-adjustment impacts are reviewed.

79. Security, Privacy and Employment Controls

☐ Use least privilege and company isolation.

☐ Use multi-factor authentication for privileged roles.

☐ Revoke sessions after deactivation or role removal.

☐ Restrict Client personal data by assignment and purpose.

☐ Protect staff personal, performance and communication data.

☐ Limit GPS location collection and retention.

☐ Restrict compensation and rate fields.

☐ Log permission changes and SuperAdmin overrides.

☐ Retain task and approval evidence.

☐ Provide a correction or review process for inaccurate performance data.

Team Management contains employment-related data

Access, performance, GPS, communication and compensation records can affect staff rights and wellbeing. Use appropriate HR, legal, privacy and worker-consultation processes.

80. Backend Models Reference

Model	Purpose
Role (Spatie)	Company-scoped role and user-permission relationship.
Permission (Spatie)	Action permission with logical group.
User	Staff identity, title, department and employer relationship.
StaffAssignment	Polymorphic staff-to-resource assignment.
StaffTask	Task lifecycle, recurrence, approval, rating and AI metadata.
StaffSchedule	Schedule, attendance, GPS, compensation, conflicts and AI.
StaffPerformanceMetric	Periodic task, quality, cost, productivity, compliance and AI metrics.
StaffCommunicationLog	Communication, response, sentiment, escalation and feedback.
PropertyDevelopmentTeamMember	Project-specific team member.
SupportDepartment	SuperAdmin support department relationship.

81. Controllers Reference

Controller	Purpose
Landlord RoleController	Role CRUD, AI, duplicate, export and name check.
Landlord PermissionController	Permission CRUD, matrix, AI insight and export.
PermissionAIController	Recommendations, optimisation and security analysis.
PermissionExportController	CSV, Excel, PDF and permission analytics.
LandlordStaffController	Staff CRUD, role preview, status, assignments and workload.
StaffDashboardController	Permission-driven staff dashboard.
StaffTaskController	Task status, comments, time logs and reassignment.
AcceptInviteController	Staff invitation acceptance and activation.
SuperAdmin StaffManagementController	Platform staff, departments, analytics and workload.
SuperAdmin RoleController / RoleManagementController	Platform and canonical roles.
SuperAdmin PermissionController	Platform and landlord-scoped permissions.
PropertyDevelopmentTeamMemberController	Development project teams and AI.

82. Middleware, Events and Notifications Reference

Component	Purpose
PermissionMiddleware	Named permission check.
RoleMiddleware	Named role check.
RoleOrPermissionMiddleware	Role or permission check.
StaffPermissionMiddleware	Staff flag and permission check.
DepartmentStaffAccessMiddleware	Department resource filter.
SetPermissionsTeam	Spatie company context.
RoleBasedRedirect / Routing	Post-login and controller routing.
PermissionUpdated	Permission-change event.
CustomVerifyStaffEmail	Staff verification invitation with landlord context.
StaffVerifyEmail	Alternative verification notification.
PropertyDevelopmentTeamMemberAddedNotification	Project team addition.
PropertyDevelopmentTeamMemberRemovedNotification	Project team removal.

83. Worked Example 1 - Maintenance Supervisor Role

Scenario

A company needs a supervisor to manage maintenance across three assigned properties without seeing finance or CRM data.

Stage	What happens
1. Role	Create Maintenance Supervisor under the company context.
2. Permissions	Grant view-maintenance, assign-vendor, update-maintenance and approved property viewing.
3. Exclusions	Do not grant process-payments, view-all-client-data or access-crm.
4. Staff	Create the staff user and send CustomVerifyStaffEmail.
5. Accept	The user sets a password and activates the account.
6. Assign	Create active StaffAssignment records for three properties.
7. Dashboard	Only permitted maintenance and assigned-property sections appear.
8. Test	Direct access to finance and unassigned properties is denied.

84. Worked Example 2 - Finance Officer with Separation of Duties

Scenario

A finance officer can review payments and reports but cannot approve a payment they created.

Stage	What happens
1. Role	Create Finance Officer.
2. Permission design	Grant view-payments, create-payment-record and view-financial-reports.
3. Restriction	Do not grant approve-payment or manage-permissions.
4. Reviewer role	Create Finance Approver for authorised managers.
5. AI security	Use getSecurityAnalysis to identify create-and-approve conflicts.
6. Test	Verify the officer can prepare but not approve.
7. Audit	PermissionUpdated records later changes.

85. Worked Example 3 - Workload Rebalancing

Scenario

One property manager has six overdue tasks and overlapping inspections while another has available capacity.

Stage	What happens
1. Overview	Open /staff/workload and identify the imbalance.
2. Detail	Review assignments, task estimates, schedule conflicts and performance context.
3. Eligibility	Confirm the second manager has the correct role, permission and property scope.
4. Reassign	Transfer selected tasks through authorised reassignTask or assignment changes.
5. Notify	Inform both staff members and update expectations.
6. Monitor	Use workloadSummary and overdue counts to review the outcome.

86. Worked Example 4 - Field Inspection with GPS and Approval

Scenario

An inspector is scheduled to attend a property and submit an inspection task requiring landlord approval.

Stage	What happens
1. Assignment	Inspector receives the property or inspection StaffAssignment.
2. Schedule	Create an Inspection schedule with location and reminder.
3. Conflict	Check schedule conflicts and travel.
4. Check-in	Inspector records server-timestamped arrival location.
5. Work	Inspector completes the task, comments and time log.
6. Submit	Task becomes Completed with evidence.
7. Approval	Landlord reviews and records approved_at and rating.
8. Privacy	GPS is retained only under the approved rule.

87. Worked Example 5 - Temporary Staff Deactivation

Scenario

A contractor finishes a three-month assignment but the company must retain records.

Stage	What happens
1. Review	List active assignments, tasks, schedules and tokens.
2. Reassign	Transfer outstanding work.
3. Unassign	Set StaffAssignment records inactive.
4. Deactivate	toggleStatus blocks login and revokes sessions.
5. Preserve	Task, time, communication and approval records remain.
6. Reactivate	The company can reactivate later after role and permission review.

88. Worked Example 6 - Property Development Team Gap Analysis

Scenario

A development project has an architect and project manager but no quantity surveyor.

Stage	What happens
1. Project team	Open the Property Development team view.
2. AI analysis	aiTeamAnalysis identifies the missing cost-management skill.
3. Human review	The project owner confirms the role is needed.
4. Add	Add or invite a quantity surveyor.
5. Notify	PropertyDevelopmentTeamMemberAddedNotification is sent.
6. Access	Grant only required project and document permissions.
7. Remove	At project completion, remove and notify while preserving history.

89. Implementation and Onboarding Checklist

Roles and permissions

☐ Company/team resolver is configured.

☐ Canonical and protected roles are documented.

☐ Permission naming and grouping standards are approved.

☐ High-risk combinations and approvers are documented.

☐ PermissionUpdated audit processing is configured.

Staff and invitations

☐ Email uniqueness and safe checkEmail response are tested.

☐ CustomVerifyStaffEmail and AcceptInvite flow are tested.

☐ Active and inactive account behaviour is defined.

☐ Role preview and role-change review are configured.

☐ Soft deletion or record-retention behaviour is confirmed.

Assignments and operations

☐ Assignable types are registered and authorised.

☐ Workload data sources are consistent.

☐ StaffTask and PropertyDevelopmentTask relationship is confirmed.

☐ Schedule, conflict, GPS and approval rules are approved.

☐ Performance and communication privacy rules are approved.

90. User Acceptance Testing and Go-Live

Test area	Acceptance test
Company isolation	Create identical role names in two companies and verify separation.
Protected role	Landlord cannot view or assign SuperAdmin.
Role create	Fields, duplicate name check and creator/company linkage.
Role duplicate	Permissions copied, new name required and security review.
Role delete	Blocked while users are assigned.
Permission create	Name, group and guard validation.
Permission matrix	Transactional save and cache refresh.
AI permission review	Advisory wording and no auto-apply.
Permission export	Company-scoped CSV, Excel and PDF.
PermissionUpdated	Actor, role, old/new set and idempotency.
Staff create	is_staff, created_by, title, department and role.
Email check	No user enumeration or duplicate creation.
Invitation	Valid, expired, altered and reused links.
Activation	Staff cannot log in before acceptance.
Dashboard	Only permitted modules appear.
Direct URL	Forbidden route is denied despite hidden menu.
Role change	Permission preview and server validation.
Deactivate	Login, tokens and sessions blocked; records retained.
Destroy	Retention and assignment cleanup behave as approved.
Assignment	Company, entity and staff ownership checked.
Unassign	Resource access removed immediately.
Department scope	Cross-department access denied.
Workload overview	Correct staff and active assignment counts.
Workload detail	Tasks, schedules and performance grouped correctly.
Task start	Server timestamp and ownership.
Task complete	Notes, actual hours and idempotency.
Task approval	Completed and approved separated.
Recurring task	One next occurrence only.
Task models	StaffTask and PropertyDevelopmentTask consistency.
Schedule conflict	Overlap, leave and travel handling.
GPS	Consent, failure handling, manual correction and retention.
Schedule compensation	Not presented as payroll without integration.
Performance	Formula, period, role context and correction process.
AI performance	No automated employment consequence.
Communication	Confidentiality, sentiment uncertainty and escalation.
Middleware order	Team context before permission check.
Role redirect	All expected roles and invalid role fallback.
SuperAdmin	Access, override reason and audit.
Bulk commands	Dry-run and company scope.
Project team	General staff and project access distinction.

Go-live gate

Do not onboard the full workforce until company isolation, invitation, direct-route denial, assignment scope, deactivation, permission-change audit and cross-company tests pass.

91. Daily, Weekly, Monthly and Quarterly Procedures

Frequency	Recommended activities
Daily	Review new invitations, failed verification, deactivated users with open work, urgent workload, overdue tasks, schedule conflicts and security alerts.
Weekly	Review role changes, unused permissions, workload balance, unresolved communication escalations, overtime and task approvals.
Monthly	Review active staff, contractor end dates, performance context, GPS retention, permission exports and privileged roles.
Quarterly	Certify role-permission assignments, review separation of duties, test cross-company isolation, review AI governance and update training.

92. Common Issues and Troubleshooting

Issue	Recommended action
Role name already exists	Use checkName, verify company scope and choose a unique name.
Landlord sees SuperAdmin role	Apply scopeExcludingSuperAdmin and protected-role policy.
Permission change not effective	Check Spatie cache, team context and PermissionUpdated listener.
Staff receives wrong company role	Verify SetPermissionsTeam before assignRole.
Invitation link fails	Check signature, expiry, user ID and single-use state.
Staff can log in before accepting	Review active and verification guards.
Deactivated staff still has API access	Revoke tokens and enforce active status on API routes.
Staff sees another landlord data	Review created_by, team resolver, Data scope and controller ownership.
Staff sees unassigned property	Add active StaffAssignment or property scope check.
Workload count looks low	Check assignment status and StaffTask / PropertyDevelopmentTask source.
Task completion duplicated	Add idempotency and status transition checks.
Recurring task duplicates	Lock createNextOccurrence and enforce unique parent/date.
Blocked task cannot be saved	Confirm blocked status implementation.
Schedule conflict missed	Check timezone, all-day and recurrence expansion.
GPS check-in fails	Handle permission, device, signal and fallback approval.
Performance grade appears unfair	Review formula, role group, leave and assignment complexity.
Sentiment analysis is wrong	Show original communication and allow human correction.
Role redirect loops	Review canonical role priority and TestStaffRedirect.
Bulk role command crosses companies	Require company/team argument and dry-run.
Project team member lacks access	Confirm User, role, permission and assignment relationship.

93. Frequently Asked Questions

Can a landlord create custom roles?

Yes. Roles are created under the landlord company context.

Can a role be duplicated?

Yes. duplicate copies its permissions, but the copy must be reviewed.

Can AI assign permissions automatically?

It should not. AI recommendations require human approval.

Can staff belong to more than one role?

Spatie supports multiple roles, but the company should define whether Leaseora permits it for staff.

What is the difference between staff_role and Spatie role?

staff_role is a profile label; the Spatie role controls permission inheritance.

Does a permission grant access to every property?

Not necessarily. Department and StaffAssignment scope should also apply.

Can inactive staff log in?

They should not, while records remain preserved.

Should staff be deleted when they leave?

Deactivation or soft deletion is generally safer for audit; confirm the production destroy behaviour.

What does /staff/workload show?

Active assignments, tasks, schedules and performance indicators across the landlord team.

Can staff reassign tasks?

Yes, if StaffTaskController permission and eligible user checks allow it.

Does GPS check-in track staff continuously?

It should not unless separately authorised; the supplied fields support check-in/out points.

Are schedule compensation fields payroll?

No. Payroll integration and legal calculation are not described in the supplied scenario.

Can AI grade staff?

AI fields can support analysis, but human review should control any employment consequence.

How is cross-company permission isolation enforced?

Through company-scoped roles, SetPermissionsTeam, the team resolver and ownership checks.

Is a development project team the same as general staff?

No. PropertyDevelopmentTeamMember is a separate project-specific model.

94. Technical Matters to Confirm Before Production

Area	Confirmation required
Role description storage	Confirm where AI-generated descriptions and role metadata are stored.
Spatie team key	Confirm company_id or other team key and resolver order.
Role uniqueness	Confirm uniqueness by company and guard.
Multiple roles	Confirm whether staff can hold multiple roles and conflict resolution.
Direct permissions	Confirm whether staff can receive direct permissions in addition to role permissions.
Permission cache	Confirm invalidation after matrix changes.
Permission audit	Confirm old and new permission values in PermissionUpdated.
Invitation	Confirm signing, expiry, resend, revocation and single use.
Account status field	Confirm exact active/inactive field and middleware.
Destroy behaviour	Confirm soft delete, anonymisation and record reassignment.
Assignable types	Confirm polymorphic allow-list and policies.
Assignment duplicates	Confirm unique active staff/entity/role rule.
Access after unassign	Confirm cache and token behaviour.
Workload sources	Confirm StaffTask and PropertyDevelopmentTask relationship.
Task blocked state	Confirm status enum and UI behaviour.
Task approval	Confirm approval transition and permissions.
Task recurrence	Confirm scheduler, timezone and idempotency.
Time logging	Confirm rounding, editing, approval and aggregation.
Schedule recurrence	Confirm expansion and conflict handling.
GPS	Confirm consent, precision, fallback and retention.
Compensation	Confirm payroll boundary, currency and authority.
Performance formulas	Confirm denominators, role peer groups and period dates.
Performance correction	Confirm staff review and correction workflow.
Communication capture	Confirm integrations and whether full message content is stored.
AI sentiment	Confirm language support, confidence and human correction.
SuperAdmin override	Confirm reason, approval and notification.
Bulk commands	Confirm mandatory company scope and dry-run.
Project team access	Confirm relationship to User, Role and StaffAssignment.

Specification basis

Undefined production behaviour is deliberately listed here. The guide does not assume employment, payroll, GPS, AI or access-control behaviour that the supplied scenario does not explicitly define.

95. Quick Reference - 47-Step Operating Flow

1. Confirm the landlord company and permissions team context.

2. Review canonical roles and protected platform roles.

3. Write the job responsibility and access boundary.

4. Create a unique custom role.

5. Use AI name and description suggestions only as drafts.

6. Create or review grouped permissions.

7. Build the role-permission matrix using least privilege.

8. Run permission optimisation and security analysis.

9. Approve and save the permission matrix.

10. Confirm PermissionUpdated and cache refresh.

11. Create the staff User with is_staff and created_by.

12. Set department, title and role label.

13. Assign the company-scoped Spatie role.

14. Send CustomVerifyStaffEmail.

15. The staff member accepts the invitation and sets a password.

16. Activate the verified staff account.

17. Review the permission-driven staff dashboard.

18. Create active StaffAssignment records for properties or assets.

19. Confirm department and assignment scope.

20. Open the portfolio workload overview.

21. Review assignments, active tasks, schedule and capacity.

22. Open individual workload details.

23. Create or assign operational tasks.

24. Staff opens My Tasks.

25. Staff starts the task and records progress.

26. Staff logs time and comments.

27. Staff completes the task with evidence and actual hours.

28. Landlord approves where required and records a rating.

29. For recurring work, create the next occurrence once.

30. Create staff schedules and reminders.

31. Run conflict detection and human review.

32. Use GPS check-in/out only under approved rules.

33. Review schedule hours and overtime separately from payroll.

34. Collect periodic performance metrics.

35. Review task, quality, cost, communication and compliance context.

36. Review AI performance insights as advisory.

37. Discuss results and corrections with the staff member.

38. Log communications and required follow-up.

39. Escalate urgent or emergency items through the correct channel.

40. Enforce login, team, staff, role, permission, department and assignment checks.

41. Deactivate staff and revoke access when required.

42. Reassign open work before removal.

43. Use SuperAdmin platform oversight only under authorised purpose.

44. Review project-development team membership separately.

45. Run periodic role and permission certification.

46. Test cross-company access and direct URLs.

47. Retain auditable staff, assignment, task, schedule and permission history.

Business value

Leaseora's Team Management module allows a real estate company to delegate day-to-day work, limit each staff member to the right modules and assets, monitor workload and execution, and maintain accountable records without sharing unrestricted landlord access.

LEASEORA

TEAM MANAGEMENT

Build accountable real estate teams with controlled access, clear assignments and measurable work.

Support and onboarding

For role design, permission configuration, staff invitations, assignments, workload, schedules, middleware, performance or security onboarding, contact Leaseora through support@leaseora.com.

leaseora.com

Was this article helpful?

Your feedback helps us improve our documentation.

Back to Knowledge Base More in TEAM

Article Info

Category TEAM

Reading Time 43 min

Published Jul 30, 2026

Tweet Share

🤝

Need more help?

Our support team is available to assist you.

Contact Support