Roles, licenses, and permissions

Several separate checks decide what a team member can do in Ona. Their role controls the parts of the app they can use. Their member status shows whether they have joined. Your organization’s subscription status can still block protected actions even when the person has the right role.

On the Team Members page, you can check role and invitation questions in one place. The list shows each member’s roles and status together. Use the Settings (1) link in the left sidebar to open settings, Team Members (2) to open the team list, and Invite Member (3) to start a new invitation.

What are roles, licenses, and permissions?

On the Team Members page, a role is the permission label on a team member. Subscription status is the organization-wide gate that decides whether protected work can continue.

Use the Status filter (1) and Role filter (2) to narrow the list, the Roles column (3) to see each member’s role labels, the Status column (4) to see whether they are invited, active, or deactivated, and Invite Member (5) to add someone new.

Roles are assigned per member. One person can hold more than one role, and their permissions add up. For example, a person who is both Clinician and Admin gets the admin dashboard, including links into Settings.

Member status is separate from role. A member can be Invited, Active, or Deactivated. An invited member has not joined yet. A deactivated member has been archived and is hidden from the active list.

Ona does not show a per-member license setting in Team Members. When an action is blocked for license reasons, the reason comes from the organization’s subscription status, not from a role checkbox on that person.

When should I check roles, licenses, and permissions?

On the Team Members page, check a member when they can sign in but cannot access the part of Ona they expect.

Use Settings (1) to get to the settings area, Team Members (2) to open the member list, Status (3) to check whether a member has joined, and Roles (4) to check which parts of the app they can use.

Common symptoms point to different causes:

• If Settings is missing, the person is not an Owner or Admin.
• If a clinician’s dashboard looks more limited, the person only has the Clinician role, so their dashboard is scoped to their own patients and visits.
• If a front-desk or back-office user needs the operational dashboard but not Settings, use Staff.
• If actions are unavailable for everyone, check the organization’s subscription status.
• If a new team member cannot join, check whether their invitation is expired, already used, or invalid.

How do roles work in Team Members?

In the left sidebar, click Settings (at the bottom). Then click Team Members. On the Team Members page, owners and admins edit roles, and when pricing levels exist they also manage the clinician-only Pricing section; only owners can grant or revoke Owner.

Use Roles (1) to review the member’s assigned roles, and the Role picker (2) to change them when you have permission.

Role	What it allows
Owner	Ownership control for the organization. Only an owner can grant or revoke Owner, and the organization must keep at least one active owner.
Admin	Access to Settings, team management, billing configuration, and the member sheet's Pricing section when pricing levels exist. Admins can manage Admin, Clinician, and Staff roles.
Clinician	A clinician-scoped dashboard for the clinician’s own patients and visits. Clinicians are also included in the roles that can sign outgoing referral letters faxed under their name.
Staff	Front-desk and back-office access to the operational dashboard, without Settings.

When someone has more than one role, the broader dashboard wins in this order: owner or admin first, then staff, then clinician. That means a clinician who is also an admin gets the admin surface.

How do invitations and member status work?

On the same page, owners and admins invite new members with Email, Roles, and Display name.

Use Email (1) for the address that gets the invitation, Roles (2) to choose what the person can do, Display name (3) for how they appear in the app, and Send Invitation (4) to create the invite.

A new invitation can include Admin, Clinician, or Staff. It cannot include Owner. To make someone an owner, invite the person with another role, then have an owner update the existing member record.

Invitation links can expire. The invite form includes Expires after, which can be 1 to 30 days. The default is 14 days. When an invitation is sent, Ona shows an invitation link that you can copy and share manually.

On the acceptance page, the invited person sees the organization name and the roles they are joining with. If the link is incomplete, they see This link isn't complete and need to check the link they received or ask the clinic for a new invitation. If the link has expired, they see This invitation has expired and need a new invitation. If a link is invalid or already used, they see We couldn't load this invitation. If the person already joined from another tab, Ona sends them to the dashboard instead.

For invited members, owners and admins can resend the invitation when the member has an email on file and is not an owner. A valid, unexpired invitation link can also be copied from the member’s actions menu.

How does subscription status affect permissions?

On the same page, subscription status can block protected actions even when the team member’s role is correct.

Use the Status filter (1) and Role filter (2) to narrow the list, the Status column (3) to check each member’s current state, and Invite Member (4) to add a member when invitations are available.

When the organization does not have an active subscription, Ona shows a reason. These are the messages you may see:

Message	What it means
No active subscription. Subscribe to get started.	The organization does not have an active subscription.
Your trial has ended. Subscribe to continue.	The trial has expired.
Payment failed. Update your payment method.	The subscription is unpaid because payment failed.
Subscription cancelled. Renew to continue.	The subscription has been cancelled.
No active subscription. Subscribe to continue.	The subscription is not active for another reason.

If one person is blocked, check their role first. If everyone is blocked from the same protected action, check the subscription.

What can’t I do with roles and invitations?

On the Team Members page, role and invitation controls have limits that protect the organization’s access.

Use Your own row (1) to find the member record for the signed-in person, No self actions (2) to note the row’s restricted actions area, Owner member (3) to identify an owner’s row, and Owner role (4) to see the owner badge on that row.

• Admins cannot grant or revoke Owner. If an admin edits an owner, the Owner role stays checked and locked.
• Owners cannot be added through the invite form. Invite the person with another role, then have an owner update the existing member record.
• The organization cannot be left without an active owner.
• A member must have at least one role.
• You cannot archive yourself from the team member actions menu.
• You cannot archive an owner from the team member actions menu.
• You cannot archive a member who is already Deactivated.
• An expired invitation link cannot be used. Resend the invitation to create a fresh one.

Common questions

Why can one person have several roles?

Roles add together. Use multiple roles when one person needs more than one surface, such as a clinician who also manages settings.

Why can’t I see Settings?

Only Owner and Admin can access it. Staff can use the operational dashboard without settings access. Clinician users get a clinician-scoped dashboard unless they also have a broader role.

Can an admin make someone an owner?

No. Only an owner can grant or revoke Owner. Admins can manage Admin, Clinician, and Staff roles.

Why can’t I copy an invitation link?

In Team Members, the copy action is only available for an invited member with a current invitation link. If the invitation expired, resend it to create a fresh invitation.

Why is an action unavailable when my role looks right?

The organization’s subscription may not be active. Role controls decide who can access a feature, but subscription status can still block protected actions for the whole organization.