Add a colleague and choose their role

Your colleague gets their own sign-in to the console. Their role decides what they can change.

Operator page, owners only

Only owners see Staff in the top menu. Give each colleague the smallest role that covers their work.

You'll need

• Your colleague's work email address
• Either an email relay on Outgoing email, so FMS can email them their sign-in details, or a way to tell them a password in person or by phone

Add a colleague

1. Open Staff in the top menu.
2. Press Add a colleague at the top right.
3. Type their address in Email.
4. Choose a Role. The line under it says what that role can do. It starts on Viewer.
5. Press Generate beside Temporary password. Or type your own of at least 12 characters.
6. Press Add colleague. The dialog now shows their sign-in details: the console address, their email and the temporary password.
7. Press Email sign-in details to send all three to them in one email. Or press Copy details, or read them out in person or by phone.
8. Press Done.

They sign in with their email and that password. FMS then asks them to choose their own, and the temporary one stops working, so the email is no use to anyone after that. Next it asks them to set up two-step sign-in with an app on their phone. See first sign-in with a temporary password.

The email comes from the address set on Outgoing email. Replies come to you.

If Email sign-in details says it can't send

Message	What to do
No email relay is set up	Set one up on Outgoing email, or tell them the password yourself.
FMS doesn't know this console's web address	The server's PUBLIC_BASE_URL is not set. Ask the technical team, and tell them the password yourself for now.
Dry run: … nothing reached them	This copy of FMS writes email to files instead of sending it. Normal on a test server. Tell them the password yourself.
The email relay didn't take it	Press it again in a minute. If it fails again, check Outgoing email.

Who can do what

The Who can do what card at the top of the screen says the same in one line per role.

Role	Can change
Owner	Everything. Only owners see Staff in the top menu. Only owners edit plans, copy a sandbox's catalogue to production, switch Claude on or off for an environment, run the member import and the newsletter opt-outs (Members → Import from WordPress), and tick Can manage the archive's newsletters on a colleague. Owners also do everything a Developer does.
Developer	The machinery, nothing about members or money. Sees Health (with Dead letters) in the top menu, and Connections, Developer, Testing, Rehearsal, Sandboxes, Backup, Email and Logs under Settings. Switches sandboxes, replays dead letters and received webhooks, sets up service keys, the email relay and off-site backups, and reads the Migration page. Reads members and money like a Viewer. No staff accounts, plans or hand-over. Give this role to the person who keeps FMS running.
Membership manager	Support plus money: everything Support and Finance can change. On Consolidation they see only the three checks that compare FMS with Stripe and Mailchimp (FMS ↔ Stripe, FMS ↔ Mailchimp, Mailchimp → FMS; an owner runs the rest), with three Mailchimp fixes: Update Mailchimp for a member's tags (or Update all drifting), Add to the audience for paying members Mailchimp does not hold, and Strip all… paid tags from people who are not members. Give this role to the colleague who runs memberships, instead of two sign-ins.
Finance	Money. Record a payment, renew, stop a membership, change a member's plan, move a free or bank-paid member to Stripe billing by invoice and mark its invoice paid by bank transfer, change how an external member pays, remove a recorded payment. Fetch fees on Reports. New teams, seats and cancelling a team. Team invoices. Discount codes and donation amounts.
Support	Member and team care, no money. New members, including a free or paid-outside-Stripe grant. Notes, names, emails and newsletters. The access dates of a grant. Team members, team name, billing email, team admin and team newsletters. Re-issuing a gift link. Outreach status on Consolidation.
Viewer	Nothing. Reads every screen and downloads reports.

Every role can read Dashboard, Members, Plans and Reports. Health and its Dead letters tab are for developers and owners only. Under Settings, every role sees Consolidation and Audit. Every role can download the Reports CSV and the Consolidation export.

Buttons a role cannot use are hidden. If someone still reaches one, FMS says "Your role (Support) can't do this. Ask an owner." Audit keeps the attempt as Refused.

A change takes effect on the person's next click. They do not need to sign out.

Open a colleague's page

Press their email in the Staff accounts list. Their page shows their role, their status, when they last signed in, and five cards: Role, Newsletter archive, Signing in, AI assistant connections and What they did. Everything below starts there. Back to staff returns to the list.

Change someone's role

1. On their page, press Change role in the Role card.
2. Choose the New role.
3. Press Change role.

They stay signed in. The new role applies from their next click.

Let someone manage the newsletter archive

An archive manager gets a Manage newsletters button in the newsletter archive. There they rename, hide, recolour and reorder the newsletters members see. They can also read the whole archive without a plan.

1. On their page, find the Newsletter archive card.
2. Tick Can manage the archive's newsletters. It saves at once.

It works when they sign in to the website with the same email as their staff account. A colleague who only edits the archive can be a Viewer. Switching their account off takes the archive away too, and switching it back on returns it. They see the button the next time they open the archive from the website, with Open the newsletter archive or the Newsletter archive menu item. An archive tab already open, a reload or a bookmark keeps the old answer until they do. After you untick it, they keep it until their archive visit ends, which can take up to 12 hours.

To make either change count at once, ask them to press Refresh my access in the archive. It is in the account menu, the button with their initial and plan at the top right. The archive then asks FMS again.

The list shows an Archive manager badge beside their role.

Someone forgot their password

1. On their page, press Set a temporary password in the Signing in card.
2. Press Generate, or type your own of at least 12 characters.
3. Press Set temporary password.
4. Press Email sign-in details, or tell them the password in person or by phone.
5. Press Done.

Their old password stops working at once, and every browser where they are signed in is signed out at its next click. They sign in with the temporary password and choose a new one.

If the only owner is locked out

This includes an owner whose sign-in says the account still has the setup password. That message only appears when two-step sign-in is not set up: with nothing to prove it is them, the live console refuses that password, so they cannot change it themselves. Another owner can set an owner a temporary password. With no other owner, nobody can do it from the console. Ask the technical team. The fix is in the ops runbook. It runs staff-reset, which also resets their two-step sign-in. They set it up again with their phone at that sign-in.

If a colleague still has the setup password

Someone with two-step sign-in set up needs nothing from you. They sign in with the setup password and their code, and the console holds them on Your account until they choose a new password. Staff shows them as Must set password meanwhile. Someone without two-step sign-in cannot sign in at all. Set them a temporary password, as above.

Someone lost their phone

Use this when a colleague has lost their phone and has no recovery codes left. With a recovery code they can sign in and set up a new phone themselves, on Your account.

1. Make sure it is really them asking, for example by phone or in person.
2. On their page, press Reset two-step sign-in in the Signing in card.
3. Press Reset two-step sign-in again in the box that opens.

Their old phone and recovery codes stop working at once, and every browser where they are signed in is signed out. They sign in with their password next time, and the console asks them to set up two-step sign-in with their new phone. Their row shows Needs two-step setup until they do.

Their Claude connections end

Resetting two-step sign-in disconnects every Claude app connected to their account. They connect again from Claude once their new phone is set up.

The button only shows for a colleague who has two-step sign-in set up and is switched on. You reset your own from Your account instead.

End someone's AI assistant connections

A colleague can connect Claude to FMS and read members as themselves. See Connect Claude to FMS. You can see and end their connections.

1. On their page, find the AI assistant connections card. It lists each Claude app with when it connected and when it was last used.
2. Press Revoke all.
3. Press Revoke all again in the box that opens.

Claude stops reading FMS as them on its next question. They can connect again by signing in from Claude. To stop it for good, switch the account off.

Switching a colleague off ends their connections too. So does setting them a temporary password, resetting their two-step sign-in, and any password change, including one they make themselves. Switching them back on first ends any Claude connection left behind. If that fails, the account stays off. Pressing Enable on an account that is already on changes nothing and ends no connection. A connection whose password has since changed (by a reset outside the console, for example) is no longer listed as connected. Every question Claude asked is in Audit under AI assistant.

Someone leaves

1. On their page, press Switch off in the Signing in card.
2. Press Switch off again in the box that opens.

They can no longer sign in. If they are signed in somewhere, their next click takes them back to the sign-in screen. Their name stays on everything they did, because accounts are never deleted.

To bring them back, press Switch on on their page. They return with their last password, their old role and their archive tick. They sign in again: a browser left signed in before the switch-off stays signed out. If they have forgotten the password, set a temporary one afterwards.

Check it worked

• A new colleague's row shows Must set password until they choose their own
• Then it shows Needs two-step setup until they set up their phone. The same after a reset
• After their first sign-in the row shows Active and a time under Last sign-in
• A colleague who left shows Switched off
• After Revoke all, the AI assistant connections card reads that the colleague has not connected an AI assistant
• An archive manager shows Archive manager beside their role
• What they did on their page opens Audit and Logs filtered to them
• Settings → Audit has a line for each change, such as "Added mya@frontiermyanmar.net to the console as Support"

What FMS will not let you do

You cannot change your own role, password or switch here. Your row is marked You, and your page points you to Your account in the menu instead. The archive tick is the exception: you can tick it on your own page.

FMS always keeps one owner who can sign in. Lowering or switching off the last one is refused with "FMS needs at least one owner who can sign in. Make someone else an owner first."

Who is an owner already

Everyone who had a console sign-in before roles arrived became an owner. So does the first account made from the server settings. Look down the list and lower anyone who needs less.

After a restore

Staff accounts and roles live in the main database. Restoring a backup puts them back to that day. A colleague added since then is gone. A role changed since then goes back.

Switch-offs, new passwords, ended sessions and two-step resets made since the backup are put back straight after the restore. Backup and restore lists them.