Understanding permissions and security
Roles and permissions
What each role can do, and who can submit to HMRC.
Last reviewed 25 October 2026Every person in a business has one role.
| Role | What it is for |
|---|---|
| Standard user | Prepares VAT returns. |
| Accountant | Reviews and approves returns. Submitting to HMRC is allowed per person. |
| Admin | Manages users, settings, billing and modules. |
Submitting to HMRC
An accountant can review and approve without being able to file. An administrator turns Allowed to submit returns to HMRC on or off for each accountant.
Where administrators manage access
- Users lists everyone with access. Use Add new to invite someone, and the row menu to edit access or disable and re-enable a person.
- Roles and permissions shows the built-in roles with their assigned users, and a table of who holds which role, who can submit, and who has two-step verification. Custom roles and permissions appear only where the service offers them.
- Controls holds the control mode, the cooling-off period and the oversight email. See Control modes.
Changing a role or the submit permission needs a fresh authenticator code, and is recorded with a reason.
Disabling a person
A disabled person can no longer sign in to the business. Use Enable in the row menu to restore access.
Related articles
Invite people and work across businesses
Add colleagues and your accountant, and switch between businesses.
Two-step verification and recovery codes
Authenticator codes, recovery codes and what to do if you lose both.