# Roles and actions: who can do what

Find the authority, authentication and review conditions for a task, with links to the working procedure.

Source: https://help.smartfact.ai/manuals/kitproof/roles-and-actions

Review edition: 25 October 2026

Roles: owner, author, reviewer, supervisor, operator, viewer

Use this reference for the real site. **Or** means either role is sufficient for the named action. **Plus** means the same person needs both the role and the additional authority. A requirement for another person is stated separately. Accounts grants and the local site assignment must both allow the role.

**Recent authentication** means completing the Accounts second factor within the last five minutes. Ordinary sign-in checks still apply to the other rows. Current site state, commercial admission, record revisions and any active holds can also refuse an otherwise permitted action.

## Choose the task and authority

| Task | Who | Additional conditions | Related guide |
| --- | --- | --- | --- |
| Set up the site and restrict local role assignments | Owner | Initial setup and role assignment changes require recent authentication. The local assignment can only narrow Accounts grants. | [Procedure](/manuals/kitproof/site-setup) |
| Add or retire a checking station | Owner | Retirement is refused while an in-progress attempt has a live lease at that station. Arrange a pause or authorised takeover first. | [Procedure](/manuals/kitproof/site-setup) |
| Create configuration revisions and candidates | Author | Save components, aliases, per-kit quantities and policies before freezing the candidate. Reviewer authority alone does not edit the draft. | [Procedure](/manuals/kitproof/configure-requirements) |
| Review expected examples and run verification | Author or Reviewer | Review the exact example version separately from running proof. The ordinary native example review does not enforce two different people. | [Procedure](/manuals/kitproof/proof-and-activation) |
| Activate configuration | Reviewer | Recent authentication and current passing proof with reviewed examples. Native activation does not itself impose a universal author exclusion; enrolled independent-review controls can add restrictions. | [Procedure](/manuals/kitproof/proof-and-activation) |
| Withdraw or prepare rollback | Reviewer | Recent authentication. Withdrawal holds affected work. Rollback prepares fresh content for verification, subject to enrolled controls. | [Procedure](/manuals/kitproof/source-and-release-changes) |
| Import jobs or decide a source revision change | Supervisor | Review preview and each affected physical kit. Started or completed kits require explicit disposition before the new revision is activated. | [Procedure](/manuals/kitproof/import-jobs) |
| Read jobs, requirement plans and retained history | Author or Reviewer or Supervisor or Operator or Viewer | Current working-role access is required. Owner alone has the complete-export exception below. | [Procedure](/manuals/kitproof/history-and-exports) |
| Claim a kit and record components, serials or lots | Operator or Supervisor | Select an enrolled station and hold current attempt control. Required serial or lot capture must be accepted before the component counts. | [Procedure](/manuals/kitproof/scan-components) |
| Take over a kit with another live owner | Supervisor | Use the explicit takeover route at the receiving station after arranging the physical handover. The new claim invalidates previous control. | [Procedure](/manuals/kitproof/station-problems) |
| Request an alternative, manual count or waiver | Operator or Supervisor | Current station ownership and the frozen policy must permit the request. Requesting does not satisfy the requirement. | [Procedure](/manuals/kitproof/alternatives-and-exceptions) |
| Approve or decline an exception | Supervisor | Recent authentication. Native self-decisions are recorded where permitted, rather than described as independent. Alternatives need a new scan after approval; manual counts and waivers retain exceptions. | [Procedure](/manuals/kitproof/alternatives-and-exceptions) |
| Reverse the latest own allocation | Operator or Supervisor | Use Reverse my last scan on open work, with a reason, as the same actor at the station that made the latest allocation. | [Procedure](/manuals/kitproof/reversals-and-rework) |
| Reverse another or an earlier allocation | Supervisor | Recent authentication. The original allocation is retained as reversed, and serial restrictions still apply. | [Procedure](/manuals/kitproof/reversals-and-rework) |
| Release a hold or cancel an attempt | Supervisor | Recent authentication and reasoned disposition. Hold release leaves a claimable paused attempt, subject to source and release barriers. | [Procedure](/manuals/kitproof/reversals-and-rework) |
| Open controlled rework | Supervisor | Recent authentication. Current or same-plan mode must pass its stated prerequisites; the new attempt starts from zero. | [Procedure](/manuals/kitproof/reversals-and-rework) |
| Complete an individual kit | Operator or Supervisor | Current attempt control and every required allocation or permitted disposition. Read Verified or Completed with exceptions distinctly. | [Procedure](/manuals/kitproof/scan-components) |
| Read evidence CSV, JSON or the checking sheet | Author or Reviewer or Supervisor or Operator or Viewer | Use the exact retained attempt. Expected requirements are preparation information, not checked physical contents. | [Procedure](/manuals/kitproof/history-and-exports) |
| Prepare and download the complete site export | Owner or Supervisor | Recent authentication at both stages, for the real site. Downloading does not close the site or cancel Accounts billing. | [Procedure](/manuals/kitproof/history-and-exports) |
| Allow or withdraw an exact OrderRun evidence read | Owner | Real site and recent authentication. Exact current source, job, line, kit and revision; no production history browsing is granted. | [Procedure](/manuals/kitproof/evidence-read-permissions) |
| Connect or recover a protected ConfigSheets feed | Supervisor | Recent authentication, approved source map and reviewed producer request. The producer must be stopped during the supervised exchange. | [Procedure](/manuals/kitproof/recover-configsheets-feed) |

## Combine roles without losing the result

A Supervisor can perform ordinary station work directly in KitProof. A Viewer can inspect its evidence without gaining exception authority. When a checking operator changes, preserve the exact kit, attempt, serials, accepted allocations, waiting request and physical contents. The [worked kit](/manuals/kitproof/worked-kit) shows why an approved alternative and a manual-count exception can lead to different final results.