Who May Book
A calendar’s permissions decide which groups may reach it and what they may do.
Where to find it
Architect Panel → Layout & Pages:
- Booking Calendars — the calendar, then its row actions for everything else
Admin Panel → User Administration:
- User Groups — the groups themselves
Permissions are per calendar and per group
Each entry names a group and what it may do. So one calendar can be bookable by customers, administered by staff, and invisible to everybody else.
Three roles, usually
- Book — make and see their own bookings.
- Administer — see everything, make manual bookings, record attendance.
- View — see the schedule without changing it.
Most calendars need exactly these three, and mapping them onto existing groups is usually the whole task.
People must not see each other’s bookings
The requirement that matters most on a customer-facing calendar. A booking often reveals something — that somebody has an appointment at a clinic, a meeting with a solicitor, a session with a service.
Test it explicitly: book as one customer, sign in as another, and look.
Set permissions before publishing
A calendar reachable while half-configured takes real bookings into availability you have not finished defining. Restrict it while you build.
Public calendars need thought
If anybody can book without signing in, you have an unauthenticated form creating records. Consider what stops abuse — verification, rate limiting, a booking horizon — before opening it.
Administrators can see everything
Including the form fields people filled in, which may be sensitive. Grant administration to the people who need it for the service, not to everybody who works there.
Test as a real user
From an account with exactly the groups a customer or a member of staff would have. Reading the permission list tells you what you configured; signing in tells you what you did.
Review when groups change
Calendar permissions reference groups, and a group repurposed for something else silently changes who can book. When groups are reorganised, check the calendars.
Worked example
A clinic calendar is bookable by the Patients group, administered by Clinicians, and viewable by Reception. A test patient account confirmed one patient cannot see another’s bookings — checked again after a group reorganisation, which had briefly widened it.
Recommendations
- Restrict before publishing.
- Test customer-to-customer visibility explicitly.
- Administration to those who need it for the service.
- Re-check calendars after any group reorganisation.