Permissions and Roles

Overview

Q&A access in TimelyChurch is controlled by two distinct gates that work independently:

1. Admin permissions (role-based) -- who can create, edit, archive, or delete a Q&A session in the admin portal.
2. Host PIN (knowledge-based) -- who can moderate a live session from the host panel.

These gates are independent. A user with admin permissions does not automatically pass the host PIN gate, and a person with the host PIN does not need admin permissions to moderate -- they just need the 6-digit PIN.

This page documents both gates and how they map to common roles.

Admin Permissions

Q&A has its own dedicated permission group, separate from Events -- granting someone Events access does not grant them Q&A access, and vice versa. Each protected action in the admin portal checks a Q&A permission:

Note: Moderating and changing the Host PIN are their own Moderate permission, separate from Edit.

The Q&A admin area lives under Q&A in your admin sidebar. The entire section also requires your church's plan to include the Live Q&A feature; on a plan without it, the Q&A item is locked and leads to the upgrade page.

Permissions are enforced per-church. A Church Admin in Church A has no Q&A access in Church B unless explicitly granted there.

Common Role Mapping (Default Roles)

By default, the only built-in role that can manage Q&A is Administrator (full access, Q&A included). The other default roles -- such as Finance Admin, Team Leader, Team Member, and Member -- do not include Q&A access, so they cannot open the Q&A admin pages until you explicitly grant them Q&A permissions in the role editor. If you create a role from the Executive Administrator template, it includes full Q&A access.

Roles are configurable per-church, so the actual matrix at your church may differ. To give, for example, a media volunteer the ability to create and run Q&A sessions without making them a full Administrator, open Administration > Roles & Permissions in your admin sidebar, edit their role, and set the Q&A Sessions row -- pick a level (None, View, Edit, Full Access) or tick the individual actions (view, create, edit, delete, moderate). Each role also has a scope (All, Team, or Self).

Their teams roles: Q&A sessions belong to the whole church, so a role whose reach is Their teams (Team Members scope, like the default Team Leader) cannot use the Q&A admin pages once team reach takes effect -- even if Q&A is ticked. Use a Whole church (All Records) role for people who run Q&A. See Roles & Permissions.

Host PIN (Moderation Gate)

The host panel is not protected by role-based permissions. Any device that knows the session's 6-digit Host PIN can authenticate and moderate. This is by design: it lets a pastor hand off moderation to a volunteer mid-service without provisioning admin accounts or assigning roles.

One exception: someone who is signed in with a role that can view Q&A but does not have Moderate is turned away from the host panel, even with the correct PIN -- their role says they don't moderate, and a PIN they happened to learn does not override that. Volunteers with no Q&A permission at all still host with the PIN as before.

How the PIN is Used

1. The first time a device opens the host panel, it is challenged for the PIN.
2. On a correct entry, that device is marked as authenticated for that session, and is treated as a host for that session only.
3. The host session is session-specific -- entering the PIN for Session A does not grant moderation access to Session B.
4. Host access persists for the life of that browser session. Closing or archiving the Q&A session ends moderation access.

Regenerating the PIN

If the PIN leaks (for example, a volunteer shares it outside your moderator team), anyone whose role has the Q&A Moderate permission can regenerate it from the session detail page. Regenerating immediately invalidates the existing PIN -- anyone who was relying on the old PIN will be re-challenged and must enter the new one.

Practical Implications

• Admin permissions are not required to moderate. A volunteer with the PIN can run the queue from their phone while the pastor speaks.
• Admin permissions alone do not open the host panel. Even an Administrator must enter the PIN the first time they open the host panel for a session. (Roles with Moderate can also moderate questions from the session page in the admin portal without the PIN.)
• Display View has its own gate -- a 32-character display token in the URL. See Display Token and Security for that flow.

Public Participant Access (No Login)

The participant-facing pages are completely unauthenticated -- anyone with the join link or join code can take part:

• The code-entry page, where participants type in the session's join code.
• The direct join link, which opens the session straight away.
• Submitting a question, voting on a question, and casting a poll vote.

These actions are protected by per-device rate limits (see Rate Limits and Abuse Prevention) and by the optional block participant flow from the host panel. There is no participant login; each participant is recognized by the browser on their own device.

Recommended Setups

• Small church / single-pastor: The Administrator role already covers Q&A. The pastor uses the host panel from their phone with the PIN. Display View runs from a separate browser tab with the display URL.
• Larger church / dedicated AV team: Pastor has the Administrator role. AV volunteer has only the PIN for that Sunday's session -- no admin account needed. Display View URL is preloaded in ProPresenter. If a volunteer needs to create sessions themselves, grant their role the Create / Edit Q&A permissions instead of giving them full Administrator -- and Moderate too if they will also host while signed in.
• Multi-campus / association: Each campus has its own church record with its own role grants. Q&A sessions are church-scoped; cross-campus moderation is not supported by design.

Previous: Event Integration | Next: Rate Limits and Abuse Prevention