Shared stations

One login on a shared terminal, and everybody's own name on what they sign.

The problem this solves

A workshop, a gatehouse, a weighbridge office. One login — Workshop — and a dozen people using it through the day.

Everything filed under that login says Workshop. Every signature, every submitted by, every approval. Which means:

• No document can say who actually did the work.
• A two-slot form — Issued by and Received by — can be signed on both sides by one person, and both sides read Workshop.
• Anybody at that keyboard can withdraw anybody else's sign-off, because the app cannot tell them apart.

Giving each person their own login solves it, and is often not what you want: a shared terminal with twelve accounts on its sign-in screen gets solved by sharing one anyway.

How it works

A second, local check-in sits on top of the ordinary login.

The login says	The check-in says
Which station this is — Workshop, Gatehouse	Which person is at it — and their own clearance

The person picks their name and types a PIN. From then on, everything they file carries their name.

A shared login does nothing at all until somebody checks in

This is the safety rule the whole arrangement rests on. A login marked as a shared station is refused everywhere until a named person has checked in. So the station's login can hold whatever clearance the desk needs without that clearance ever being usable by "Workshop" as such.

Setting one up

You need to be an administrator, signed in with your own login — not checked in at a station.

1. Mark the member as a shared station

Open Members, choose the member, and tick Several people share this login.

The tick only appears on an existing member

Create the member first, then come back and mark it. Marking it takes effect immediately: from that moment nobody can use the login until somebody is set up to check in at it.

2. Say who works there

The button Who works here opens the roster. Add somebody for each person, giving:

Field	What it is
First name and Surname	Exactly what will appear on anything they sign
Clearance	What they may do while checked in here
PIN	The credential they will type. You set it; you can reset it later
Active	Clear it to stop somebody checking in without removing them

A station can share out its authority, never add to it

The clearance list stops at the station's own level. A level-6 person cannot be given level-2 rights at a level-6 station.

Removing somebody, or making them inactive, does not touch anything they have already signed. Their name stays on it, which is the point of the whole feature.

On the roster, Linked person says who each person is elsewhere in your organisation — a team member, or the account holder. It gives them no PIN and no clearance. It is what stops them approving their own refund at a till: see Nobody approves their own refund.

Checking in and out

At the station, the app asks Who is working here? — pick your name, type your PIN.

While you are checked in, the header shows your name and a Check out control. Check out when you finish your shift.

An administrator can also check somebody out remotely — the roster shows Working here now, with when each person checked in and when they were last active. Use it when a tablet has been left signed in.

Too many wrong PINs locks the person out

The lock clears itself shortly. An administrator can also reset the PIN to let them straight back in.

What check-in changes, and what it does not

This is the part worth reading twice, because the two halves pull in opposite directions.

Clearance is the operator's

What you may do — record, edit, delete, approve — follows the clearance you were given for this station, capped at the station's own.

Reach is the station's

What you may see does not change at all. The tracker group whitelist belongs to the station's login, so:

An operator sees exactly the data their station sees. Clearance governs what you may do; the station's whitelist governs what you may reach.

Why it works this way

It caps the damage a borrowed PIN can do — administrator-level actions, but only over the station's own groups. If you need wider access than the station has, use your own login.

Signing and approving belong to the desk

The mirror of the rule above. If the station's own login may sign a form or approve one, so may whoever is checked in at it.

A station named as an authorised signer was appointed to that desk precisely so that whoever is on shift does the job. Judging that by the operator's own clearance would make the appointment unusable — the signature field would simply vanish from the form.

A station holds one approval, not one per operator

Once anybody at a station has approved something, the station has approved it. A form needing two approvals cannot have both filled from one keyboard — that separation is the whole reason the threshold exists.

Chat is yours, and the desk has its own

Messages are the one place where checking in gives you something of your own rather than the station's.

Once you are checked in, you have your own conversation list, and anyone in the organisation can message you by name. A colleague at the same station cannot see your conversations, cannot open them, and cannot clear your unread badges. Check in at a second station and your messages follow you — you are one person with one inbox, not one inbox per desk.

The station stays addressable as well, as a shared desk. Anyone can message Workshop Bay and whoever is on shift will read it.

In a conversation addressed to the desk, everything the desk has sent sits on your side of the chat, as your own messages would — whoever on shift wrote it. You can edit or withdraw only the ones you wrote yourself; a colleague's stay theirs, and deleting one hides it for everyone at the desk while the other side still sees it.

Online and last seen follow the same split. Your own online and last seen are yours, and Hide my last seen hides only yours. The shared desk shows online while anybody is checked in there.

A desk conversation belongs to the shift, not to you

In a conversation addressed to the station, the unread count and the read receipts are the desk's. If you open it, it is marked read for everybody who works there, and the sender is told the desk has read it. Your own conversations behave normally.

Two practical notes. On a shared tablet, check out when you finish — your messages are cleared from the screen when you do, and left there if you do not. And a notification at a shared station tells you only that a message arrived, never who sent it or what it says, because the next person to walk up may see the screen.

When something looks wrong

What you see	Why, and what to do
The login is refused everywhere, on every screen	Nobody is checked in. That is the design — pick a name and enter a PIN.
"Nobody has been set up to work at this station yet"	An administrator needs to open the member and use Who works here.
The Who works here button is missing	You are checked in as an operator. Only an administrator signed in with their own login may change the roster.
Somebody's name is missing from the list	They are marked inactive, or were removed. Anything they signed keeps their name.
A PIN is refused after several tries	The lockout. Wait, or ask an administrator to reset the PIN.
A signature field is not offered	The station is not a named signer on that form. Check-in shares out the station's authority; it does not add any.
"You have already approved this" from somebody who has not	A colleague at the same station approved it. A station counts once.
Items are missing that your own login can see	Reach follows the station's whitelist, not yours. Use your own login.

See also

• Members and teams — creating the member in the first place.
• Who can do what — clearance levels and the whitelist.
• Submitting an entry — signing and approval.