> ## Documentation Index
> Fetch the complete documentation index at: https://docs.imaracare.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Auditor Role

> Grant read-only compliance access to external reviewers and inspectors.

## Overview

The **Auditor** role gives a user read-only access to all compliance data for a single facility — inspection records, violations, incidents, documents, training logs, assessments, and medication records — without the ability to create, edit, or delete anything.

This role is designed for external compliance consultants, state inspectors reviewing historical records with your cooperation, or internal quality-assurance reviewers who should not modify live data.

## What an Auditor can do

* View all compliance records across every module
* Download documents, reports, and version history
* Export HHSC report PDFs
* View resident assessments and care plans
* Review staff training records and background check status

## What an Auditor cannot do

* Create or edit residents, staff, incidents, violations, or inspections
* Upload documents or new document versions
* Log medications or training completions
* Invite other users or change facility settings
* Access billing or trust ledger write operations

## Inviting an Auditor

1. Go to **Settings → Team** (Administrator role required).
2. Click **Invite team member**.
3. Enter the reviewer's email address.
4. Select **Auditor (read-only)** from the role dropdown.
5. Click **Send invitation**.

The invited user receives an email with a link to create their account. They will see a **Read-Only Access** banner in the sidebar so their role is always visible.

## Revoking access

To remove an auditor's access, go to **Settings → Team**, find the user, and deactivate their account. Access is revoked immediately upon deactivation.

<Note>
  Auditor access is enforced at both the database level (row-level security policies block writes) and the application level (write buttons are not rendered). Attempting a write operation via the API will return a permission error.
</Note>