# Access policy

> Who can pair phones: a ban in an organisation on buff.systems, the “Mobile app” section of the admin panel, disconnecting phones, push and the log.

By default every employee can pair their phone and gets their own permissions on it. If
the company needs it otherwise, this is decided by the organisation owner on buff.systems or by the administrator
of a Buff Community or Enterprise installation.

## An organisation on buff.systems

The organisation owner opens **“Settings → Phone”** in the workspace and sees, besides their own,
**“Organisation’s phones”** — all employees’ phones: who paired them and when, when they were last
online. Any of them can be **disconnected**.

The same place has the ban on phones in the organisation. After confirmation (“Forbid phones?”) new
phones cannot be paired, and **those already paired are disconnected at once**: the connection
is broken, and the organisation’s data is wiped from the phones. The ban also applies to the Buff Code of
employees signed in to this organisation. The ban can be lifted in the same place; the phones then
have to be paired again.

## Buff Community and Enterprise

The installation’s admin panel has a **“Mobile app”** section:

- **“Mobile access is on”** — the main switch. When it is off, the installation does not
  register at the gateway: phones do not see it and new ones cannot be paired. Existing pairings
  are not broken — turn access back on, and the paired phones are online again.
- **“Who can pair phones”** — “All employees”, “Roles only” (choose the roles) or
  “Forbidden to employees”. With “Roles only”, the installation owner can pair their own phone
  even without a role from the list. “Forbidden to employees” closes pairing to everyone, including the owner,
  and phones already paired are disconnected.
- **“Push notifications”** — “Via buff.systems” or “Off”. When off, no notifications go to
  phones at all; what is waiting for an employee is visible in the app. More in
  [Notifications](/en/docs/mobile/notifications).
- **“Employees’ phones”** — all paired phones, with a “Disconnect” button.
- **“Buff Code signed in to the installation”** — employees’ machines that this
  policy also applies to, and how many phones are paired with each.
- **“Log”** — who changed what and when: pairings, disconnections, policy changes.

Changes take effect within half a minute. A disconnected phone loses the connection at once and
wipes this installation’s data as soon as it is online.

## The phone’s permissions

The policy decides **whether** a phone can be paired. **What** can be done from the phone is decided by the employee’s ordinary
permissions in the installation: the phone acts on their behalf and cannot do more than they can
in the workspace.