Add-Ons & Modules

How vertical add-on packages are activated, entitled, and gated across TotalApp.

What is an Add-On?

Add-ons are purchasable vertical modules that extend TotalApp with industry-specific screens, master data, roles and capabilities — Legal, Construction, Manufacturing, Education, Energy, Agriculture and more. Core screens (HR, Finance, Project Management) are always available; add-ons are gated behind a per-tenant entitlement and a per-user domain role.

Two independent gates

An add-on screen opens only when both hold: the tenant has purchased the package (Level-1 paywall) and the signed-in user carries a matching domain role (Level-2 RBAC). Missing either one returns a paywall or a 403.

Package Activation

An administrator activates a package for the whole tenant from Administration & Access → Add-Ons. Activation writes to the tenant entitlements.json store; the app reads the same file, so what the admin grants is exactly what the app sees.

Admin opens Add-Ons

→

Toggle package ON

→

entitlements.json updated

→

Screens unlock for role-holders

The Package Catalog

The catalog lists every purchasable package. Wired packages have live, guarded screens today; coming soon packages can be granted but their screens are not built yet.

Package	Domain	Status
Legal	LEGAL	Wired
Construction Field Ops	CONSTRUCTION	Wired
Manufacturing (MOM)	MOM	Wired
Education	EDUCATION	Wired
Energy & Utilities	ENERGY	Wired
Agriculture	AGRICULTURE	Wired
Healthcare	HEALTHCARE	Coming soon
Sales	SALES	Coming soon
Payroll	PAYROLL	Coming soon

Governance vs Operational Setup

Every add-on splits its setup screens into two groups:

Administration & Access (System / Governance) — the Roles and Staff Master screens. Admin-only; hidden from non-admins in the sidebar and My Apps, and 403 on direct URL.
Operational Setup — domain master data (client directories, jobsites, site zones, work centers, fields, …). Open to any user who holds a domain role in the add-on.

Generic URL, domain title

All add-ons share one URL shape — /{domain}/roles, /{domain}/staff — while the header title stays domain-specific (Legal Team, Construction Staff & Team, Plant Workers).

Where to go next

Legal add-on — matters, contracts, client directory.
Construction Field Ops add-on — jobsites, crews, daily logs.
Roles & Add-On Access — the full RBAC + entitlement architecture.

Frequently Asked Questions

How do I activate an add-on?

A tenant administrator toggles the package on under Administration & Access → Add-Ons. It takes effect immediately for every user who already holds a matching domain role.

I bought the package but still can’t open a screen.

Purchase is only the first gate. You also need a domain role for that add-on assigned to your user — ask your admin to grant you a role from the add-on’s Roles screen.

Why can’t a normal employee see the Roles screen?

Roles and Staff Master are governance screens — admin-only. They are hidden from non-admins entirely and return 403 on direct navigation.

Is the admin’s view of activation the same as the app’s?

Yes. Both read and write the same tenant entitlements.json — there is no separate source of truth.

What’s the difference between an add-on and an App Group?

An add-on is a single purchasable vertical (Legal). An App Group is a curated bundle of screens across modules for a use-case (e.g. Construction Field Operations); see App Groups.