Users, roles, and permissions

Open Users & Roles at /roles. Server authorization checks the signed in user, workspace, role, module grants, and the record controls implemented by the requested action. Hiding a menu item is helpful navigation, but it is not the security boundary.

#Base roles

Module actions may use an exact role policy. For example, payroll administration, bank import, contact mutation, and supply chain mutation are generally restricted to SUPER_ADMIN and MANAGER even when another role can read the page.

#Invite a teammate

1. Open /roles?tab=members.
2. Create an invitation with the teammate email and base role.
3. Assign module access and an access group if your workspace uses them.
4. Send the invite code or email link.
5. After redemption, verify that the member is approved and not suspended.

Managers can invite and manage ordinary roles. Only a SUPER_ADMIN can grant SUPER_ADMIN, manage module access at the owner boundary, or permanently delete a member.

#Permission sets and access groups

The Permission sets tab and /settings/access-rights support finer controls over groups, record scope, fields, permissions, and menu visibility. Only Access Rights administrators can change these controls. Other users see a restricted explanation instead of a partially functioning editor.

Use the smallest access needed. A base role grants a broad operating posture. Module grants determine available products. Permission sets and groups narrow what the member can see or change inside them.

#Review access

Open a member at /roles/users/<user-id> and select Access to review their module grants and permission sets. Profile editing and access editing are separate operations.

#Updated access editor

The following controls are prepared for the next ERP release. They require the matching ERP deployment and department scope database migration; updating this documentation does not enable them in an older deployment.

1. On the member's Access tab, select the top Edit button or Edit access.
2. Change the role, installed module access, permission sets, page rules, or supported record scopes that you are authorized to manage.
3. Select Save or Save access to persist the draft. Selecting a role alone does not save it.
4. Select Cancel to restore the saved values without submitting the draft.

The module choices include installed modules only and exclude temporarily suspended modules. Installing a module does not automatically grant access to every person.

#Record and department access

The updated member editor supports record scopes for Employees, Tasks, Expenses, and legacy attendance time off requests. This is not a universal record policy for every module or for the separate Time Off module.

An explicit individual choice overrides the shared group record scope for that data area. If My department is selected and the person has no assigned department, that scope returns no records. A department text label is not a substitute for the assigned department record.

Super Admins and Access Rights administrators retain their administrative recovery access. Record scope does not grant module access, grant write permission, or reveal restricted fields. See Record scope and field masking for coverage and verification.

#Access reviews

The Access reviews tab shows privileged access and pending invitations to authorized reviewers. Run a review after staffing changes and before sensitive finance or payroll cycles.

#Common problems