Permissions

Permissions control what each member of your organization can see and do. You manage them as permission groups: a named set of members and a matrix of what those members may do in each module. A member can belong to several groups, and gets everything any of their groups grant.

Only Admins and the Owner can open Settings > Permissions.

#How access is decided

Before you create your first group, read this section. It explains the three situations a member can be in.

• Owners and Admins always have full access. The matrix never restricts them. Adding an Owner or Admin to a group changes nothing for them.
• No active group exists. Every member has full access to every module your organization has enabled. This is how a new organization starts.
• At least one active group exists. From that moment, members below Admin only have what their groups grant. A member who is in no group can open the dashboard, their profile and Settings, and nothing else.

Changes take effect immediately. A member does not need to sign out.

#The Permissions page

Settings > Permissions lists your groups with their member count, how many permissions each grants, whether it is active, and when it was last changed. From here you can create a group, open one to edit it, or delete one.

If groups exist but none is active, a notice reminds you that every member currently has full access.

#Create a group

1. Open Settings > Permissions and select New group.
2. Enter a name that describes the role, for example "Warehouse supervisors" or "Sales team".
3. Leave Active on, or turn it off to prepare the group without applying it yet.
4. Under Members, tick each person who belongs to the group. Only active members of your organization are listed.
5. In the matrix, tick what the group may do. See The permission matrix below.
6. Select Create group.

#The permission matrix

The matrix shows one card per module your organization has enabled. Open a card to see its submodules, one per row. The first card is open; select a card's header to open or close it.

Each row has these controls:

The Select all checkbox in a card header ticks every permission in that module. It shows a dash when only some of the module's permissions are ticked.

#All and Own

All and Own are independent. Tick Own to let a member work with what they created, and All to let them work with everything. If both are ticked, All applies.

A member's "own" records are the ones they created. Some submodules widen this to records assigned to them:

• Asset reservations and consignments: the consignee is also an owner.
• Asset inspections: the assigned inspector is also an owner.
• Asset audits: every member of the audit team is an owner.

A member with Own on a submodule sees only their own records in its lists and dashboards, and gets an access error if they open someone else's record by link.

#Special permissions

Some submodules have actions that should not follow from ordinary edit rights. These appear in the Special column with a short label, and they are granted on their own. A member with Edit but without the special cannot take that action, and a member with the special but without Edit can take only that action.

Special permissions available today:

Approval-type permissions apply to every record in the organization, not only the member's own: they decide who is eligible to approve, and the workflow decides the rest. Disposing of an asset is different, because it changes the asset itself: it also needs Edit on the Asset Registry for that record. The two Sales overrides also need Edit on the order: without it a member cannot confirm the order at all. They are the exception to the rule that, in an organization without active permission groups, every member has every permission: there, only Owners and Admins can override a credit hold or a stock shortfall. Cancelling or closing a sales order also needs Edit on the order, but follows the usual rule: without active groups, every member who can edit the order may cancel it. Releasing a sales order hold and amending a sales order work the same way. Approving or rejecting a discount below the margin floor decides both quotations and sales order amendments; on an order it also needs Edit on the order, and nobody can approve their own request.

Projects & Tasks' special permissions are different: they stand in for abilities that otherwise come with a member's organization role, so ticking one gives it to a Member and leaving it unticked takes it from a Manager. Each still needs the ordinary permission for its screen. See Projects & Tasks.

#What the matrix does not cover

• Settings is never in the matrix. Access to Settings follows the member's role: Admins and the Owner manage the organization, everyone else manages only their own profile and preferences.
• Modules without submodules (for example Reports and Communications) have no row to tick. Members can see them as long as the module is enabled for your organization.
• Some modules are still being connected to the matrix. For those, ticking permissions records your intent and controls the sidebar, and the module's pages are protected as each module is connected. Warehouse, Asset Management, Container Depot, Finance, Inventory, Maintenance, Consumables, Products, Purchasing, Sales, Fleet Management and Projects & Tasks are fully connected today.
• Actions that don't apply are not offered. Where a submodule has no records of its own, or no way to edit or delete them yet, the matrix shows only the checkboxes that do something. For example, Inventory's Overview and Balances each offer only View all.

#Edit a group

Open a group from the list to change its name, members or permissions, or to turn it off. Select Save changes when done.

Two notices can appear at the top of the edit page:

• Former members. The group still lists people who are no longer active in your organization. They are not shown in the member picker and are removed from the group when you save.
• Legacy permissions. The group holds permissions from an older version of the system that no longer exist in the matrix. They are not shown and are removed when you save.

Both notices describe what saving will do. If you would rather keep the group as it is, leave the page without saving.

#Deactivate or delete a group

Turning Active off keeps the group's members and permissions but stops it from granting anything. This is the safest way to pause a group you may need again.

Deleting a group removes it permanently. The list asks you to confirm.

#Common questions

A member can see a module in the sidebar but every page says they do not have permission. Their group ticks the submodule but no action under it. Open the group and tick at least View for that submodule.

A member cannot see a module at all. Either no group grants them anything in that module, or the module is not enabled for your organization. Check the group first, then Settings > Modules.

I added someone to a group but nothing changed. If they are an Admin or the Owner, groups do not apply to them. Otherwise check that the group is Active.

Two groups disagree about a member. Grants only add up. If one group gives View All and another gives View Own, the member has View All. A group can never take away what another group grants.

Can I let someone approve transfers without letting them change them? Yes. Grant the Approve or reject a transfer special permission and leave Edit unticked.