Roles and permissions
What a permission is (a module plus an action), how roles bundle permissions, the twelve default roles and what each is meant for, the one-role-per-user rule, and when a change reaches a signed-in user.
Roles and permissions
A permission is the right to do one kind of thing in one module: View bookings, Create estimates, Approve payout runs. A role is a named bundle of permissions. Every user holds exactly one role, and what they may do in NirmaanOne is exactly what that role ticks. Roles keep access understandable: you decide what a Sales Executive or an Accountant may do once, then give people the role.
How it works in NirmaanOne
The permission catalogue
Permissions come from a fixed catalogue of 38 modules in 7 groups. Each module has View, Create, Edit and Delete unless it is read-only, and a few carry a special action:
| Group | Modules (special actions in brackets) |
|---|---|
| Organization | Dashboard (View only), Organization Settings, Users, Roles & Permissions, Screen Labels (View, Edit), Audit Trail (View only) |
| Projects | Projects, Societies, Tenants, Termsheets, Pricing Plans, Towers, Floors & Units, Parking, Construction Stages |
| CRM | Opportunities, Estimates (Approve), Bookings, Campaigns (send) |
| Masters | Contacts, Companies, Bank Accounts, Charge Components, Lookups |
| Accounting | Books, Chart of Accounts, Vouchers (Post), Payments (Approve), Demands (Issue), Commissions, Revenue Recognition (Approve), Reports (View only) |
| Documents | Document Templates (publish), Generated Documents |
| Workflows | Workflow Rules, Workflow Runs, Message Templates, Tasks, Notifications (View, Edit) |
That is 146 permissions in all. Module names in the role editor can differ from the tab you use them on: the Unit Pricing tab is the Pricing Plans module, the Structure tab is Towers, Floors & Units, the Tasks item under My work is filed under Workflows.
The special actions mean: Approve on Estimates approves a discount or price; Approve on Payments approves a payout run before its bank file is exported; Approve on Revenue Recognition changes the revenue policy and posts a revenue run; Issue on Demands turns a draft demand into a bill; Post on Vouchers posts a voucher to the books; publish on Document Templates snapshots a version for use; send on Campaigns sends a campaign.
How a check works
Every action in the app names the permissions it needs, and the user must hold all of them. Most need one; some need several because they touch several modules. Cancelling a booking with money on it, for example, needs the Edit permission on Bookings, the Edit permission on Demands and the Create permission on Payments, since it reverses demands and creates a refund. A missing permission answers "You do not have permission to do that."; a page you cannot view says "No access" with "You do not have permission to view <what>. Ask your administrator." Buttons are usually hidden, not greyed out, when the permission is missing (see Greyed-out buttons), and a sidebar group shows only when you hold any permission on one of its modules.
The same permissions gate what an AI assistant connected as you may do (see AI connectors) and which dashboard tiles and cards you get (see Dashboard figures).
Three kinds of role
- Locked: the Administrator. It always holds every permission, is kept in step as modules are added, and cannot be renamed, changed or deactivated. Clone it if you need a near-admin.
- Default: the other eleven seeded roles. Tailor their permissions, rename them or deactivate them; they cannot be deleted.
- Custom: roles you create with New role or Clone; deletable while nobody holds them.
An inactive role grants nothing and cannot be assigned, but keeps its permissions for later.
The default roles
| Role | Meant for |
|---|---|
| Administrator | Full authority across every project. |
| Finance Lead | Approves manual journal vouchers and escrow drawdowns: the full accounting set, including Post on Vouchers, Approve on Payments and Revenue Recognition, plus Approve on Estimates. |
| Accountant | Posts and reconciles money; cannot approve its own postings (no Post on Vouchers, no Approve). |
| Project Manager | Owns delivery and unit inventory: projects, societies, structure, parking, stages and pricing. |
| Sales Manager | Owns the pipeline and approves discounts (Approve on Estimates); campaigns, document templates. |
| Sales Executive | Works opportunities, estimates and bookings; cannot approve a discount. |
| Compliance Officer | Reads everything, certifies stages and RERA data, and can read the Audit Trail. |
| Auditor | Reads everything, changes nothing; can read the Audit Trail. |
| Rehab Officer | Owns societies, tenants and term sheets on redevelopment projects. |
| Site Engineer | Certifies construction progress; maintains structure and stages. |
| Front Desk | Logs walk-ins, calls and follow-ups; owns no pipeline. |
| Legal & Documentation | Agreements, registration and termsheet paperwork; no pricing or approval. |
Every seeded role also gets the View permission on Dashboard and Screen Labels and View plus Edit on Notifications, so everyone lands on the dashboard and reads their own inbox. Only the Administrator, Compliance Officer and Auditor hold View on Audit Trail, because the organization-wide log shows every user's sign-ins and changes.
One role per user
A user holds exactly one organization-wide role (an invitation without a role is refused: "Choose a role"). To give someone more rights, tailor their role or clone it into a new one; do not look for a second assignment. A role marked " (project)" on the Users grid is recorded but not enforced: it grants its permissions across the whole organization.
When a change takes effect
Permissions are worked out when a user's session starts and again each time it is renewed, about every 15 minutes. So a role change, or deactivating a role, reaches a signed-in user at their next renewal, not the instant you save. Deactivating the user is immediate: every session ends at once. An AI assistant connected as the user picks up a role change at its next request.
Example
Shree Siddhi Developers hires Kavita as a junior accountant. The finance lead wants her to record receipts and prepare demand runs but not to post vouchers or approve payouts. The seeded Accountant role is exactly that: Create and Edit on Payments and Demands (with Issue on Demands), View, Create and Edit on Vouchers but no Post, and no Approve anywhere. Kavita is invited with the Accountant role.
A month later the firm decides accountants should also be able to write off small balances by posting journals themselves. On Roles & Permissions the administrator clones Accountant as "Senior Accountant", ticks Post on Vouchers on the Edit role page and saves. On Users Kavita's row gets Edit role & access → Role "Senior Accountant" → Save changes. Kavita, still signed in, sees the Post button on her next page load after her session renews, within about 15 minutes. Her role page's History shows who created the role and which permission was added; her user's History shows the role change.
Had the administrator instead added Post to the default Accountant role, every accountant would have gained it, and a later reseed of the defaults would not remove it (a reseed only puts back permissions that were taken away from a default role).
Where you see it
- Roles & Permissions: the roles, their badges Locked / Default / Custom / Inactive, permission and user counts, Clone, Deactivate, Delete.
- New role and Edit role: the permission matrix with View, Create, Edit, Delete and the special actions, and the Members card.
- Users: the Role each person holds and Edit role & access.
- Audit log: who may open it, and role and permission changes.
- Dashboard: which tiles and cards a role gets, and the order.
- Sidebar, top bar and notifications bell: groups shown by permission.
Related
Related
- Roles & PermissionsScreen
The list of your organization's roles: open one, create or clone a role, deactivate or reactivate it, and delete custom roles nobody holds.
- New roleScreen
Name a new role, describe it and tick what it may do in each module, then create it so it can be given to users.
- Edit roleScreen
Change a role's name, description, active flag and permissions, see who holds it, and open its History.
- UsersScreen
The people in your organization: invite new users, change their role, deactivate or reactivate them, reset a lost two-factor authentication, and resend or revoke pending invitations.
- Audit logScreen
The organization-wide change log: every create, change and delete, every sign-in (including refused ones), sign-out and downloaded file, with who did it, when, from where and what changed.
- DashboardScreen
The page you land on after signing in: shortcuts to common jobs, a queue of what is waiting on you, the headline figures and one card each for projects, sales, stock, receivables, construction and the RERA accounts.
- Greyed-out buttonsScreen
Why a button is grey and can't be clicked, where to read the reason, and why some buttons are missing altogether.
- Sidebar, top bar and notifications bellScreen
The frame around every page once you are signed in: the sidebar with its groups, the top bar with the notifications bell, the light and dark switch and your account menu, and the banners that ask you to act.
- User accounts: invitations, status and sign-inConcept
How a person gets an account (by invitation), the four user statuses and how they are derived, how long an invitation link lives, what happens at sign-in with and without two-factor authentication, how long a session lasts, and what deactivation does.
- Audit trail and record historyConcept
What an audit entry records (who changed what, when, from where, with before and after values), how entries group into a record's history and a project's history, and who may read them.
- AI connectorsConcept
How an AI assistant such as Claude or ChatGPT connects to NirmaanOne, acts as one user within that user's role, what it can and cannot do, and how connections are watched and stopped.
- Dashboard figures: absorption, funnel and operational moneyConcept
How the dashboard's tiles and cards are worked out: absorption of saleable stock, the sales funnel by stage reached, money read from demands and receipts rather than the ledger, the RERA accounts card, and the period with its comparison window.