New role
Name a new role, describe it and tick what it may do in each module, then create it so it can be given to users.
New role
Use this page to build a role from scratch: give it a name, and tick, module by module, what someone holding it may view, create, edit, delete, approve, issue, post, publish or send. Once created, you give the role to people on Users.
Where to find it
On Roles & Permissions, click New role.
The page needs the View permission on Roles & Permissions (otherwise "No access" and "You do not have permission to view roles. Ask your administrator."). Saving needs the Create permission on Roles & Permissions; without it the form is read-only, there is no Create role button and the link at the bottom reads Back to roles instead of Cancel. In the default roles only the Administrator can create roles.
Before you start
Decide what the role is for and which modules it touches. If an existing role is close to what you need, it is quicker to Clone it on Roles & Permissions and adjust the copy.
What you see
The header reads New role with the line "Name the role and tick what it may do in each module."
The first card holds:
| Field | Rules |
|---|---|
| Role name | Required, 2 to 100 characters: "Use at least 2 characters" / "Use at most 100 characters". Must be unique in your organization (case doesn't matter). |
| Description | Optional ("Optional"), up to 255 characters: "Use at most 255 characters". It is shown under the Role list on the invite form and the Edit user panel once the role is picked, so a short "what this person does" helps. |
The Permissions card shows "N of M selected" and the buttons Select all and Clear, then the permission matrix. The columns are Module, All, View, Create, Edit, Delete, and then the extra actions some modules have: Approve, Issue, Post, and "publish" and "send" (these two are shown in lower case).
The rows are grouped by area (Organization, Projects, CRM, Masters, Accounting, Documents, Workflows). Each group row shows how many of its permissions are ticked ("have/total") and an All box that ticks or clears the whole group; the box is half-filled when only some are ticked. Under it, one row per module with its own All box and one box per action. A dot "·" means the module has no such action (for example, Dashboard and Audit Trail are view-only; Estimates has Approve; Demands has Issue; Vouchers has Post; Document Templates has "publish"; Campaigns has "send").
The module names are the ones the permission catalogue uses, which can differ from a tab's label: the Unit Pricing tab is the Pricing Plans module, the Structure tab is Towers, Floors & Units, and the Audit log is Audit Trail.
What you can do
Select all
Ticks every permission in the matrix.
- Who: anyone with the Create permission on Roles & Permissions.
Clear
Unticks every permission.
- Who: anyone with the Create permission on Roles & Permissions.
Create role
Saves the role as an active Custom role with the ticked permissions.
- Who: anyone with the Create permission on Roles & Permissions.
- Blocks: a name already used by another role shows "A role with this name already exists." under the name field. Length messages appear under the field as you type.
- What happens next: "Role "<name>" created." and you return to Roles & Permissions. Give the role to people with Edit role & access on Users, or pick it when inviting someone.
Cancel
Returns to Roles & Permissions without saving.
Things to know
- A role with no permissions is allowed. It grants nothing; a user holding only that role sees "No access" on almost every page.
- View is usually needed alongside the others. A page needs the View permission on its module to load; Create or Edit without View lets someone submit but not see the screen. Tick View whenever you tick another action on a module.
- Some permissions are held by everyone in the default roles. Every default role can read Notifications and mark them read, see the Dashboard, and read Screen Labels. A custom role does not get these unless you tick them.
- Audit Trail shows everyone's activity. Give the View permission on Audit Trail only to roles that audit; a record's own History button already works with the View permission on that record's module.
- The matrix reflects the live catalogue. While the catalogue is loading, or if it cannot be fetched, a built-in copy is shown that lacks the Screen Labels module and the Approve action on Payments, and lists Tasks under a group of its own ("My work"). Reload the page if a module you expect is missing.
- Permissions can be changed later on Edit role; every change is recorded in the role's history.
Related
Related
- Roles & PermissionsScreen
The list of your organization's roles: open one, create or clone a role, deactivate or reactivate it, and delete custom roles nobody holds.
- Edit roleScreen
Change a role's name, description, active flag and permissions, see who holds it, and open its History.
- UsersScreen
The people in your organization: invite new users, change their role, deactivate or reactivate them, reset a lost two-factor authentication, and resend or revoke pending invitations.
- Roles and permissionsConcept
What a permission is (a module plus an action), how roles bundle permissions, the twelve default roles and what each is meant for, the one-role-per-user rule, and when a change reaches a signed-in user.
- Create, tailor or retire a roleHow-to
Make a new role from scratch or as a copy of an existing one, tick the permissions it grants per module, tailor a default role to your organization, retire a role you no longer need, and give the role to users.