Roles & Permissions
The list of your organization's roles: open one, create or clone a role, deactivate or reactivate it, and delete custom roles nobody holds.
Roles & Permissions
A role is a bundle of permissions, one set per module, that you give to users. This page lists every role in your organization with how many permissions and users it has, and is where you create, copy, retire or remove roles.
Where to find it
Open the account menu in the top bar, choose Settings (see Settings), then the Roles & Permissions tab. The Cancel and Back to roles links in the role editor also return here.
You need the View permission on Roles & Permissions to see the list. Without it the page shows "No access" and "You do not have permission to view roles. Ask your administrator." In the default roles the Administrator, Finance Lead, Project Manager, Accountant, Sales Manager, Compliance Officer, Auditor and Rehab Officer can view roles; only the Administrator can create, change or delete them.
What you see
The header reads Roles & Permissions with the line "Roles bundle permissions per module. Default roles can be tailored or deactivated but not deleted; Administrator is locked." and, when you may create, the New role button.
Below it, the box Show inactive roles adds retired roles to the list.
The grid columns:
| Column | What it shows |
|---|---|
| Role | The role's name, as a link to Edit role, with badges: Locked (the Administrator), Default (a role that came with your organization) or Custom (one you created); Inactive when retired; Default for invites when the role is pre-ticked on the invite form. |
| Description | The role's description, or "—". |
| Permissions | How many permissions the role holds. |
| Users | How many people hold it. |
| Actions | The row's icons (below). |
Roles are listed by name, A to Z. With no roles the grid reads "No roles yet".
Your organization starts with twelve default roles: Administrator, Finance Lead, Project Manager, Accountant, Sales Manager, Compliance Officer, Auditor, Rehab Officer, Sales Executive, Site Engineer, Front Desk and Legal & Documentation. The Administrator holds every permission; the others are starting points you can tailor.
What you can do
New role
Opens New role, where you name the role and tick its permissions.
- Who: anyone with the Create permission on Roles & Permissions. Without it the button isn't shown.
Edit / View
The first icon on a row opens Edit role. It is a pencil (tooltip "Edit") when you can change the role, and an eye (tooltip "View") when you can only look: without the Edit permission on Roles & Permissions, or on the Administrator row, which nobody can change. Clicking the role name does the same.
- Who: anyone who can see this list.
Clone
The copy icon (tooltip "Clone") opens the "Clone role" dialog: "Name for the copy of <role>", filled with "<role> (copy)", and the note "The copy starts with the same permissions; you can edit it next." Create copy is greyed out until the name has at least 2 characters.
- Who: anyone with the Create permission on Roles & Permissions. Every role can be cloned, including the Administrator.
- Blocks: a name already used by another role (case doesn't matter): "A role with this name already exists."
- What happens next: "Role "<name>" created from a copy." The copy is a Custom role with the description "Copy of <role>" and the same permissions, and opens at once in Edit role so you can adjust it.
Deactivate
The ban icon (tooltip "Deactivate") on an active role opens "Deactivate role?": "Users holding <role> lose its permissions immediately. The role keeps its settings and can be reactivated later." with Cancel and Deactivate.
- Who: anyone with the Edit permission on Roles & Permissions. Not offered on the Administrator row.
- What happens next: "Role "<name>" deactivated." The role grants nothing and can no longer be given to anyone, but keeps its permissions and its members. It disappears from the list unless Show inactive roles is ticked. Holders keep the permissions until their session is next renewed, within about 15 minutes.
Reactivate
The refresh icon (tooltip "Reactivate") on an inactive role opens "Reactivate role?": "<role> will grant its permissions again and can be assigned to users." with Cancel and Reactivate.
- Who: anyone with the Edit permission on Roles & Permissions.
- What happens next: "Role "<name>" reactivated."
Delete
The trash icon (tooltip "Delete") on a Custom role opens "Delete role?": "<role> will be removed permanently. Roles still held by users cannot be deleted." with Cancel and Delete.
- Who: anyone with the Delete permission on Roles & Permissions. The icon isn't shown on Default or Locked roles.
- Blocks: a role someone still holds: "Users still hold this role. Reassign them or deactivate the role instead of deleting it." A default role, if attempted another way: "Default roles cannot be deleted. Deactivate the role instead."
- What happens next: "Role "<name>" deleted."
Statuses
| Badge | Meaning |
|---|---|
| Locked | The Administrator role. It always holds every permission, is kept in step as modules are added, and cannot be renamed, deactivated or deleted. |
| Default | A role that came with your organization. You can rename it, change its permissions and deactivate it, but not delete it. |
| Custom | A role you created or cloned. It can be changed, deactivated and, once nobody holds it, deleted. |
| Inactive | A retired role: it grants nothing and cannot be given to anyone, but keeps its settings and members. Deactivate and Reactivate switch it. |
| Default for invites | The role would be pre-ticked on the invite form. Nothing in the app sets this today, so the badge does not appear in practice. |
Things to know
- Permissions are per module and per action. The editor shows each module with View, Create, Edit and Delete, plus Approve, Issue, Post, "publish" or "send" where a module has them. A user holds one role, so what they may do is exactly what that role ticks (nothing, while the role is inactive).
- Deactivate a role before you delete it. Deleting is only for custom roles nobody holds; it keeps old records from pointing at a role that no longer exists. Deactivating keeps the role and its members for later.
- A deactivated role drops out of the Role list. Its holders keep it until you move them: on Users, Edit role & access offers only active roles, so pick another role for each holder (the grid's Deactivate icon is unaffected). Move the holders before retiring a role if you want them to keep working.
- "Immediately" means at the next session renewal. The deactivate dialog says holders lose the permissions immediately; in practice a signed-in user keeps them until their session is renewed, within about 15 minutes. Deactivating the user instead (on Users) is immediate.
- Renaming a default role is allowed, but a reseed can bring the old name back. Only the Administrator's name is protected. When whoever maintains the server reseeds the default lookups and roles, a default role that no longer exists under its original name is created again.
- Tailoring a default role may not survive a reseed. When whoever maintains the server reseeds the default lookups and roles, any default permission you removed from a Default role is granted again. Clone the role and tailor the copy if you want the change to stick.
- Who holds Audit Trail. Only the Administrator, Compliance Officer and Auditor can see the organization-wide Audit log, because it shows everyone's sign-ins and changes. Every default role can read notifications, the dashboard and screen labels.
- Changes to roles are recorded. Each role's Edit role page has a History button showing who added or removed which permission and when.
Related
Related
- SettingsScreen
The Settings area of the app: a row of tabs for your organization's profile and policies, products, users, roles, lookups, workflows, documents, AI connectors and the audit log.
- New roleScreen
Name a new role, describe it and tick what it may do in each module, then create it so it can be given to users.
- Edit roleScreen
Change a role's name, description, active flag and permissions, see who holds it, and open its History.
- UsersScreen
The people in your organization: invite new users, change their role, deactivate or reactivate them, reset a lost two-factor authentication, and resend or revoke pending invitations.
- Audit logScreen
The organization-wide change log: every create, change and delete, every sign-in (including refused ones), sign-out and downloaded file, with who did it, when, from where and what changed.
- History panelScreen
See who changed a record, what they changed and when, including the record's lines, newest first, and jump to the full audit log.
- Roles and permissionsConcept
What a permission is (a module plus an action), how roles bundle permissions, the twelve default roles and what each is meant for, the one-role-per-user rule, and when a change reaches a signed-in user.
- Create, tailor or retire a roleHow-to
Make a new role from scratch or as a copy of an existing one, tick the permissions it grants per module, tailor a default role to your organization, retire a role you no longer need, and give the role to users.
- Role cannot be deleted, renamed or assigned; a user cannot deactivate themselvesTroubleshooting
Default roles and roles still held by users are never deleted (deactivate them instead), the Administrator role is locked, an inactive role cannot be given to anyone, you cannot switch off your own account, and only active users of your organization can own opportunities, tasks and workflow actions.