A role is a named set of permissions for a single product. Instead of granting permissions person by person, you define a role once (for example Sales Manager or Accountant) and assign it to members. Roles are managed per product, so an organization can have its own ERP roles and Billing roles.

The Roles & access page

Open Roles & access from the sidebar. Use the product tabs (ERP, Billing) at the top to switch between each product's roles. For every role you'll see whether it's a system role (built-in, read-only) or a custom role you created.

• Click a role's name to open a read-only overview of everything it grants.
• Use the row menu to Edit, Duplicate, or Delete a role.

Creating a role

1. On Roles & access, select the product tab you want the role to belong to.
2. Choose New role.
3. Enter a role name and a short description.
4. In the permission editor, tick the access this role should have (see the permission model below).
5. Choose Save role.

Duplicating a role

The quickest way to build a new role is to start from an existing one:

• From a role's row menu, choose Duplicate. The editor opens pre-filled with a copy that you can rename and adjust. A duplicate is always a new, editable custom role, even when you copy a system role.

Editing a role

• From a custom role's row menu, choose Edit, make your changes, and Save role.
• System roles are read-only. They're shown with a lock and can't be changed by regular admins. Only a platform super-admin (or a role granted the right to manage system roles) can edit them. Duplicate a system role if you need a tweakable version.

Deleting a role

• From a custom role's row menu, choose Delete and confirm.
• A role that's still assigned to a member or a pending invitation can't be deleted. Reassign those people to another role first.

The permission model

Permissions are organized by module/entity within a product. For each entity you grant specific actions:

• Full access: a convenient "select all" that grants every action for that entity.
• View / Create / Edit / Delete: the standard actions. These cascade sensibly: granting Create implies View, Edit implies View and Create, and Delete implies all of the above. Turning off View clears the rest.
• Additional permissions: some entities expose extra, more specific capabilities (shown under a "more" affordance) such as approving or editing approved documents.
• Reports: report access is granted per report, with View acting as the floor before other report columns can be added.

You only ever grant the permissions you intend. Enabling a product for a member never silently assigns full access; a role must be chosen explicitly.

Assigning roles to members

Roles are assigned when you invite or edit a member. On the invite form (or the member's access panel) switch on a product and pick the role for it. See Members & invitations.