Access Control
Decide who in your company can see and do what β for example, letting a bookkeeper enter vouchers but not delete anything, or letting a manager only view reports. You do it by giving each person a role, and giving each role a tick-list of permissions.
Think of your app as a building with rooms (accounts, invoicing, banking, VATβ¦). A role is a keyring, and each checkbox is a key β some keys just let you look inside a room (Read), others let you rearrange the furniture (Write), throw things out (Delete), or carry paperwork in and out (Import/Export). You hand each employee a keyring; the Tenant Admin holds the master key to every room.
01What you see on the screen
This admin-only tab has a π Roles card (the list of roles + a form to add one) and a π‘ Role Access Control card (the permission matrix β a small grid per role). There are also two separate safety cards (Segregation of Duties and Maker-Checker) that flag or double-check risky combinations.
02How permissions work
Permission is decided where a module (a part of the app) meets an action. Tick a box to grant that role that one ability in that one module.
| The 10 modules | The 5 actions |
|---|---|
| accounts, vouchers, parties, items, invoicing, assets, banking, vat, reports, users | R Read (view) Β· W Write (create/edit) Β· D Delete Β· I Import Β· E Export |
03Built-in vs custom roles
Three built-in roles always exist and can't be deleted or renamed (but their ticks can be edited): Accountant (full bookkeeping), Manager (review/approve + reporting), and User (data entry). Tenant Admin always has full access and can't be limited here. You can also create your own custom roles (e.g. "External Auditor"), which show a green "custom" badge.
04Create a custom role and set its access
- Open Access Control (Tenant Admin only).
- In π Roles, type a Role key (lowercase, e.g.
auditor) and a Display name (e.g. "External Auditor"). - Optionally pick a role in Copy access from to start from its permissions.
- Click οΌ Add Role β it appears with a "custom" badge.
- In π‘ Role Access Control, find your role's grid and tick the action letters (R W D I E) for each module.
- Click πΎ Save Access List. People holding the role get the new permissions on their next login.