Users and roles

Access is controlled in three layers. Users are people. Roles are bundles of permissions. Groups are named collections you can put users in. A user sees a menu item only if a role they hold grants View on that feature.

All of this lives under Config.

Create a user

Users, at config/user. Placeholder image.

1. Go to Config, Users.
2. Select Add.
3. Fill in:
   • Name, the person’s full name.
   • Email, which is also what they sign in with, so it has to be unique.
   • Password and Confirm password. You are setting the first password for them. There is no invite email and no self service reset, so tell them the password directly and ask them to have it changed later.
   • Portal, which selects which part of the system the account belongs to.
   • Active. Clear this to switch an account off without deleting it, which is what you want when someone leaves.
4. Select Save.

To stop someone signing in, open their record and clear Active. Their history stays attached to the records they touched.

Build a role

Role form, at config/role/add. Placeholder image.

1. Go to Config, Roles.
2. Select Add.
3. Give the role a Name and a Description. The description is what the next administrator reads, so write what the role is for rather than repeating the name.
4. Work down the Application permissions tree. The tree follows the menu, with a parent for each area and children beneath it.
5. For each feature, tick the permissions the role should have:
   • View to open the screen and read records.
   • Create to add records.
   • Update to change existing records.
   • Delete to remove them.
6. Select Save.

View is the one that matters most, because a feature with no View is not in the menu at all for that user. If someone reports that a menu item has gone missing, this is almost always why.

Use groups

Groups, at config/group. Placeholder image.

Groups have a Name and a Description, and you assign users to them. They are useful for describing your organisation, for example a group per department or per site, and for keeping assignment tidy when you have more than a handful of people.

1. Go to Config, Groups.
2. Select Add, give the group a name and description, and save.
3. Assign users to the group from the group record.

A sensible starting set

There are no roles in the system until you create them, so decide what you need before you start clicking. Most factories end up with something close to:

• Administrator. Everything, including Config. Keep this to one or two people.
• Sales. View, Create and Update on Leads, Projects, Contacts and To dos. View on Inventory so they can see whether stock exists. Nothing in Config.
• Production. View and Update on Production and Inventory. View on Projects so they can see what a job is for. No access to Accounts.
• Accounts. View, Create and Update on Accounts, and View on Projects.

Build the narrow roles first and widen them when someone hits a wall. That is easier to reason about than starting from full access and cutting back.