Users, roles and permissions
Who can sign in where
| Who | Signs in to | Account comes from |
|---|---|---|
| You and your staff | The admin console at /admin/ |
Staff accounts, created by an administrator |
| Your staff, for their own HR | The employee portal at /portal |
The portal password on their HR profile |
| Your customers | The client portal at /clientportal |
A portal account they create or you invite |
The first account, created by the installer, is a super admin with access to everything, so you cannot lock yourself out.
Staff accounts
An administrator creates a staff account with a name, an email and a role. The app generates a password and emails it to the new user, so set up email first. Administrators can also reset a user's two-factor sign-in.
Settings & Secrets › Users & Roles sets defaults for new staff: invite link expiry, the session timeout and its warning, strong passwords and default permissions.
Roles and permissions
Roles live in Human Resources › Employees › Roles:
- Hierarchy lists roles in rank order, each with a head and a member count.
- Permission matrix sets, for each role and each module, one of four levels:
| Level | Grants |
|---|---|
| None | The module is hidden |
| View | Read only |
| Edit | Create and change records |
| Full | Everything, including deleting and the module's settings |
The console hides what a role cannot open, and the server checks the permission on every request, not just the menu. A request for an action that has no permission mapping is refused for everyone but full administrators.
Give each person their own account and the lowest role that lets them do their job. Be sparing with full access to Finance, Settings and HR.
When someone leaves
Archive the employee in HR. Archiving removes their role, so they lose access, and remembers it so Restore can give it back. Their past sales, repairs and notes stay attributed to them, and the audit log keeps their history.
Customer accounts
Portal Accounts (under People) lists every client-portal account. See Client portal.