Permissions the server enforces, not the menu
Every user holds one role, and every role holds a level per area: View, Create, Edit, Full or Approve. Without the level, the screen turns read-only and the server refuses the change all the same.
- Role
- Sales clerk (custom)
- Sales orders
- View
- Tries to
- Change a saved order
- Needs
- Edit
Refused · Read-only on screen, and the server refuses the save
How access is set up
Start from five roles
Admin, Manager, Supervisor, Staff and Viewer come ready on every account.
Build your own
Create a role and pick a level for each area, from View up to Approve.
Assign it
Give each user one role. Their screens follow its levels at once.
Archive and restore
Archive a role you no longer use, and restore it if you need it back.
Details that matter
Levels build on each other
View, Create, Edit, Full, Approve: granting Edit includes Create and View.
The name is not the key
Access comes from the role’s grants only. A role called Admin with no grants opens nothing.
Approve is its own level
Releasing a credit hold or approving a till shift needs the Approve level on that area.
Questions buyers ask
Can we change the starter roles?
No. The five starter roles stay as shipped. Create your own role, set its levels and assign it instead.
Is hiding a button the only protection?
No. Every request is checked on the server against the user’s role, so a hidden button cannot be got round.
Can a user hold two roles?
No. Each user holds one role. Build a custom role that combines the levels they need.