Skip to main content

Roles

The Roles configuration page within the System Administration module is the architectural core of the ERP's security apparatus. It dictates functional access control, determining exactly which modules, pages, and actions a user is authorized to interact with.

By employing a Role-Based Access Control (RBAC) paradigm, administrators can assign a single role (e.g., ARManager) to multiple users, streamlining security governance rather than managing permissions on a per-user basis.

Accessing Role Management​

Navigate to System administration > Roles.

The primary interface displays a list of all defined roles within the system (e.g., Administrator, HRManager, SalesRepresentative). The grid provides an audit trail indicating when each role was created and last modified.

Defining a Role​

Selecting a role or clicking + New opens the detailed configuration interface.

Role Information​

  • Name: A definitive, descriptive identifier for the security persona (e.g., SalesManager). This is the value that will be mapped to users during provisioning.

Assigned Privileges​

This section links the role to advanced, fine-grained data filtering mechanisms.

  • Privileges: In this ERP architecture, "Privileges" are a highly specialized concept strictly related to row-level data filtering and security policies.
  • Example: Assigning a SalesRepresentative privilege enforces a security policy that dynamically restricts the user's data view, ensuring they can only query and interact with sales invoices where they are explicitly listed as the assigned salesperson.
Advanced Security

Privileges do not grant access to UI pages; they restrict the dataset returned on those pages. For a deeper understanding of row-level data enforcement, refer to the documentation on Security Policies.

Configuring Functional Permissions​

To define exactly what a role is allowed to do (which menus they can see, which buttons they can click), select a role and click the Edit permissions button on the action toolbar.

This opens the comprehensive Permissions Matrix, providing granular, feature-level control across the entire application ecosystem.

The Permissions Matrix​

The interface is divided into a module selection pane and a granular capability grid.

  1. Modules Pane (Left): Displays all installed ERP modules (e.g., Accounts receivable, General ledger). It provides a quick summary of the permissions currently allocated versus the total available (e.g., 28/56 permissions).
  2. Capability Grid (Right): Selecting a module expands its respective functional areas into an accordion layout.
    • Expanding a functional area (e.g., commission-sales-group) reveals atomic capabilities.
    • Atomic Capabilities: You can explicitly grant or deny specific operational verbs such as create, read, update, or bespoke actions like manage reps or settle.

Best Practices for Permissions​

  • Principle of Least Privilege: Only grant the specific atomic capabilities strictly necessary for the persona to execute their business function. Avoid blindly granting all permissions within a module.
  • Separation of Duties: Ensure that critical, conflicting operational verbs (e.g., the ability to create a payment journal and the ability to approve a payment journal) are segregated into distinct roles to prevent fraud and maintain internal compliance standards.