Users & Permissions Manual
Access management happens in two steps: you define Profiles (sets of permissions), then you create the Users who inherit them. Each profile receives up to 7 permissions per screen: Read, Create, Edit, Delete, Activation, Reset, Synchronization.
Overview
A user is a login account; a profile is a set of permissions. You first create the profiles (Salesperson, Warehouse Clerk, Accountant, Admin…), then assign a profile to each user. The user then inherits all the permissions of their profile — there is no individual permission to set account by account.
Goal
- Open user accounts
- Define permission profiles per screen
- Secure access with least privilege
- Pool permissions through standard profiles
Target audience
- Administrator — creates profiles & users
- Manager — manages their team
- User — inherits the profile's permissions
Profile before user
Create the desired profile before entering the user, so you can select it directly. Overview: Administration module.
Access and navigation
Left-hand side menu: Settings → Users (the accounts) or Profiles (the permissions).
Visibility conditioned
These entries require the Read permission on the Users / Profiles screens. Without it, they do not appear.
Create a user
Click New, fill in the identity, choose the Profile and set the password (to be confirmed).
The password must be at least 6 characters and confirmed. Login rules (anti-brute-force, reset via link) are described in Security.
Record fields
| Field | Description |
|---|---|
| First name · Last name * | Identity of the user, shown in the header and the logs. |
| Code | Internal reference of the account (optional). |
| Email * | Login identifier and recipient of the reset link. |
| Profile * | Privilege profile from which the user inherits all permissions. |
| Phone | Contact detail (optional). |
| Password * | Min. 6 characters, to be confirmed. Resettable via secure link. |
One account = one person. Never share an account: the logs and the anti-brute-force lockout would become unusable.
Privilege profiles
For each screen of the application, the profile receives up to 7 permissions. Screens are grouped by module (Sales, Purchasing, Settings…); check what is needed, row by row.
| Module / Screen | Reading | Creation | Edit | Deletion | Activation | Reset |
|---|---|---|---|---|---|---|
| SALES | ||||||
| 01 - Quotes & Proforma invoices | — | |||||
| 02 - Delivery notes | — | |||||
| 03 - Invoices | — | |||||
| SETTINGS | ||||||
| 01 - Users | ||||||
The Reset permission on the Users screen allows resetting another account's password.
The 7 permissions per screen
| Permission | Effect on the screen |
|---|---|
| Read | View the screen and its lists. Essential: without Read, the menu entry is hidden. |
| Create | Add new records (the New button). |
| Edit | Edit an existing record. |
| Delete | Delete a record (the Trash button). |
| Activation | Validate / activate (depending on the screen: validate a document, activate an account…). |
| Reset | Reset (e.g. a user's password, a counter…). |
| Synchronization | Sync with an external system (visible if the option is enabled). |
Read = the gateway — Create and the other permissions have no effect on a screen until its Read permission is granted.
Check in bulk
To save time, the header checkboxes of each column check or uncheck a permission for all screens at once.
Column header
Checking the "Read" header grants Read on all the listed screens. Ideal for an Admin profile.
Row-by-row adjustment
After a global check, fine-tune screen by screen to remove unnecessary permissions.
Create template profiles (Salesperson, Warehouse Clerk, Accountant, Admin) and duplicate them; then adjust on a case-by-case basis.
Assignment workflow
flowchart LR A([Create a profile]):::s --> B[Check permissions
per screen]:::p B --> C([Create the user]):::ok C --> D[Assign the profile]:::p D --> E([Login
inherited permissions]):::ok D -.->|employee departure| F([Deactivate the account]):::st classDef p fill:#f3f1ff,stroke:#7366fe,color:#1f1c3d; classDef s fill:#F1F5F9,stroke:#334155,color:#1E293B; classDef st fill:#FEF3C7,stroke:#F59E0B,color:#92400E; classDef ok fill:#D1FAE5,stroke:#10B981,color:#065F46;
Business rules
Profile mandatory — every user must be attached to a profile; their permissions are entirely determined by it.
Read = the gateway — without Read on a screen, the menu entry disappears and the other permissions have no effect.
Full inheritance — editing a profile instantly updates the permissions of every user who holds it.
Data isolation — a user only sees their company's data (multi-tenant isolation).
Best practices
Principle of least privilege
Grant each profile only the permissions strictly necessary. Reserve Delete for administrators.
Deactivate rather than delete
For a departing employee, remove their permissions or deactivate their account rather than deleting it — you preserve traceability.
One account = one person
Avoid shared accounts: it is the condition for reliable traceability and effective anti-brute-force protection.
FAQ & Tips
A menu entry does not appear for a user?
Their profile does not have the Read permission on this screen, or the module depends on the subscription.
How do I reset a colleague's password?
With the Reset permission on the Users screen, or let them use the reset link.
I want to give the same permissions to 10 people
Create a single profile and assign it to the 10 users: any change to the profile updates all of them.
Tip — name your profiles clearly
Explicit labels ("Sales Manager", "Warehouse Clerk") make assignment and permission audits easier.
