Read How permissions work first if the words ability and role are not yet distinct in your mind. This article is the how-to.
Building a role
Admin → Roles → New role.
- Name the role after the job, not the person — Operations Coordinator, not Sara's access.
- Choose its abilities. They are laid out as one card per subject (
Invoice,Shipment,Lead,Journal, …), with the individual actions listed inside each card.- Tick the checkbox in the card header to grant manage — everything on that subject, now and in future.
- Tick individual actions to grant only those.
- Save.
The two are not equivalent, and the difference bites later:
manage is a standing grant. When a new action is added to that subject in a future release, everyone holding manage receives it automatically. A list of specific actions does not grow — you have to come back and edit the role.
Use manage for roles you trust broadly, such as your own operations managers. List actions explicitly for anything sensitive or external — an outside accountant, an agent with limited access, a temp.
Unticking one action from a card that had manage does not silently leave a hole: the form expands manage into the full list of individual actions minus the one you removed, so what you see ticked is what is granted.
Read-only roles
There is no "read-only" switch. Build one by granting read and nothing else on the subjects concerned.
Remember that some work needs more than reading to be useful. Someone who can read a shipment but not transit it can watch the job but cannot move it along; someone who can read a quotation but not calculate cannot reprice it. Walk through the person's actual day before deciding a read-only role is enough.
Roles have a privilege level, and it is enforced
Every role carries a level, and lower numbers are more senior. This is not a label for sorting — it is checked whenever anyone assigns or revokes a role:
You can only assign or revoke roles that are equal to or less senior than your own. Attempting otherwise is refused with "You can only assign roles with lower privilege levels than your own".
So a manager cannot grant someone the administrator role, and cannot strip an administrator of theirs. Authority flows downward only, which is what stops permission escalation by a user who happens to hold the "assign roles" ability.
One behaviour to be aware of when someone holds several roles: the check uses the numerically highest — that is, the least senior — of their levels. Holding an extra junior role therefore narrows what that person can assign, rather than widening it. If an administrator unexpectedly cannot assign a role, look at whether they are also carrying a low-privilege role they no longer need.
Some roles cannot be edited
A role created from a preset is locked — "This role is managed by a preset and cannot be modified directly". It cannot be edited or deleted from here.
These are the ready-made roles your company was set up with. They are maintained centrally so that the same job means the same thing everywhere, and changes to them arrive from outside your company.
If one does not fit, build your own role alongside it. A role you create is yours to change and is never overwritten. Do not try to work around the lock by assigning extra abilities elsewhere — create the role you actually need and assign that instead.
Editing a role
Editing takes effect for everyone holding it, from their next sign-in. Before removing abilities from a widely-held role, check who holds it — the change is not staged, previewed, or reversible in one click.
Assigning roles to people
Roles are attached to users, not the other way round. Go to Admin → Users, open the person, and assign. Roles stack: a user with two roles can do everything either allows, and there is no way for one role to take away what another grants. See Adding and managing users.
A workable starting set
If you are setting up from scratch, four roles cover most forwarding businesses:
- Administrator — manage on users and roles; whatever operational access the person also needs.
- Operations — manage on shipments, quotations, workflows and transitions; read on catalog and CRM.
- Finance — manage on invoices, vendor invoices, journals, bank and treasury; read on shipments.
- Sales — manage on leads, companies, contacts and quotations; read on shipments.
Adjust from there rather than starting with manage-everything and cutting back. A missing permission announces itself the first time someone hits it; an excess one stays quiet for years.
Last updated 15 September 2026