Roles & Permissions

A role is a named set of permissions. Permissions are granted to roles, never to individuals, which is what keeps access reviewable.

Overview

Permissions are granted at three levels: the module (can the user see Sales at all), the document (can they see Sales Invoices), and the action (can they create, edit, cancel or only view). A user needs permission at every level for an action to succeed, which is why “I can see the menu but the button is greyed out” is usually a missing action permission.

Warning

Settings on this screen apply across the Business Plus Plus installation. Make one change at a time and verify it before making the next — a bad configuration is much harder to diagnose when it is bundled with four others.

Prerequisites

Before you begin

• You are signed in with an administrator role
• You have told affected users that a change is coming

Opening the screen

Navigate to

1. Administration
2. Security
3. Roles

Click to enlarge

The Roles & Permissions screen in Business Plus Plus.

Procedure

Open the configuration screen

Use the navigation path above. Administrator rights are required.

Make the change

Edit the settings you need. Changes are validated as you type and the screen tells you what else they affect.

Save and verify

Click Save, then sign in as a normal user (or ask a colleague to) and confirm the change behaves as intended before telling the team.

Expected result

The setting is saved and an entry is written to the audit log recording who changed what, and when.

Field reference

Roles & Permissions fields

Field	Type	Required	Default	Description
Name	Text	Yes	—	Display name for this roles & Permissions entry.
Description	Text area	No	—	What this configuration is for. Shown to other administrators.
Applies To	Dropdown	Yes	All branches	Scope of the setting.
Status	Dropdown	No	Active	Inactive entries are retained for audit but no longer applied.

Roles & Permissions fields

Permission levels

How a permission check resolves

Step	Action	Who	Result
1	Module permission	Role	Decides whether the menu appears at all
2	Document permission	Role	Decides whether the screen opens
3	Action permission	Role	Decides which buttons are enabled
4	Branch access	User	Decides which records are visible
5	Approval limit	User	Decides what the user may approve

How a permission check resolves

A worked example: three roles against the Sales Invoice

Aspect	Sales Executive	Accounts Clerk	Branch Manager
See the Sales menu	Yes	Yes	Yes
Open Sales Invoice	Yes	Yes	Yes
Create	Yes	No	Yes
Edit a draft	Own only	No	Any
Confirm	No	Yes	Yes
Cancel a confirmed invoice	No	No	Yes
Override the price list	No	No	Yes

Important notes

Important

Grant the minimum that lets someone do their job. It is far easier to add a permission when someone asks than to work out, six months later, who had access to what and why.

Warning

Changing a role changes it for every user who holds it, immediately. Before editing a widely-held role, check the user count shown next to it.

Common problems

The Save button is disabled

A required field is empty or invalid. Fields in error are outlined in red with the reason underneath — scroll up, the first error is usually in the header.

You do not have permission to perform this action

Your role is missing the relevant permission for this screen. Ask an administrator to check it against Roles & Permissions.

Frequently asked questions

QWho can perform this task?

Any user whose role grants access to this screen. Roles and Permissions lists exactly which permission controls it.

QIs the change audited?

Yes. Every create, edit and cancel is recorded with the user, timestamp and the before-and-after values.

Related documentation

• Administration overview
• UsersCreate user accounts, reset passwords and deactivate leavers.
• Company SettingsConfigure company details, numbering series, tax and printing.