Managing Users & Access

Start here

1Before you start

A brand-new install already ships with six roles — you don’t need to build anything before you can add your first teammate. Each role is a label, a description, a Read only or Read & write capability, and a list of which modules it can see.

These six are protected — you can’t edit or delete them, only build your own alongside them (see Building a custom role). Notice Users & Roles and Settings aren’t on any of these lists — only Company Admin (or a Super Admin) can reach them by default.

People

2Add a user

On the People tab, click Add a User and enter their email, name, and role. What happens next depends on whether that email already has a login:

• Existing account — it’s simply attached to this company with the role you picked. No new credentials, no email sent.
• New account, invited by email — leave the password field on its default; a password-set link is emailed to them.
• New account, credentials handed over directly — switch to “Set username & password now,” pick or generate a password. Nothing is emailed; the username and password are shown to you once, in the response — copy them down immediately, they’re never stored in a recoverable form and can’t be shown again.

You can also assign the same person to more than one company at once, each with its own role, in a single submission — or leave company/role entirely blank to create a bare login with no company yet (useful when handing someone credentials so they can create their own company on first sign-in).

3Manage access afterward

From the Company Users table:

• Change role — pick a new role inline; takes effect immediately.
• Remove — deletes their membership in this company only. Their login itself isn’t touched, and they keep access to any other company they belong to. Blocked if they’re the last Company Admin on this company — assign another admin first.
• Set Password — issue a brand-new password for them (typed or generated), shown once the same way Add a User‘s manual-credentials path works.

Common tasks

Building a custom role

Need something the six built-ins don’t cover? On the Roles tab, click Create Role Profile.

1. Label & description

   Whatever you’ll recognize it by later.

2. Access level

   Write (can view and make changes) or Read only (can view, never save/create/delete) — there’s no finer-grained choice than this one switch; see what this module doesn’t do.

3. Modules

   Check every module this role should be able to open. Leaving one unchecked hides it from the sidebar and blocks its API for anyone holding this role.

Save, then assign it to people the same way as any built-in role. Custom roles can be edited or deleted freely — only the six system roles are protected.

Granting Super Admin access

Super Admin isn’t a role you assign — it’s a separate, install-wide access level that bypasses every company membership and role check entirely, granted directly to an existing account.

From the Company Users table, use Promote to Super Admin on the person’s row. Only someone who’s already a Super Admin can grant it to someone else — a Company Admin, no matter how permissive their role, can never mint a new one. There’s no “demote” action here — removing Super Admin access has to happen outside this module.

Linking access through an HR record

You don’t have to manage everyone through this module directly — an employee’s record in HR has its own Linked User and Role Profile fields, and saving that employee keeps this company’s membership row for that person in sync automatically, using whichever role you set there.

An employee record can also carry its own Module Access list, which — if set — overrides the role’s own module list entirely for that one person, without changing the role itself or affecting anyone else holding it. Use this when one specific employee needs narrower (or different) access than their assigned role would otherwise give them.

Viewing as another user

Click View as on any row in Company Users to see the app exactly as that person would, for troubleshooting a permissions issue or an “I can’t find X” report. A banner appears everywhere while active — click Return to your account in it to switch back. Only a Super Admin can start this, but the “Return to your account” path stays reachable even while viewing as someone whose own role couldn’t otherwise reach this module.

Deleting your own account

Anyone can permanently delete their own login from Settings → My Account — re-entering their current password confirms it. It’s blocked in two cases: for a Super Admin account (contact another Super Admin instead), and if the person is the last Company Admin on any company they belong to (assign another admin there first). This never deletes the company itself, only that one person’s login.

Reference

Default roles & access

See the table in Before you start for the exact module list each of the six built-in roles ships with.

What this module doesn’t do