Jump to a page, find a record or run a command
Manage your profile, company branding and subscription.
Exactly what each role can do. Read this before assigning one.
One role per department, plus the external customer portal
Sees every department, approves orders and commercial exceptions, owns billing and account closure.
Works inside the operationHandles inquiries, quotations, customer POs and sales orders, and owns the customer relationship.
Works inside the operationRaises supplier RFQs and purchase orders, and answers Sales on cost and lead time.
Works inside the operationIssues customer invoices, records receipts and supplier payments, and watches credit limits.
Works inside the operationRuns the order chain end to end — visibility across every stage, and owns the exception queue.
Works inside the operationReceives goods, keeps stock and serial records straight, and books deliveries out.
Works inside the operationManages people, attendance, company documents and system settings.
Works inside the operationExternal portal access to their own orders, invoices and deliveries.
External portal accessA tick means the role holds that grant outright
The same matrix, one role at a time
Every permission in this table has a matching row-level security policy in the database. The interface and the database read the same definition, which is what makes a permission check trustworthy rather than decorative — a screen someone cannot open is also a table the database will refuse to return. A custom role invented in the browser would have no policy behind it, so every list would come back empty with nothing to explain why.
Changing what a role can do is a deployment: edit config/permissions.ts and the migration that seeds it, together.