How Users, Roles, and Permissions Fit Together
User Management is where you control who can sign in to the portal and what each person is allowed to see and do. Access is built from three pieces that work together:
- A User is a login account — a username, password, and profile for one person on your team.
- A Role is a named job function (e.g. "Sales Executive", "Finance") that carries a set of permissions. Every user is assigned exactly one role.
- Permissions are the individual features (Items, Reports, Operations, and so on) that a role is allowed to use.
So the chain is: you grant features to a role, then assign that role to users. A person's access is always whatever their role allows — you never grant features to an individual user directly.
Access is deny-by-default
If a role hasn't been granted a feature, users with that role simply don't see it — the menu entry, the page, and the search result are all hidden. A user whose role has no permissions at all can still sign in, but will land on a "no access" screen telling them to contact their administrator. This is the most common surprise for new admins: a freshly created role starts with zero access until you assign permissions to it.
The three screens
All three live under the Admin section of the sidebar:
- Users (
/management/users) — the list of login accounts. Add, edit, deactivate, or delete team members here. - Roles (
/management/roles) — the list of role definitions. Create and maintain the job functions you assign people to. - Permissions (
/management/permissions) — the permission matrix. Pick any role and check exactly which features it can use.
Recommended order for setting up a new team member
- Check whether an existing role already fits — if so, skip straight to step 3.
- Create a role and give it permissions (you can do both in one step on the role form, or later on the Permissions page).
- Add the user and assign them the role.