Manage Roles and Permissions

Overview

Use this guide to create staff roles, update role status, and assign permission sets from the Roles and Permissions admin page. Role changes affect what menu areas and actions staff can use after their next authorization refresh.

Prerequisites

• Access to Admin > Settings.
• rbac.roles.read to open the role management page.
• Role permission management access to create roles, edit roles, or save permission assignments.
• A clear request from the tenant that lists the business function the role should support.

Step-by-step procedure

1. Open Admin > Settings > Roles and Permissions (/Admin/Roles).
2. In Create Role, enter the name in Role name.
3. Select Create Role.
4. In All Roles, select the role to load it into Role Details.
5. Update Role Name or Active if needed.
6. Select Save Role.
7. In Permissions, use Search permissions by code or description to find permission items.
8. Expand one group, or select Expand All to review every permission group.
9. Check permissions the role should have and clear permissions it should not have.
10. Select Save Permissions.
11. Ask a test staff user assigned to the role to confirm the expected menus and restricted actions.

Variations / branching flows

• New staff persona: create a new role, assign only the permissions needed for that persona, and validate with a test user.
• Permission reduction: clear permissions, select Save Permissions, and confirm the user can no longer access the removed areas.
• Temporary access: create a narrowly scoped role, set an operational reminder to remove or deactivate it, and audit assigned users after the work is complete.
• Finance access: include the required financial export permissions before asking the user to validate export creation, approval, locking, cancellation, and download.

Expected outcomes

• The role appears in All Roles.
• Role Details shows the expected role name and active state.
• Permissions reflects the saved checkboxes after reload.
• Staff assigned to the role can reach only the intended pages and actions.

Troubleshooting / edge cases

• If Create Role is disabled or a permission warning appears, confirm the admin has role permission management access.
• If the page shows Super Administrator cannot be edited., choose a different role; the protected role cannot be changed from this page.
• If the page shows Only roles with Persona = Staff can be edited., the selected role type is not editable in the staff role workflow.
• If clearing all permissions is intentional, save the empty permission set and validate that the role no longer grants menu access.
• If a user still has access after removal, check for additional roles assigned to the same user and ask the user to sign out and back in.

Related processes

• Configure Tenant Settings and Options
• Financial Exports - View and Download

Assumptions and gaps

• This guide covers staff role administration. Protected platform roles and non-staff personas may be visible but are intentionally not editable through the same workflow.