How do I create custom user roles?

In addition to the predefined roles administrator, inventory manager, and employee, you can create your own roles. For each role you define, permission by permission, what users with this role can see and do. The rules apply immediately and are checked by the server on every request – in the web application as well as in the app.

Prerequisite: activation for your account

Role management is activated per account. If it is active for your account, you will find the menu item Roles under Settings. You only see it if your own role has the permission View roles – the predefined administrator role has it. Creating, editing and deleting roles are separate permissions in the roles area. If the menu item is missing, role management has not yet been activated for your account. In that case, please contact our support.

As long as role management is not activated, only the predefined roles are available in the user dialog.

Creating a role

Open Settings → Roles. The table lists all roles with their type (predefined or custom) and the number of assigned users; clicking a row opens the detail view of the role with all its permissions.
Click Create new role. You start with a role that has no permissions.
Alternatively, open the detail view of an existing role and click Duplicate. The new role takes over all permissions of the template, for example those of the inventory manager, and you only adjust the differences.
Enter a name. The name must be unique.
Define the permissions (see below).
Click Save.

Defining permissions and levels

The permissions are grouped by area, for example inventory, recipients, users, storages, stocktaking or data import / export; use the menu on the left to jump directly to an area. Each area has a table with the columns View, Create, Edit and Delete. The first row contains the basic permissions of the area itself, for example view, create, edit and delete inventory. Below that are rows for individual functions of the area with the same four columns – in the inventory area, for example, reservations, reminders, QR codes and NFC, documents and images, internal documents, commercial data, history, notes, report problems and manage problem reports. If a row does not have all four permissions, the column stays empty: QR codes and NFC only have assign and remove, internal documents and the history only have view, report problems only has create. Resolving a problem report belongs to the row Manage problem reports (column Edit). All other permissions of the area are listed at the bottom in the column Additional permissions, each with a short description. In the area Inspections the row is called Inspection templates (view, create, edit, delete), followed by Record inspection results. The area Procedures has the rows Procedure templates (view, create, edit, delete) and Procedure logs (view). Imports, exports, the bulk update and the import of inspection data are grouped in the area Data import / export. The area Administration contains the permission Receive email notifications. In the inventory area, the additional permissions also include Global search in the app (the app delivers all inventory items even if View inventory is not set to All) and Transfer to users by selection (transfer in the app via a receiver list instead of only by QR code). Depending on the permission, you define it differently:

Permissions with levels (e.g. view inventory, edit reservations): You select a level. None forbids the action. Own allows it only if the user has a personal relationship to the object, for example assigned inventory or their own reservations. Selected storages allows it for all objects in the storages you pick directly in the role – regardless of whether the user is registered there as a storage manager; own objects are included as with Own. Assigned storages allows it for all objects in storages in which the user is registered as a storage manager. All allows it for all objects of the account within the visible business units. What Own means exactly depends on the permission: for inventory the inventory assigned to me, for appointment reminders the appointments on inventory assigned to me, for reservations, notes and problem reports the entries on inventory assigned to me and the entries I created myself, for stocktakings the lists I am assigned to as a helper, for procedure logs the procedures I am involved in. The basic data of an inventory item stays visible even if it is assigned to someone else, for example after scanning a QR code. The detail view hides sections for which the permission is missing. Commercial data, history, notes and problem reports have these storage levels as well. The storage levels also apply to the target of an action: inventory can only be created in, or duplicated into, a storage for which Create inventory applies, and Switch storage only offers storages for which the permission to switch storage applies.
Selecting storages in the role: If you choose the level Selected storages for a permission that relates to storages, a field appears below it where you pick one or more storages. At least one storage is required – otherwise the role cannot be saved. When reservations are created (individually, via sets, quantity inventory, consumables, bulk reservation or the external API), the server checks that the affected inventory or the chosen stock is located in one of the selected storages.
Assign and return: Here you choose between None, Storage rules and All storages. With Storage rules, the usual rules of the storages apply: in storages the user is responsible for, bookings are unrestricted; in self-service storages only to themselves; and their own inventory may be returned or handed over. All storages lifts these rules. In the overviews, Assign and Take back appear with the level Storage rules only if you are responsible for a storage or have access to a self-service storage.
Yes/no permissions (e.g. import data, view internal documents, create storages): You tick or untick Allowed.
Recipient permissions (view, create, edit, delete and archive recipients, QR codes for recipients, recipient documents) and Reservations for other recipients: You choose between None, Selected recipient types and All recipient types. With Selected recipient types a field appears where you pick the types, for example only employees and vehicles. For the predefined roles, this selection matches the state previously chosen in the system settings. Recipient images are controlled by the permission Edit recipients. Without the permission View recipients there is neither the menu item Recipients nor the recipient overview nor any recipient page, not even the user's own. A user can still select themselves as recipient in booking dialogs.
Reservations: The reservations row defines for which inventory (by storage) reservations may be created and which reservations are visible, editable and deletable. For view, edit and delete, Own means the reservations created by the user; higher levels include the reservations of other users. Two further permissions define for whom reservations may be made: Reservations for oneself allows reservations in the user's own name, and Reservations for other recipients with its recipient types allows reservations on behalf of other recipients.
Execute procedures is not a separate permission: which procedures someone has to or may execute follows from the procedure template. You can execute a procedure on inventory you are involved with: inventory you are allowed to view, inventory in storages where you are allowed to hand out or take back, and inventory of an open handover in which you are the sender or the recipient. Anyone who may execute a procedure can also open it without the permission View procedure logs. The area Handover requests controls viewing and managing open handovers, returns and bulk bookings.

An example: You want a role "Storekeeper" that may do everything a stock manager may do, but must not delete inventory. Create the role using the stock manager as a template and set the permission Delete inventory to None.

A second example: A role "Main storage reservations" should only be allowed to create reservations for inventory from the main storage. In the Reservations row, set the permission Create to Selected storages and pick the main storage. Users with this role can then not reserve inventory from other storages.

Assigning a role to a user

You assign the role in the user dialog: Open Settings → Users, select the user, and click Edit. The Role field offers the predefined roles and your own roles. After saving, the new role applies immediately. In the role overview, the Assigned users column shows for each role how many users have it.

Adjusting predefined roles

You can also change the permissions of the predefined roles: open the detail view of the role and click Edit. You cannot rename or delete them. When adjusting, make sure that at least one role keeps the permissions View roles and Edit roles – otherwise nobody will be able to edit roles anymore.

Deleting a role

You delete your own roles in the detail view of the role via Delete. This is only possible if the role is no longer assigned to any user. Assign a different role to the affected users first.

How a role affects the interface

The web application follows the permissions of the role: menu items, buttons, table columns, and detail sections only appear if the role has the respective permission. For example, without View commercial data the section is hidden in the detail view; without View history the tab with the changes is missing; without Create inventory there is no button for creating items. For permissions with a storage level this applies per item: with the level Assigned storages you only see edit, state change, or switch storage for inventory from storages in which you are registered as a storage manager, with Selected storages only for inventory from the chosen storages. Management pages such as users, categories, storages and locations, or system settings are only shown in the menu if the role may at least create, edit, or delete something there. If you open such a page directly via the address bar or a saved link anyway, the application shows “Access denied”; the same applies to stocktaking, reports, inventory lists, data import, and creating inventory. The dashboard is shown to users whose role may see more than their own inventory; everyone else starts in the inventory overview. Changes to a role take effect the next time the application is loaded.

What happens when the activation ends?

Your own roles remain stored. As long as role management is not activated, users with a custom role work with the permissions of the predefined role that served as the template. If the role was created without a template, the permissions of the employee role apply. After a renewed activation, your own roles apply again.

You can find an overview of the predefined roles here: What roles are there?