Roles and access
Who can do what, how offices work, and what Preview as is.
Every person has a home office and one or more roles. Lists show the union of the home office and any grants. There is no “current office” to switch.
Permissions have a scope: all offices, this office, the team, or only what is assigned to the person. Where two roles grant the same permission, the widest scope wins. A written deny on a person beats every grant.
Nothing is anonymous. Access changes are written to an audit log.
The seeded roles
| Role | What they can do | What they cannot do |
|---|---|---|
| Sales person | Their own cases: view and edit the inbox, draft and send quotations, see their sales orders | Approve a sales order, hand off to the ERP, manage people or mailboxes |
| Office head | The office: assign work, approve and send inbox items, quotations, sales orders, ERP handoff, reports | Administer users and roles |
| Stakeholder | Read the catalogue, inbox, quotations, orders, ERP queue and reports across every office | Change anything |
| Administrator | Every office and every action, including users, roles and mailboxes | — |
| Developer | The same reach as Administrator, plus diagnostics later | — (kept separate so maintenance is visible in the audit log) |
An office head’s approve and ERP keys are what stop a sales person signing off their own work.
Custom roles can be cloned from these. Lineage is recorded.
Offices and grants
- A record belongs to one office.
- A person sees every office they hold — home plus grants.
- A grant carries a written reason. It is auditable. It is not a mode.
- Preview as lets an administrator look at the product as another person. It is a signed-in preview; it is not that person acting.
What this means in practice
- The rail hides what you cannot do. An entry you lack permission for is not shown, rather than shown and then refused.
- A quotation carrying a deviation is still a send. Approval of the order
is the office head’s; the quotation send is gated on
quote:sendat the person’s scope. - Destructive actions are permissioned. Removing a mailbox, deleting a user, deleting a role — none of these are available to a sales person.
- Password accounts cannot hold administration. Privileged roles stay on Entra identities.
See First sign-in for the doors, and Automatic behaviour for what runs without a click.