---
title: Roles and access
description: Who can do what, how offices work, and what Preview as is.
sidebar:
  label: Roles
  order: 2
---

Every person has a home office and one or more roles. Lists show the union of
the home office and any grants. There is no "current office" to switch.

Permissions have a **scope**: all offices, this office, the team, or only what
is assigned to the person. Where two roles grant the same permission, the
widest scope wins. A written **deny** on a person beats every grant.

Nothing is anonymous. Access changes are written to an audit log.

## The seeded roles

| Role | What they can do | What they cannot do |
| --- | --- | --- |
| **Sales person** | Their own cases: view and edit the inbox, draft and send quotations, see their sales orders | Approve a sales order, hand off to the ERP, manage people or mailboxes |
| **Office head** | The office: assign work, approve and send inbox items, quotations, sales orders, ERP handoff, reports | Administer users and roles |
| **Stakeholder** | Read the catalogue, inbox, quotations, orders, ERP queue and reports across every office | Change anything |
| **Administrator** | Every office and every action, including users, roles and mailboxes | — |
| **Developer** | The same reach as Administrator, plus diagnostics later | — (kept separate so maintenance is visible in the audit log) |

An office head's approve and ERP keys are what stop a sales person signing off
their own work.

Custom roles can be cloned from these. Lineage is recorded.

## Offices and grants

- A record belongs to one office.
- A person sees every office they hold — home plus grants.
- A grant carries a written reason. It is auditable. It is not a mode.
- Preview as lets an administrator look at the product as another person. It is
  a signed-in preview; it is not that person acting.

## What this means in practice

- **The rail hides what you cannot do.** An entry you lack permission for is
  not shown, rather than shown and then refused.
- **A quotation carrying a deviation is still a send.** Approval of the *order*
  is the office head's; the quotation send is gated on `quote:send` at the
  person's scope.
- **Destructive actions are permissioned.** Removing a mailbox, deleting a
  user, deleting a role — none of these are available to a sales person.
- **Password accounts cannot hold administration.** Privileged roles stay on
  Entra identities.

See [First sign-in](/getting-started/first-sign-in) for the doors, and
[Automatic behaviour](/business/automatic-behavior) for what runs without
a click.