Roles are used to group user permissions. If a user has a role, they have all permissions included in that role.
Permissions can also be managed at the individual user level. Navigate to Manage > Organisation > Users and click the middle icon next to the relevant user. Here, you can toggle specific permissions, such as "delete transactions" or "delete exported transactions."
Via Manage / Organisation / Roles you can create, edit and delete roles. Fixed roles cannot be deleted.
A role has two types of permissions:
App permissions: actions that users are allowed to perform.
Administration permissions: access rights for administrations within your organisation.
The following roles are available by default:
Administrator: contains all user permissions except authorization management permissions. Has access to all administrations.
User: contains all user permissions except certain management permissions. Has access to all administrations.
Submitter: is a free user * and contains the user permissions for submitting documents. See Working with submitter users for more information. Has access to all administrations.
Authorizer: users with this role can be included in an authorization scheme to authorize bookings. Does not include access to administrations.
Authorization administrator: users with this role can assign and manage authorization schemes, process rejected bookings and modify authorized bookings. Does not include access to administrations.
when a user is assigned more permissions by the administrator, the user will automatically be considered a full user and monthly costs will be charged for this user. If in doubt, the column 'Paid user' can be checked to see whether additional/paid permissions have been assigned to a specific user. Loading this column may take longer than usual.
Handling Authorization Schemes
If you need to remove a user who has pending authorizations, you have two options:
Wait for the current authorizer to approve the booking. The booking will then proceed to the next step.
Log in as the current authorizer and reject the booking. The authorization administrator can then reassign the booking to a new authorization scheme that excludes the user being removed.
Best Practices to Prevent Unwanted Actions
To minimize the risk of accidental deletions of bookings or invoices, consider the following measures:
Restrict delete permissions: Disable permissions that allow users to delete bookings. Assign this capability only to Admin users, ensuring deletions occur only with administrator approval.
Centralize responsibilities: By limiting deletion rights to a single administrator, accountability for such actions is clear and traceable.