Roles & permissions
A role decides which modules a person can open and what they can do there: view, create, edit, approve, export and administer, each within a record scope (assigned records, team, branch, organisation or partner). Field-level rules hide sensitive values inside a module.
Roles
One person can hold several roles. Permissions add up and each role keeps its own record scope; Roles are assigned on the responsibility profile. The owner role cannot be edited or removed, and at least one owner must stay active.
Permission is not the menu. This matrix says what a role may do. Which modules appear on a role’s workspace by default is a separate setting; the “Default workspace” column shows it.
Least access check. Sales can export contacts but nobody in Sales has used export in 90 days. Consider removing it.
| Module | View | Create | Edit | Approve | Export | Administer | Record scope | Default workspace | Limits for this role |
|---|
Ticking Approve only has effect where the central approval policy names this role. The steps it gives this role are listed below, rendered from that policy.
| Field or record | Module | Who sees it | Everyone else |
|---|---|---|---|
| Instructor day rates and payout amounts inst-payouts, instructor agreement | Instructors | Owner, Operations, Finance. Each instructor sees their own. | Sales, Marketing and Learner support see the directory and availability, never amounts. |
| Batch cost, margin and break-even calculation venue, licences, ASME royalty, instructor fee | Scheduling | Owner, Operations, Finance | Sales sees seats, fill and a “below minimum” flag so they know which batches to push. |
| Deal value, discount and price list including corporate contract prices | CRM & sales | Owner, Sales, Operations, Finance (view) | Marketing sees stage, source and campaign. Corporate learners never see what their company paid. |
| Lead score and the reasons behind it | AI layer | Owner, Sales, Marketing, Operations | Hidden. |
| National ID or passport copy collected for certificates and venue access | Learners | Operations, Learner support | Masked. Viewing the file is written to the audit log. |
| Assessment scores and exam attempts | Catalog & LMS | Operations, Learner support, the batch instructor, the learner | Corporate client admin sees pass or fail and completion, not individual answers. |
| Attendance exceptions and reasons | Learners | Operations, Learner support, the batch instructor | Corporate client admin sees the attendance percentage only. |
| Payment card details | Commerce | Nobody. Cards stay with the payment gateway. | Finance sees the last four digits and the gateway reference. |
| Expenses and supplier invoices | Finance | Owner, Finance | Operations sees totals per batch. Hidden from Sales, Marketing and Learner support. |
| Internal notes on a ticket | Support | All staff roles | Never shown to the learner or the corporate client admin. |
| Revoking a certificate | Certificates | Owner, Operations | Learner support can request a re-issue, which goes to approvals. |
| API keys and webhook secrets | Integration hub | Owner. Shown once when created. | Operations sees key names and last use. |
| Pay and payroll amounts payslips, payroll run lines and totals | People & HR | Owner, HR, Finance. Each employee sees their own payslips. | Withheld from details, search, exports, notifications and AI answers. |
| Customer reliability rating grade, score and the reasons behind it | CRM & sales | Owner, Sales, Operations, Finance | Marketing and Learner support see loyalty status, which is a separate field. |
| Partner agreement terms and settlement amounts | Partners | Owner, Operations, Finance. A partner user sees its own agreement only. | Sales sees the directory and approved services, not the terms. |
| Exports that contain personal data | All modules | Roles with Export on that module | Every export is logged with the user, filter and row count. |
| User | Other roles and scope | Status | Last active |
|---|