Designing roles and permissions for a growing team

How permissions work in Modulix

You never give permissions to people directly. Permissions are grouped into roles, and people receive roles. A person with several roles gets every permission of all of them together. Each permission has a key, such as contacts.contact.read, and every module declares its own.

Every organization starts with four system roles:

• Owner has every permission, always. The person who creates the organization is its owner.
• Administrator manages users, roles, settings and modules, plus what each module gives administrators.
• Member is the default role for new users: the day-to-day work of each module.
• Read-only sees what members see and changes nothing.

You can change what Administrator, Member and Read-only include, but you cannot delete them. For a team of ten, they are often enough. As the team grows, custom roles make the difference.

Design roles around jobs

Create a role for each job, not for each person: Sales representative, Warehouse operator, Bookkeeper, Finance lead. When someone changes jobs, you change their roles, and nothing else.

When ticking permissions, All module permissions next to a module's name gives every permission of that module, including those added in later versions. Use it for roles that should always have the whole module, and tick individual permissions for the others.

Use record scopes

Some permissions can be limited to the records a person owns, to their team's records, or granted for all records. Teams come from the organization structure: the units a person belongs to define their team.

Typical uses:

• Sales representatives see and edit their own leads, deals and quotations; sales managers see their team's.
• Buyers see the suppliers they manage as buyer, or their team's.
• Employees see and submit their own expense claims; the finance team sees all of them.

Lists, search and the command palette all follow the same scopes, so a person never stumbles on records they should not see.

Separate the duties that matter

A few separations are worth setting up from the start, even in a small team:

• Drafting and posting. Give bookkeepers the right to draft journal entries and keep the right to post and reverse them for the person who reviews.
• Approving and paying. Approving a vendor bill commits the organization to paying it. Give that permission only to the people who should make that commitment.
• Discounts. Discount limits are set per role. A typed discount above the limit of the person's role is refused.
• Exports. Importing and exporting records are separate permissions. Members do not have them by default.

Integrations follow the same rules

API keys and OAuth clients carry scopes: a list of permission keys that cannot exceed the permissions of the person who creates them. A key for an accounting integration does not need to read leads. Give keys an expiry date where you can, and revoke them when an integration is retired. Requests made with a key are recorded in the audit log as the person who created it.

Check and review

• When a person lacks a permission, the request is refused and the refusal is written to the audit log, so you can see what people tried to do.
• When you enable a module, the built-in roles get its default permissions, but custom roles get nothing automatically. Review them after every new module.
• Once a quarter, open Roles and permissions with the people who lead each team and walk through each role. Remove what nobody uses.
• Give auditors and advisers the Read-only role rather than a copy of someone else's.

A starting point

• Sales representative: contacts, leads, opportunities and quotations, scoped to their own records; orders scoped to their own; no invoicing.
• Warehouse operator: view products and stock, receive purchase orders, record deliveries and transfers.
• Bookkeeper: view the books, draft journal entries, import bank statements and match lines; no posting.
• Finance lead: post and reverse entries, reconcile banks, approve bills, prepare and file tax returns, view the audit log.

Adjust from there. Changes take effect within seconds, without anyone signing in again.