Roles & Permissions

Configure role-based access control (RBAC) in Alpha.

Understanding Roles

Roles are named collections of permissions that define what actions users can perform in the system. Instead of assigning individual permissions to each user, you assign roles that bundle related permissions together.

How Roles Work

1. Create a role with the permissions needed for a job function
2. Assign the role to users who perform that function
3. Users inherit all permissions from their assigned roles
4. Update the role to change permissions for all users with that role

System Roles vs Tenant Roles

Alpha has two types of roles:

System roles are assigned by platform administrators. Tenant roles are managed within your organization.

Default Roles

Alpha automatically creates a few tenant roles in specific situations:

All other roles are created and managed by your organization.

Managing Roles

Creating Roles

1. Go to Administration > Roles
2. Click Add Role
3. Name the role
4. Select permissions
5. Save

Editing Roles

1. Open role
2. Add/remove permissions
3. Save
4. Affects all users with role

Deleting Roles

1. Reassign users to other roles
2. Delete role
3. Cannot delete if users assigned

Permission Categories

Alpha organizes permissions by functional module. When creating or editing roles, you select permissions from these categories.

Application Permissions

Core system and administration permissions:

Products Permissions

Finance Permissions

Permissions for financial operations:

Clients

Estimates

Purchase Orders

Sales Orders

Invoices

Debit Notes

Suppliers

Bank Accounts & Transactions

Inventory Permissions

Production Permissions

Projects Permissions

Configurator Permissions

For product configuration features:

Asset Management Permissions

CRM Permissions

Calendar Permissions

Communications Permissions

HR Permissions

Document Permissions

Reporting Permissions

Hiding stock value from most users

By default the VIEW_STOCK_VALUE permission is not granted to any role. Users who don't have it can still see stock counts and units, but every monetary column ("Total Stock Value", "Value" per row, etc.) is hidden.

Grant it only to roles that legitimately need to see cost / inventory value:

1. Go to Administration → Roles
2. Open the role that should see stock value (e.g. Finance, Purchasing, Managing Director)
3. Scroll to Reporting
4. Tick View Stock Value
5. Save

Users with that role will see the value columns on their next page load. Users without the role will see the same screens with the value columns removed — no separate "denied" view is needed.

Permission Naming

Most permissions follow CRUD naming — Create, Read, Update, Delete — per entity, with extra action permissions where a workflow needs them (for example Review PO, Review Transfer, Send Invoices). Each permission is toggled individually in the role editor.

Role Hierarchy

Example Structure

Administrator (all permissions)
├── Manager Roles (department permissions)
│   ├── Sales Manager
│   ├── Warehouse Manager
│   └── Finance Manager
└── User Roles (limited permissions)
    ├── Sales User
    ├── Warehouse User
    └── Viewer

Assigning Roles

Single Role

Users typically have one role:

1. Open user
2. Select role
3. Save

Multiple Roles

If needed:

1. Create combined role
2. Or assign multiple
3. Permissions combine

Testing Roles

Before Deployment

1. Create test user
2. Assign role
3. Test access
4. Verify restrictions

Best Practices

Principle of Least Privilege

• Grant minimum needed access
• Start restrictive
• Add permissions as needed

Role Maintenance

• Review roles quarterly
• Remove unused permissions
• Document role purposes

Roles vs Access Control

It's important to understand the difference between roles and access control:

A user needs both appropriate role permissions and resource access to perform an action on a specific resource.

Related