Roles and permissions

Define least-privilege access before broader team onboarding.

Last updated:

On narrower layouts, the Name column becomes the primary summary cell. When the standalone Status column is hidden, the role status badge folds into Name.

Default role strategy

Start with broad role templates, then narrow permissions by real job function.

Suggested rollout

  1. Admin for platform owners
  2. Integration Manager for channel connections and integration credentials
  3. Manager for operations leads
  4. Location-focused roles for warehouse teams
  5. Read-only access for reporting users

Default role permissions

  • Admin receives all active permissions, including support request read/write access.
  • Integration Manager receives channels.connections.read and channels.connections.manage, plus media.library.read.
  • Manager receives:
    • channels.connections.read
    • catalogue.listings.manage, insights.rules.manage, and inventory.stock.manage
    • media.library.read and media.library.manage
    • all purchase-order permissions
    • all sales-order permissions
    • all Warehouse permissions
  • Location receives:
    • purchase-order read and receive
    • sales-order read, allocate, deallocate, dispatch, and deliver
    • Warehouse read, operate, labels, and setup
    • no admin or connection-management permissions
  • Read-only receives:
    • channels.connections.read
    • media.library.read
    • purchase-order read
    • sales-order read
    • Warehouse read

Only Admin receives account-details, costing-policy, and plan-management permissions by default. Read-only users can view permitted operational data but cannot mutate stock, locations, listings, listing drafts/templates, insight rules, account details, costing policy, or trial plan.

Guardrails

  • Avoid shared user accounts
  • Review permissions regularly
  • Remove stale invites and unused roles
Tip

Test role changes in a staging environment before rolling out to all users.