User & Role Management

Overview

The Identity & Access Management (IAM) system gives Super Admins fine-grained control over what each admin user can see and do inside the CRM. Instead of every admin having identical full access, you create roles with specific permissions and assign those roles to individual admin accounts.

Navigate to Admin → Access Management in the sidebar to reach the IAM dashboard. From here you can manage roles, review user assignments, and inspect the audit log.

---

Key Concepts

Term	What it means
Module	A section of the CRM (e.g. Clients, Invoices, IAM). Each module has a set of configurable permission actions.
Permission	A specific action within a module, formatted as module.action — e.g. clients.read, invoices.delete.
Role	A named bundle of granted permissions. Roles are created by Super Admins and assigned to admin users.
Super Admin	Bypasses all IAM checks — always has full access regardless of roles.
Legacy Admin	An admin with no IAM role assigned. Retains full access for backward compatibility until a role is explicitly assigned.

---

How Access is Determined

Every admin API route and page checks permissions in this order:

1. Super Admin? → Always allowed (full bypass, no checks performed).
2. No IAM role assigned? → Full access — legacy admin fallback for backward compatibility.
3. IAM role assigned? → Only permissions explicitly granted to that role are allowed. Everything else returns 403 Forbidden on APIs or redirects to the Access Denied page.

---

Managing Roles

Go to Admin → Access Management → Roles.

Creating a Role

1. Click New Role.
2. Enter a role name (e.g. "Account Manager", "Support Agent") and an optional description.
3. Click Create. The role opens in the permission editor.

Editing Permissions (Permission Matrix)

Each row in the permission matrix corresponds to a CRM module. Toggle the switches to grant or revoke individual actions for the role. Changes are saved immediately on toggle.

Module	Available Actions
Clients	read, create, update, delete, export, import
Leads	read, create, update, delete, convert, export, import
Invoices	read, create, update, delete, send, export
Proposals	read, create, update, delete, send, export
Contracts	read, create, update, delete, send
Projects	read, create, update, delete
Employees	read, create, update, delete, invite
Support	read, reply, close
Reports	read, export
Documents	read, upload, delete
Corporate Documents	read, create, update, delete
Brand Center	read, create, delete
Time Logs	read, create, update, delete
Catalog	read, create, update, delete, import
Blog / Content	read, create, update, delete, import
Onboardings	read, create, update, delete
Business Apps	read, create, update, delete, archive, restore
Settings	read, update
Security	read
Audit Log	read
Notifications	read
Locations	read, create, update, delete
Accounts	read, create, update, delete
IAM	read, assign, audit_log.read

Archiving a Role

Archived roles cannot be assigned to new users. Existing user assignments with an archived role remain active — those users continue to have the role's permissions until the assignment is manually updated. To archive, open the role and click Archive Role.

---

Assigning Roles to Users

Go to Admin → Access Management → Users.

1. Find the admin user in the list. The table shows their current role (if any) and when they joined the tenant.
2. Click the role dropdown in their row.
3. Select a role from the list and confirm. The dropdown only shows active (non-archived) roles.
4. To remove a user's role (reverting to legacy full-access mode), select No Role.

Permission changes take effect on the user's next request — no logout required.

---

Sidebar Visibility

When an admin lacks the .read permission for a module, that module's sidebar link is automatically hidden. Admins only see the modules they are authorized to use — reducing confusion and surface area for mistakes.

---

IAM Audit Log

Go to Admin → Access Management → Audit Log. Every role creation, permission toggle, and user assignment is recorded here. Each entry shows:

• Actor — who made the change
• Action — what happened (role_created, permission_granted, role_assigned, etc.)
• Target — which role or user was affected
• Before / After — previous and new values
• Timestamp

---

Access Level Summary

Who	Permissions set	Access level
Super Admin (role = super_admin)	null (bypassed)	Full access — all modules, always
Admin with no IAM role	null (legacy)	Full access — backward compatible
Admin with IAM role	Set of granted keys	Strict — only what the role grants
Admin with empty role (no grants)	Empty set	Denied on all permission-gated modules

---

Frequently Asked Questions

What happens if I assign an empty role (no permissions)?

The admin will see only the wiki, their profile, and the dashboard. They will be denied access to all permission-gated modules and redirected to the Access Denied page. Always verify the role has the necessary permissions before assigning it.

Can a user have multiple roles?

No. Each admin user has one active IAM role at a time. To combine sets of permissions, create a custom role that includes all required actions.

Does IAM affect client or employee portals?

No. IAM only controls admin panel access. Clients and employees have their own separate portal authentication and do not have IAM roles.

How do I give a new admin exactly the same access as an existing one?

Create or reuse a role with the permissions you need, then assign that role to both users.

Is there a way to test a role before assigning it?

Open the role in the permission matrix and review each toggle. The matrix shows exactly which actions will be allowed. You can also assign the role to a test admin account to verify behavior before rolling it out to production users.