Roles and access: how permissions work

#The model in one paragraph

A person has one or more roles; a role holds permissions; a permission is written module.record.action — for example finance.fiscalyear.edit. The standard actions are view, create, edit and delete. Vouchers use record_type.<code>.<action>, for example record_type.CASH-REC.create. A superuser account passes every check. Business actions such as approve, post, close or release are checked by their own rules, which are described in each process chapter.

#Where to manage access

#Roles delivered with BSuit

Each module seeds its standard roles (for example Finance Manager, Warehouse Clerk, Technician, Maintenance Manager, HR Payroll Admin, Registrar, Bursar, Faculty, Doctor, Nurse). The Roles and permissions directory lists every role with what it can do: Roles and permissions. Some seeded roles are created empty and must be given permissions before use; the directory shows only roles that currently hold permissions.

#Requesting temporary access

1. Open Identity › Access requests and choose New request.
2. Pick the role, a duration between 1 and 720 hours, and write a justification (required).
3. An administrator approves or denies it. Approval is refused if the role would create a segregation-of-duties conflict with roles you already hold.
4. Approved access is time-bound and ends automatically.

#Access reviews

In an access review an administrator decides, for each person and role, to keep or revoke. Revoking removes the access immediately and the decision is recorded for audit.

#Multi-factor sign-in

1. Open your own security page (Administration › My security).
2. Scan the code with an authenticator app and enter the 6-digit code to confirm.
3. Store the recovery codes safely; each works once.

#Troubleshooting access