Create a role and choose its permissions

Why it matters

The roles Genuka provides cover common cases, but your organization has its own jobs: warehouse supervisor, a salesperson who does not see margins, an outside accountant. A custom role groups exactly the permissions of a job. You create it once, then assign it to everyone who holds that job.

Summary

Roles are managed in Settings › Company › Roles & Permissions. A role has a name and a list of permissions, grouped by module. You then assign it to a member from their record in Settings › Company › Team. To understand what a permission covers, first read "Access rights, roles and permissions".

Before you start

• Create, edit or delete a role: users.* permission (administrators, and by default the Manager role).
• View the list of roles: users.view is enough.
• Assign a role to a member: be an administrator. A manager (Manager role) cannot change the role of an existing member.

The list of roles

The Roles screen shows, for each role, its Name, Description, the number of Permissions, Members, and its Type:

• System: Administrator, Manager, Service agent, Delivery person, Accountant. You can change their permissions, not their name, and you cannot delete them.
• Custom: the roles you create.

Steps: create a role

1. Settings › Company › Roles & Permissions (/settings/roles).
2. Click Create a role.
3. Fill in:
   • Internal name: lowercase, digits, _ or -, no spaces (e.g. warehouse_supervisor);
   • Display name: what the team will see (e.g. "Warehouse supervisor");
   • Description (optional).
4. Under Permissions, tick what the role should open. Permissions are grouped by module (Orders, Products, Stocks, Accounting, Inbox, AI assistant...). Use:
   • Search a permission...;
   • the All / Granted / Denied filter;
   • Expand all / Collapse all and Select all / Deselect all.
5. Save. Genuka shows "Role created".

In each module, Manage all (...) is the wildcard (orders.*, stocks.*...): it gives all actions in the module. View (...), Create (...), Update (...), Delete (...) are the separate actions.

Steps: assign the role to a member

1. Settings › Company › Team, open the member (or Create account for a new one).
2. Under Role, choose the role. Its permissions are ticked under Choose user permissions.
3. Adjust this member's permissions if needed, then Save.

When you change a member's role or permissions, their open sessions are closed: they must sign in again for their new rights to apply everywhere.

Steps: edit or delete a role

1. In the list of roles, open the role.
2. Tick or untick permissions, then Save ("Role updated").
3. For a custom role, Delete removes it permanently, after confirmation.

Fields and options

Edge cases and common mistakes

• "Use lowercase letters, numbers, underscores or dashes only.": the Internal name contains a capital letter, a space or an accent. Put the readable label in Display name.
• "Pick at least one permission": an empty role cannot be saved.
• You can only grant what you have. A member who manages the team without being an administrator can only tick permissions they hold themselves; the others are ignored on save.
• Editing a role updates the members who carry it. The new permissions apply at once to every member holding this role in this company. If you remove a permission, those members are signed out and must sign in again, so the removal applies everywhere. A member working in another of their companies at that moment gets the new permissions when they come back to this one.
• A role that cannot be deleted: system roles cannot be deleted, nor can a role still assigned: "Reassign the ... member(s) before deleting."
• The Administrator role opens everything, including billing, the team and data deletion. Prefer a custom role.

FAQ

Can I rename the "Service agent" role to "Salesperson"? No, the name of a system role is locked. Create a custom "Salesperson" role with the permissions you want.

Can the Manager role create roles? Yes, by default it carries users.*. But it can only grant the permissions it has itself, and it cannot change the role of an existing member.

How do I give access to the AI assistant? Tick AI assistant in the role. It is the agent.access permission, granted to roles by default and which an administrator can remove.

What about the team messaging of the Genuka Workspace app? It has its own permissions, separate from the Inbox: chat.use (use the messaging), granted to all roles by default and which an administrator can remove; chat.groups.create (create discussion groups) and chat.messages.delete_any (delete other members' messages), which only administrators have by default: tick them on the role that needs them.

What about Work (tasks, shared notes, approvals) in the Genuka Workspace app? It is opened by the work.use permission (use work: tasks, notes, approvals), granted to all roles by default: an administrator can remove it from a role to hide Work from its members. The Work manager of a company is whoever holds the users.* right (see above).

See also

• Access rights, roles and permissions (droits-et-permissions)
• Invite a team member (inviter-membre)
• Security policy: PIN, password and sessions (politique-securite)