Custom permissions by role

What this does

Every role starts with a default set of permissions. Settings → Roles shows them as a grid: one column per role, one row per permission, grouped by area (Dashboard, Customers, Work Orders, Accounting, Settings, and so on). The Owner can turn any cell on or off for this shop. Everyone else can look but not change.

Before you start

Owner only. Know which specific permission is missing; the permission names are literal (invoices.void, accounting.manage, settings.team), and the grid shows them by area.

Steps

Open Settings → Roles. Click a cell to toggle that permission for that role. Changes save as you click and apply on each person's next page load. The Owner column is fixed: the Owner always has everything.

Reset on a role's column drops your overrides and puts that role back to the defaults.

How it's used

Two places read the grid: the sidebar, which hides screens a role can't open, and the server actions, which refuse the action outright even if someone reaches the screen another way. Changing a permission changes both. A role with accounting.view but not accounting.manage sees the accounting screens read-only.

Common problems

I gave a role a permission and they still can't do it. They need to reload. If it still fails, the action may need a second permission: voiding a check is check.void, not check.create; deleting a vendor is vendor.delete.

Which permission is it? The screen's error message usually says. If not, the Roles and permissions page lists the areas each role covers by default, and the grid rows are named for the action.

I've made a mess. Reset the role and start again.