Roles and permissions

Who can do what, and how to change it.

Administration → RBAC & Custom Roles (headed Custom Roles & Dynamic RBAC) is where store-level permissions are defined.

The roles you start with

Every new business gets three:

Role	What they can do
Business Admin	Everything
Store Manager	Create and edit categories, products, inventory and transfers; create and receive purchases; import sales; view analytics and reports. Cannot delete products, categories or suppliers, approve price changes, or edit settings and roles
Employee	Read-only across the catalog, inventory, purchases and sales

The default Employee role cannot receive deliveries or change prices from the Store Ops app. To allow that, grant the role permission to write products and receive purchases — or use a custom role.

Make a custom role

1. Choose Create Custom RBAC Role
2. Name it and describe it

   Both are worth doing properly — in a year, “Backroom” will not mean anything without the description.

3. Tick the permissions

   They are grouped by area. At least one is required.

4. Create Role

   Then assign it to people per store from Team Members.

Custom roles are a paid feature, with a limit on how many you can have. See Billing and plan.

Permissions worth understanding

Permission	Why it is separate
purchases:receive	Counting a delivery in — the person doing this is often not the person who creates invoices
purchases:approve_prices	Approving shelf-price changes. Deliberately separate from creating purchases
inventory:transfer	Moving stock between stores
products:delete	Removing catalog items
settings:write	Business settings, including agent API keys
roles:write	Changing what everybody else can do

The full list is in the permissions reference.

Why a page or button is missing

Anything you lack permission for is hidden, not greyed out — in the web app and the mobile app both. A missing menu item is almost always a permission rather than a missing feature.

Owners and Admins bypass permissions entirely. Testing a role by using an Admin account will not show you what that role can actually see.