Permissions reference

Every permission a custom role can grant, and what it allows.

Permissions are written as area:action and are ticked when you create a custom role.

Owners and Admins bypass all of these inside their business. Permissions apply to Members, per store.

Catalog

Permission	Allows
products:read	See products
products:write	Create and edit products, including selling prices
products:delete	Delete products
products:export	Export the catalog
categories:read / write / delete	View, manage and remove categories
suppliers:read / write / delete	View, manage and remove suppliers

Stock

Permission	Allows
inventory:read	See stock levels and the ledger
inventory:write	Adjust stock
inventory:transfer	Move stock between stores

Purchasing

Permission	Allows
purchases:read	See purchase invoices
purchases:write	Create and edit invoices, including scanning them
purchases:receive	Check in deliveries — the one staff need for phone receiving
purchases:approve_prices	Approve or reject price recommendations
purchases:delete	Delete invoices

Sales and reporting

Permission	Allows
sales:read	See sales records
sales:import	Import sales
sales:export	Export sales
analytics:read	See the analytics screens
reports:read / reports:export	View and export reports

Administration

Permission	Allows
stores:read / write / delete	Manage store locations
stores:manage_members	Assign people to a store
businesses:read / write / delete	Manage the business
businesses:manage_members	Manage who belongs to the business
roles:read / write / delete	Manage roles and their permissions
settings:read / settings:write	View and change business settings, including agent API keys
notifications:read / notifications:manage	See and act on notifications
audit:read	Read the audit trail

Combinations worth knowing

Back-room receiver

products:read, purchases:read, purchases:receive, inventory:read — can count deliveries in, on a phone, and nothing else.

Shelf-price updater

Add products:write. Note this changes prices at every store.

settings:write includes agent API keys, and roles:write lets someone change what everyone else can do. Both are effectively administrative — grant them accordingly.