Roles and Data Visibility

Access rights have two layers, as in ABRA Flexi:

• Roles say what a user may do: which modules, which records of them and which operations (read, write, delete, print and export, single wizards).
• Data visibility says which records they see inside the functions their roles allow: only some cost centres, document types, number series, warehouses, cash registers, bank accounts, accounting rules, or only their own documents.

Both are set in Settings → Organisation: [navigate:/settings/roles|Roles|shield-check] and [navigate:/settings/users|Users|users].

Before you start

Nobody has a role yet, so everyone has full access. The rights switch on for the whole organisation the moment the first role is assigned. From then on a user without a role sees nothing but their own profile, so give every user a role first. An administrator of the organisation always has every function and every record.

Roles

System roles ship with the application and are kept up to date with it: Administrator, Read only, Chief accountant, Accountant, Invoicing clerk, Salesperson, Buyer, Warehouse clerk, AI agent. A system role that needs a module the organisation does not have is not offered. You cannot change a system role: copy it to an own role and take rights away, that is the quickest way to a role of your own.

An own role has a tree of functions. Each module (Products, Warehouse, Sales, Accounting, …), each of its entities and, under Custom, each operation group has one of these levels:

• Inherit – the same as the level above it (the entity takes the module’s level, the module the role’s default, which is no access).
• No access – the module or the entity is not in the menus and its records cannot be opened.
• Read only – list, open, search, reports and dashboards; nothing can be changed.
• Full access – read, write, delete, print and export, every wizard.
• Custom – choose per operation group: Read, Write (also the wizards and actions that change records), Delete, Print and export; a single wizard can be switched off inside a granted group.

The General, Accounting and Settings blocks hold the cross-cutting rights: export, print, file import, API keys, MCP, the AI assistants, merging change sets, editing locked periods and closed VAT, posting, the rulebooks, the settings pages.

Sensitive fields (purchase prices, bank details, personal data) can be hidden or made read-only for a role, for every entity at once under General or per entity under Custom.

A user may hold several roles: they may do what any of the roles allows.

Data visibility

Open a role (Data visibility tab) or a user (Edit permissions). For each dimension a switch Restricted turns the restriction on; then every object of the dimension is Hidden, See or See and edit. “(no value)” stands for records without a value in the dimension: they are always seen, writing them needs See and edit on “(no value)”.

• A hidden object is not seen at all, not even in the list of cost centres or document types; its documents look as if they did not exist.
• An object that is seen but not editable makes its documents read-only.
• The user’s own rows in a dimension win over the rows of their roles; a dimension without rows is unrestricted.
• The lines of a document follow the document.

A write with a value outside the user’s visibility is refused as a whole record, as in Flexi.

Users

[navigate:/settings/users|Users|users] lists the members of the organisation with their membership (administrator or user), their roles and, once the rights are on, who has no role. Edit permissions opens the user: tick the roles, set their own data visibility and check Effective rights: what the user may do, exactly as the server resolves it.