Roles and permissions explained

A role is a named set of permissions. Every user has one role, and the role decides three things for every screen and every important button in SeroBooks:

• whether the person can see it at all;
• whether they can use it straight away;
• or whether it is visible but locked, so that someone with the right to approve it must type their password first.

This article explains how roles work, walks through the Roles screen and the role editor, lists the ready-made roles, and documents every permission in the SeroBooks tree.

Opening the Roles screen

1. Open Company ▸ Set Up Users and Roles… (or Menu ▸ Admin ▸ Users & Roles).
2. Click Manage roles & permissions.

The Roles screen lists every role in your company.

Three outcomes: hidden, locked, allowed

Every row in the SeroBooks permission tree has two tick boxes.

Hover over the column headings for a reminder: VIEW — Shows the tab or button at all; ALLOW — Use it without asking anyone.

How ticking works

The editor keeps the tree consistent for you:

• Allow includes View. Ticking Allow also ticks View on that row and on every row above it.
• View works up the tree. Ticking View on a screen also ticks View on its module, because a screen inside a hidden module can never be reached.
• Clearing View clears everything underneath. Unticking View on a module clears View and Allow on every screen and action inside it, so nothing stays granted out of sight.
• Clearing Allow does not cascade. You can leave a module locked and still allow a screen inside it. The person approves once on the way in and then works without being asked again.

The row menu

Every module and screen row has a ⋮ menu (Apply to everything in …) with four choices:

Adding or editing a role

1. On the Roles screen click Add Role, or the pencil on an existing role.
2. Type the Role name (for example Bookkeeper). Do not use # — it is removed.
3. Optionally click Start from a role (top right) and pick a ready-made role. This replaces everything on the SeroBooks Access tab with that role's permissions; the other tabs are not changed.
4. Adjust the tabs described below.
5. Click Create Role (or Save Changes).

A green message confirms Role added successfully or Role updated successfully. Users on the role get the new permissions the next time they sign in.

The tabs of the role editor

If your company has both SeroBooks and SeroPOS, an App access box also appears under the role name: Both apps (default), SeroPOS only — the till or SeroBooks only — the books. People with the role sign in to that app, and count towards that product's user allowance.

The SeroBooks Access tab

• Search (Search tabs and actions — "refund", "reconcile"…) filters the tree. A match shows its module and everything inside it.
• Click the arrow or the name of a module or screen to open or close it.
• The count beside each module or screen (for example 12/34) shows how many rows inside it are granted.
• The line above the columns reads X of Y granted for the whole tree.

When nothing on this tab is ticked, a blue note reads: Nothing ticked — this role is UNRESTRICTED in SeroBooks and sees every screen, exactly as it did before permissions existed. Tick anything at all and the role is governed from then on: only what is ticked will be visible.

Saving an empty role

A role must grant something. If no box is ticked on any tab, Create Role shows Tick at least one permission. A role with none grants no access at all. A role that grants nothing shows its users nothing.

Who is never restricted

Roles with no SeroBooks policy

A role that holds Web Access or Workspace permissions but nothing on SeroBooks Access is ungoverned: it sees every SeroBooks screen, as roles did before SeroBooks permissions existed. Two exceptions apply even then:

• The following areas are locked (visible, but need approval) for an ungoverned role: Accounting ▸ Banking, Accounting ▸ Year-End, Accounting ▸ Sales Tax, Accounting ▸ Setup (the posting map), Accounting ▸ General Journal Entries, Accounting ▸ Move from QuickBooks, and every Payroll screen (Pay Runs, Employees, Setup, Benefits & Deductions, Remittances, Records of Employment, Employer Levies, Year-End Slips). To let such a role use them without approval, give the role a SeroBooks policy and tick Allow on them.
• Opening Purchases, Payments, Inventory, Transfers or Reports can ask for Manager Approval if the role lacks the older module permission for it. Giving the role a SeroBooks policy replaces these checks with the tree.

Approval dialogs

Two kinds of approval box appear in SeroBooks.

Approval Required

Shown when someone uses a locked SeroBooks screen or button. The box names the action being approved (for example Invoices › Refund / Credit Note) and reads This is locked for your role. Anyone who has access to it can approve this one action.

1. The approver types their Login ID and Password.
2. They click Approve.

An approval covers one action only. The next refund asks again. Nothing is remembered for the rest of the day.

Manager Approval

Shown for the Workspace and Admin permissions (for example opening App Settings or an Admin tile). It reads '…' is locked for your role. An Admin or Manager can approve this action. Only an Admin or Manager login is accepted; anyone else gets Please Enter Admin or Manager User id and password. This approval also covers one action only.

Admin Access

Opening Menu ▸ Admin asks for an Admin or Manager login (Admin Access — Manage products, categories, staff and settings) unless you are an Admin or Manager yourself, or your role holds at least one Admin tile permission. Once passed, it is not asked again until you sign out.

Where you see permissions in the app

• A screen your role cannot view is simply not in the menus, the ribbon or Go To / Look Up.
• A locked screen shows a small padlock beside its name. Clicking it asks for approval.
• A screen your company's plan does not include shows a different mark (a small award-badge icon). That is not a permission: nobody in the company can open it until the plan changes. See Your subscription and plan.
• If a document links you to a screen you cannot view, the window reads Your role does not have access to this screen. An administrator can grant it under Admin › Roles.

The ready-made roles

Start from a role offers six starting points. Each one only sets the SeroBooks Access tab; you can change anything afterwards.

Every permission in the SeroBooks tree

The tree follows the SeroBooks modules. Every module row and every screen row has View and Allow. Actions (indented under their screen) are the sensitive buttons. Screens are listed with the names SeroBooks shows; a few screens share another screen's permission and have no row of their own (Edit Invoice uses New Invoice, Edit Bill uses Enter Bills, the Home Page uses Overview, and Create Estimates uses Estimates).

Dashboard

Overview, Getting Set Up, My accountant (called Clients for an accounting practice), Sales Analytics, Inventory Health, Cash Flow. No separate actions.

Sales

Purchases

Inventory

Transfers

Payments

Contacts

Reports

Accounting

In a United States company, T2 / GIFI is called Income Tax and Write Cheques is Write Checks.

Payroll

Forecast

Forecast, Reorder Levels, Ship to Amazon, What's Coming. No separate actions.

Amazon

Overview, Insights, Settlements, Orders, Taxes, Products (Map a Listing), Issues (Resolve an Issue), Returns, Inbound, Storage, Recovery, Buy Box, Traffic, Settings (Edit Marketplace Settings), and Fees (Map a Fee).

Maya

Chat

The Workspace tab

One tick box per item; these control the left menu and the Admin screen.

A role that holds any Admin tile permission goes straight into Menu ▸ Admin without the Admin Access box; each tile still checks its own permission.

The Web Access tab

These permissions apply in the web Back Office and to some server actions made from the app — for example adding tax rates or changing payment methods. They are grouped by area, with a tick box per group. Two entries matter for locations:

• Allow multiple locations (under Business Locations) — users on this role may work at more than one location. When it is off, an orange note reads Allow multiple locations is off — each user on this role works in exactly one location, set on their user record.
• The locations themselves are set on each user (Works at), not on the role.

If the tab reads No permissions synced yet. Run 'Sync Database' first., use Menu ▸ Sync DataBase and reopen the role.

Deleting a role

1. Click the bin on the role's row.
2. Confirm Delete in the Delete role …? box (This action cannot be undone.).

Tips

• Build roles around jobs, not people. A Bookkeeper role used by two people is easier to keep right than two personal roles.
• Prefer locked to hidden for day-to-day actions. Staff who can see Refund / Credit Note with a padlock ask for approval; staff who cannot see it look for a workaround.
• Use Read-only (hide actions) for auditors and outside reviewers. They see everything and are never interrupted by approval prompts.
• Test a role. Create a test user on the role, sign in as that user on another computer, and walk through the screens they need.

Common problems

I ticked one box and the user lost everything else. Ticking any box on SeroBooks Access makes the role governed. Use Start from a role, or the ⋮ ▸ Full access menu on the modules the person needs.

A module shows with a padlock and every click asks for approval. The role has View on the module but no Allow on any screen inside it. Tick Allow on the screens they should use.

A Manager approved something their own role cannot do. That is by design: a Manager may approve anyone's locked action. Only the Manager's own work follows their role.

Changes to a role did not apply. Users pick up the new permissions when they next sign in.

Role already exists. Another role already has that name. Choose a different name.

Related articles

• Set Up Users and Roles
• Staff sign-in names (name@business)
• Permissions: "you do not have access"
• The Admin screen
• Audit Trail
• Set Closing Date and Year-End
• Ask Maya, your assistant
• Team Chat