Roles and permission groups
Every portal user is given at most one of nine roles: Platform Operator, or Owner, Admin, Supervisor or Accountant of a tenant or of a merchant. The role decides what the user may do; drivers have no role and sign in to the Driver App through their driver profile.
Overview#
A role (also called a permission group) is a fixed bundle of permissions. Administrators give a user a role by name and never edit the individual permissions behind it; the platform team can view each role's full permission list. There are exactly nine roles, and the role picker offers no others. Four roles belong to tenants (fleet operators), four to merchants (fuel and service providers), and one to the platform team. What a role lets a user do is set out in What each role can do; which records the user then sees is set out in Which records each user can see.
The nine roles#
| Role | Organisation | What it is for | Typical holder |
|---|---|---|---|
| Platform Operator | The platform | With a platform team account, works across every tenant and merchant: sets up tenants, maintains merchants, plans and subscriptions, users and platform notifications, fuel VAT rates and government fuel prices, and the platform's finance tasks such as credit allocations, proforma invoices, invoice matching and settlement records. | Platform support and operations staff |
| Tenant Owner | Tenant | Full running of the company's fleet: vehicles, drivers, cards, orders, documents, maintenance, shifts, GPS settings, vouchers, departments and users, with read access to wallets, invoices and transactions, acceptance of proforma invoices and re-issue of a failed money movement. | The company owner or director |
| Tenant Admin | Tenant | Day-to-day administration with the same broad access as the Tenant Owner, and also works the Review Queue. | Fleet or operations manager |
| Tenant Supervisor | Tenant | Supervises the fleet: views vehicles and drivers, creates and changes orders, approves drivers' orders that need a supervisor's decision, reviews odometer readings, updates maintenance logs and plans driver shifts. Cannot delete anything and has no access to wallets, transactions or invoices. Works the Review Queue (Documents, OCR Corrections, Pump Discrepancies). | Dispatcher or team lead |
| Tenant Accountant | Tenant | Finance follow-up: wallets, transactions, ledger, VAT and proforma invoices, subscriptions and billing, with read access to fleet and orders for context. Cannot create orders or change vehicles; besides reading, the role can accept a proforma invoice and re-issue a money movement. | Accountant or finance officer |
| Merchant Owner | Merchant | Full running of the merchant: stores, store devices, SKUs, services, price lists, order processing, departments, vouchers, users and merchant finance. | The merchant's owner or director |
| Merchant Admin | Merchant | The same as Merchant Owner, except that it cannot delete users, store devices or the merchant itself. | Merchant operations manager |
| Merchant Supervisor | Merchant | Processes orders at the stores assigned to them and views stores, catalogue, prices, store devices and departments. No price changes and no deletes. | Store or station manager |
| Merchant Accountant | Merchant | Merchant finance: wallets, transactions, ledger and B2B credit accounts; creates and issues proforma invoices and records B2B credit payments; reads stores, catalogue, prices and orders. | Accountant or finance officer |
Rules#
- One role per user. Saving a user replaces any previous role with the selected one, so a user never holds two roles.
- The role is optional. The Role field on the user form can be left empty; a user without a role holds no portal permissions.
- The role list follows your organisation. On the user form (card Role & Permissions), a tenant's administrators see only the four Tenant roles and a merchant's administrators only the four Merchant roles. Platform team accounts see all nine.
- The creator of an organisation is its Owner. The person who signs up and creates a new tenant becomes its Tenant Owner; the person who creates a new merchant becomes its Merchant Owner. Sign-up itself is described in Get started as a new organization.
- Roles stay inside their organisation. Tenant roles see merchants' stores and prices only as a buyer and cannot manage them; merchant roles never reach tenant-only features such as vehicles and drivers.
- A refused action shows an access-denied page. A signed-in user who opens something the role does not allow gets an error 403 page, rather than being sent back to sign in.
- A role change applies on the user's next click, with no need to sign out, and the audit log records the old and the new role. See Change a user's role and Audit log.
Drivers have no role#
There is no driver role. A driver is a user account with no role, linked to a driver record in the fleet; the user form says so under the Role field and links to the form for adding a driver. The Driver App takes what a driver may see and do from that driver record, not from a role — the driver's company, the driver and the driver's vehicles.
In practice:
- The Users list shows a Driver tag next to the role of any user who is a driver, and the user's detail page has a Driver row reading Yes - view driver (a link to the driver record) or No.
- Drivers sign in to the Driver App with their username, which is their phone number when the driver record has one.
- The Driver App accepts only accounts linked to a driver record. Any other account is refused with the same message as a wrong password, so the app never reveals that the account exists.
- Giving a portal role to a driver's account does not change what the driver can do in the Driver App.
A merchant's store device also signs in without a role: it signs in as the store, not as a person.
How a driver gets a login is described in Give a driver a login; the driver record itself in Drivers.