Roles and permissions
How access control works - the permission catalog, roles, and the platform/business-module split.
- Audience
- Administrators, IT/security evaluators, Implementation partners
- Permissions needed
- Platform Roles administration
- Environment
- Production and staging
- Product version
- Current
- Last reviewed
- Owner
- Propulsive Product Team
Every action in Propulsive ERP is gated by a permission key in the form module.resource.action - for example inventory.items.create or hr.payroll.read. This single catalog is the source of truth for what permissions exist; roles decide who has them.
Two scopes of permission
- Platform-scope permissions cover running the platform itself - application settings, integrations, the CMS, platform-level billing and administration. These are for the small group of people who administer the deployment.
- Business-module permissions cover the day-to-day modules your staff use - CRM, HR, Accounting, Inventory, Sales, Procurement and so on.
Keeping these separate means a sales manager can be given full CRM access without ever being able to touch application settings.
Setting up roles
Under Application Settings → Platform Roles, an administrator creates roles and assigns them a set of permissions from the catalog. Typical starting roles look like: Administrator (platform-scope + everything), Sales Manager, Sales Rep, HR Admin, Finance/Accounting Admin, Production Lead, Read-only/Auditor. Assign the narrowest role that lets someone do their job - it’s easier to grant one more permission later than to discover someone had access they shouldn’t have.
What happens when a permission is missing
If a user’s role doesn’t include a permission, the corresponding menu item doesn’t appear and the corresponding action is rejected server-side (not just hidden client-side) - so removing a menu item is a real control, not cosmetic.
Auditability
Permission changes themselves are recorded in the platform’s append-only audit log - who changed which role, when, and what the permission set looked like before and after. See Security & Compliance for the full audit-logging model.