Staff accounts, roles and permissions

Prerequisites and authority

Use an individual staff account with the action permission and required organization module/license. Viewing a menu does not establish permission to mutate records.

Create individual staff access

Use Administration → Admin Users and Roles & Permissions. Give each person a separate account so sessions and audit events can be attributed accurately. Grant the minimum permissions required for their work.

1. Identify the staff member's responsibilities.
2. Review an existing role or prepare a suitable role through the supported interface.
3. Create the administrator account and assign the role.
4. Deliver initial access privately and complete the password/security setup.
5. Test a representative permitted action and a representative forbidden action.

Role names alone do not establish authority. Consult effective permissions and the Roles and permission matrix navigation matrix. A financial operator may need payment and reporting access without router or staff administration.

Maintain a recovery-capable administrator before restricting another account. Do not remove the last working administrative access path. Protected actions may require a second authentication step; inspect the actual challenge rather than bypassing it through another interface.

When someone leaves, deactivate access and revoke sessions through supported controls, then check the audit outcome. Role changes and deactivation may affect existing sessions differently; verify the selected release. Review permissions periodically and after organizational changes.

Related guides

Related guides: Administrative session and audit investigation, System operations and task controls, Roles and permission matrix.