12. Roles and permissions
Every organisation gets six system roles. Permissions are granular, and the
tables below summarise the default grants. A dash means the action is not
available; where a role can view a screen but not change it, that is stated.
12.1 Administration and master data
| Task |
Owner |
Administrator |
Accountant |
Bookkeeper |
Sales |
ReadOnly |
| View organisation settings |
✔ |
✔ |
✔ |
— |
— |
✔ |
| Edit organisation settings |
✔ |
✔ |
— |
— |
— |
— |
| Manage users and invitations |
✔ |
✔ |
— |
— |
— |
— |
| Contacts: create / edit |
✔ |
✔ |
✔ |
✔ |
✔ |
— |
| Contacts: delete |
✔ |
✔ |
— |
— |
— |
— |
| Products & services: create / edit |
✔ |
✔ |
✔ |
— |
— |
— |
| Products & services: delete |
✔ |
✔ |
— |
— |
— |
— |
| Chart of accounts: create / edit |
✔ |
✔ |
✔ |
— |
— |
— |
| Chart of accounts: delete |
✔ |
— |
— |
— |
— |
— |
| Tax rates: create / edit |
✔ |
✔ |
✔ |
— |
— |
— |
| Tax rates: delete |
✔ |
— |
— |
— |
— |
— |
| Invoice template |
✔ |
✔ |
— |
— |
— |
— |
| Document numbering |
✔ |
✔ |
— |
— |
— |
— |
| Data import |
✔ |
✔ |
— |
— |
— |
— |
12.2 Sales, purchases and banking
| Task |
Owner |
Administrator |
Accountant |
Bookkeeper |
Sales |
ReadOnly |
| Invoices: create / edit |
✔ |
✔ |
✔ |
✔ |
✔ |
— |
| Invoices: post |
✔ |
✔ |
✔ |
✔ |
— |
— |
| Invoices: void (credit note) |
✔ |
✔ |
✔ |
— |
— |
— |
| Invoices: delete draft |
✔ |
✔ |
— |
— |
— |
— |
| Invoices: send |
✔ |
✔ |
✔ |
✔ |
✔ |
— |
| Credit notes: create / edit |
✔ |
✔ |
✔ |
✔ |
— |
— |
| Credit notes: post |
✔ |
✔ |
✔ |
— |
— |
— |
| Credit notes: delete |
✔ |
✔ |
— |
— |
— |
— |
| Customer payments: create / edit |
✔ |
✔ |
✔ |
✔ |
— |
— |
| Customer payments: delete |
✔ |
✔ |
— |
— |
— |
— |
| Bills: create / edit / post |
✔ |
✔ |
✔ |
✔ |
— |
— |
| Bills: void |
✔ |
✔ |
✔ |
— |
— |
— |
| Bills: delete |
✔ |
✔ |
— |
— |
— |
— |
| Supplier payments: create / send |
✔ |
✔ |
✔ |
✔ |
— |
— |
| Supplier payments: delete |
✔ |
✔ |
— |
— |
— |
— |
| Supplier credit notes: create / edit |
✔ |
✔ |
✔ |
✔ |
— |
— |
| Supplier credit notes: post / reverse |
✔ |
✔ |
✔ |
— |
— |
— |
| Supplier credit notes: record the refund |
✔ |
✔ |
✔ |
— |
— |
— |
| Supplier credit notes: delete draft |
✔ |
✔ |
— |
— |
— |
— |
| Bank accounts: create / edit |
✔ |
✔ |
✔ |
✔ |
— |
— |
| Bank accounts: delete |
✔ |
✔ |
— |
— |
— |
— |
| Bank transactions: receive / import / match |
✔ |
✔ |
✔ |
✔ |
— |
— |
| Bank transactions: delete |
✔ |
✔ |
✔ |
— |
— |
— |
| Reconciliation: start / reconcile |
✔ |
✔ |
✔ |
✔ |
— |
— |
| Reconciliation: complete |
✔ |
✔ |
✔ |
— |
— |
— |
| Manual journals |
✔ |
✔ |
✔ |
— |
— |
— |
| Reverse a journal entry |
✔ |
✔ |
✔ |
— |
— |
— |
| Financial periods: manage |
✔ |
✔ |
✔ |
— |
— |
— |
| Close / reopen a financial year |
✔ |
✔ |
✔ |
— |
— |
— |
| GST: prepare |
✔ |
✔ |
✔ |
✔ |
— |
— |
| GST: file / reopen |
✔ |
✔ |
✔ |
— |
— |
— |
| Reports |
✔ |
✔ |
✔ |
✔ |
— |
✔ |
| Receivables |
✔ |
✔ |
✔ |
✔ |
✔ |
✔ |
| Payables |
✔ |
✔ |
✔ |
✔ |
— |
✔ |
12.3 Notes on permissions
- Read-only covers the registers, statements and reports but no changes.
- Sales is the customer-facing role: invoices, sending, contacts, products,
credit-note visibility and receivables. It has no purchases, reports, GST or
banking access.
- Bookkeeper performs data entry (invoices, bills, receipts, payments,
matching, draft GST returns) but cannot void, delete, complete a
reconciliation or file GST.
- Accountant runs the accounting: posting, voiding, journals, periods,
reconciliation completion and GST filing. It cannot delete master data or
manage users.
- Owner has every permission, including deletion of master data and
organisation settings.
- Administrator manages the organisation and users and runs both cycles, but
cannot delete accounts or tax rates.
- The Owner always retains
Users.View and Users.Manage, even if a role
permission row is missing. A global administrator also bypasses tenant
permission checks for support.
- Changing a user's role takes effect the next time their permissions are
evaluated (normally on the next request).
