NavigateERP for African business

Access matrix: who can see and do what

Control, role by role, which documents people can view, create, edit, post, approve and more.

Steps

  1. Go to Settings > Access matrix and choose a role.
  2. Each area (Sales, Purchasing, Finance…) and each document has a row; each action (View, Create, Edit, Delete, Cancel, Print, Export, Post, Reverse, Approve) a column.
  3. Leave a cell on Inherit to follow the line above (document → area). Set Allow or Deny only where it differs - e.g. Allow View on Sales, but Deny Create on A/R invoices.
  4. Add a reason and Save: every change is kept in the audit trail. Copy from role gives a role exactly the access of another (replacing what it had).
  5. Under By user, choose a person: tick extra roles (e.g. Sales Officer + Branch Manager - they may do what any of their roles allows) and set personal overrides for exceptions. An override beats the roles and is shown plainly, e.g. "Role: Denied | Override: Allowed".
  6. To make the matrix decide access, tick the areas under Enforce the matrix - Sales, Purchasing, Inventory, Finance, Fixed assets, People, Operations - and save. Screens and buttons a role may not use disappear, and opening them anyway is refused. Untick an area to go back to the roles' current permissions straight away.

Good to know

  • The organisation owner always has full access.
  • In an enforced area, nothing set anywhere means no access.
  • ⚠ marks sensitive actions such as approve, post, reverse and delete.
  • Approving a document also needs its approval template: the matrix says who may approve a kind of document, the template who approves a particular one. Approvers can always open a document waiting for them.
  • Payroll stays with the Payroll Admins the owner assigns: the matrix can narrow their access (Deny) but cannot give payroll to a role.
  • Nothing changes on the day you tick an area: the matrix starts from each role's current permissions.
  • Who wins: the person's own override → their roles combined (a role's Deny only means that role doesn't give it) → nothing set = no access.
  • Extra roles also count for approval steps set by role.
  • Data access: limits stack (own branch + own records = both); several roles give the widest; a person always sees what they created; approvers can open what waits for them. Department and cost centre follow the cost centres on the document lines. Branch limits narrow the dashboards and reports; Records (own team / own) narrows the sales dashboards, Salespersons, targets, the pipeline and the sales report - see Who sees whose sales.