Users, Groups, and Roles

The System section of the left menu contains three related directories for access management: Users (/users), Groups (/groups), and Roles (/roles). Users and groups are available to administrators and holders of the admin.users permission (see Admin sections access); roles — to the full administrator only.

User ──┬── linked to a Company and an Org Unit
        ├── belongs to one or more Groups
        └── gets permissions through Roles:
               • assigned directly
               • inherited from the Org Unit

Users

Creating a user

1. In the System section, open Users
2. Click the create button
3. Fill in the form's tabs
4. Save

The user form is split into tabs.

Tab	What it configures
General	Username, Email, Last Name / First Name / Middle Name, time zone, password
Organization	Company, Org Unit, Manager, Job Title, VIP flag
Roles	Manually assigned roles, and roles inherited from the org unit (view-only)
Workspace	The list of desktop tabs (entities, dashboards, calendars) and their order
Notifications	Email and Telegram notifications, Telegram account linking

User fields

Field	Required	Description
Username	Yes	Login/display name
Email	Yes	Used for login and notifications
Password / Confirm Password	Yes when creating	Minimum 8 characters, must match. Not required when editing unless you need to change it
Last Name / First Name / Middle Name	No	Personal details
Time Zone	No	Auto-detected if not set
Company	No	Link to the organizational structure
Org Unit	No	Available after a company is selected
Manager	No	Used, for example, for approving absence requests
Job Title	No	A free-text field

If a user signs in through an external provider (LDAP/Active Directory, Google, GitHub), the form shows the login source as a separate badge; a local password isn't required in that case, but it can be set as a backup login method.

A user's groups and roles

On a user card's Roles tab, you can see all of that user's active roles — both manually assigned and inherited from the org unit (the latter are marked separately and can't be removed here — they must be changed on the org unit's card). Only manually assigned roles can be added or removed there.

Group membership is configured from the group's side (see below), not from the user's card.

Groups

Groups (/groups) are sets of users. A group has a name and a list of members.

Creating a group

1. Open Groups
2. Click the create button
3. Enter a Group Name
4. In the Group Members field, select the employees who should belong to the group
5. Save

A group doesn't carry access permissions by itself — it's just a named list of people. Use groups where you need to address employees as a set (for example, as recipients in notification settings or owners in categories), not for controlling access to data — that's what roles are for.

Roles

Roles (/roles) are the primary access-control mechanism. A role defines:

• a set of permissions for entities;
• a workspace — which tabs (entity lists, dashboards, calendars) a user with this role sees, and in what order.

Permissions

For every entity (record type) in the system, four permissions are created automatically: create, view, edit, delete (CRUD). A role is a set of such permissions across all entities. CRUD permissions control access at the level of an entire record type ("can read tickets," "can delete customers").

Which specific records within a type a user sees and can modify is governed by the second layer — record access rules (RLS), configured per role in the entity builder. If an entity has no rules configured, regular users see no records at all, even with a CRUD permission on it.

A user with the Administrator role (the system admin role) bypasses permission checks entirely — they always have access, regardless of which permissions are explicitly assigned.

Admin sections access

Full access to App Management belongs only to the admin role, but administration can be delegated piecewise: the role card has an Admin sections access block. Each permission opens its whole section:

Group	Permission	Section
Constructor	admin.entities	Entity constructor & packages
Constructor	admin.menu	Menu
Content	admin.dashboards	Dashboards & charts
Content	admin.portals	Self-service portals
Content	admin.reports	Reports administration
Content	admin.calendars	Calendars
Content	admin.audit	Audit log
Processes & Integrations	admin.processes	Business processes
Processes & Integrations	admin.integrations	Incoming messages & actions
System	admin.org	Organization & shifts
System	admin.users	Users & groups
System	admin.settings	System settings & license
System	admin.developer	Developer tools (Script Console, etc.)

Roles stay with the full administrator

Managing roles and assigning them is deliberately not a separate permission and remains with the admin role only — otherwise a holder of partial access could grant themselves the missing permissions (privilege escalation). admin.users manages users and groups, but not roles.

System preset roles

Ready-made roles for typical delegation are created out of the box:

Role	Contents
Administrator (admin)	Full access to everything
Process Designer (process_designer)	admin.processes — the BPMN process editor
User Administrator (user_administrator)	admin.users — users and groups
Report Builder (report_builder)	reports.build + reports.view — building own reports
Report Administrator (report_administrator)	admin.reports + reports.build + reports.view — all tenant reports

Example: to let an analyst build reports without access to the rest of administration, assign Report Builder; to let a support tech lead maintain processes — Process Designer.

Creating a role

1. Open Roles
2. Click the create button
3. When creating, you can immediately apply one of the ready-made presets — Administrator, Employee, or Observer — which fills in a characteristic set of permissions that can then be fine-tuned manually
4. In the System Permissions block, add or remove specific entity permissions
5. In the Tab Order block, configure which entities/dashboards/calendars a user with this role sees on their desktop, and in what order — the first tab opens by default
6. Save

Assigning a role to a user

A role can be assigned in two ways:

Method	Where	Applies to
Directly	User card → Roles tab	Only that user
Through an org unit	Org unit card → roles tab	All users in that org unit automatically

The second method is convenient for roles like "Employee" or "Company Access" that every employee in an org unit should receive without manual per-user assignment.

Deleting a user, group, or role

Open the relevant record and use the delete button on the card. This action is irreversible.