Custom roles and the permission matrix

The role decides who can do what in the diary: a role carries permissions (log an event, issue a task, report…), and each colleague has a role. Alongside the built-in roles you can create a custom role, and in the permission matrix toggle each action on or off per role.

Before you start

• Permission: the role-management right — tenant_role:manage.
• Where to find it: the Roles and Permissions tabs in the management area.

Create a custom role

The New custom role form. The base is an existing role whose rights the new one inherits — you refine from there in the permission matrix.

1. On the Roles tab, in the New custom role block, enter the Display name (e.g. Senior operator).
2. Give a Key — a machine identifier (e.g. senior_operator).
3. Choose a Base (inherited rights) — an existing role whose rights the new one starts from.
4. If the organisation has a module enabled, tick under Module access which modules the new role can reach. “The new role cannot reach anything you leave unticked.” (The permission manager sees this selector.)
5. Click Create role.

Set the permissions (permission matrix)

On the Permissions tab there is a matrix: “One role per row, one action per column — the toggle sets the tenant-level right.” Turning a cell on gives the role that action; off removes it.

1. Open the Permissions tab.
2. Find the role’s row and the action’s column (if it is not obvious what a column allows, hover its header — it explains).
3. Toggle the cell on/off. The change takes effect immediately.

The Administrator’s rights cannot be restricted

“The Administrator’s rights cannot be restricted: they have full access in their own plant.” Their row in the matrix is locked. If someone needs narrower rights, give them a different role (on the Users tab) rather than trying to restrict the Administrator.

Paid-module permissions — a separate sub-tab

When you enable a paid module (e.g. Operations Analytics), a sub-tab switcher appears at the top of the Permissions tab: alongside the Diary & organization base, each enabled module gets its own sub-tab. While no module is enabled the switcher is not shown — the matrix looks exactly as before.

1. On the Permissions tab, switch between the sub-tabs (e.g. Diary & organization ↔ Analytics).
2. Each sub-tab shows the columns for that module; the text above it describes what they control.
3. Set the toggle the same way as in the base matrix.

Module access — the first toggle in the row

The first column of every module sub-tab is Module access: it decides whether the role can reach the module at all. The other columns decide what it can do inside.

1. Switch to the module’s sub-tab (e.g. Permit to work).
2. In the role’s row, turn Module access on.
3. Then set in the other columns of the row what the role can do in the module.

When Module access is off, the other cells of the row are greyed out and cannot be clicked: “The role has no access to this module. Turn on Module access first.” Permissions set earlier are not lost — they apply again when you turn access back on. On the Roles tab a badge next to the role’s name shows which modules it can reach.

The roles are the same — only the columns differ

The roles per row are the same on every sub-tab: you do not create a separate “analytics role”, you turn the module’s actions on for an existing role. The sub-tab only filters which columns you see — so the permissions of many modules never collapse into one unreadable matrix.

Photo permissions

The Diary group holds two photo permissions: photos:filter_by_uploader (“Filter photos by uploader” — filtering by uploader and the uploader’s name in the photo viewer) and photos:export (“Export photos” — the manifest CSV). By default the Shift leader and the System administrator hold them; details: Set up photos.

If it worked

The new role appears in the roles list and is selectable at invitation time. Changes in the matrix take effect immediately: the toggle state decides what the role can do. When you pick the role on the invite form it lists the modules the role can reach — a quick way to check your setup.

Common problems

What you see	Why	What to do
No “Roles”/“Permissions” tab	You do not have the tenant_role:manage (or permission-management) right.	Ask your admin.
I cannot change the Administrator’s row	Their rights cannot be restricted (locked).	Give the colleague a different role on the Users tab.
I do not know what a column allows	The action name is short.	Hover the column header — it shows the explanation.
The cells on a module sub-tab are greyed out	The role has no access to the module.	Turn on Module access at the start of the row.
I granted a permission but the colleague still cannot reach the module	Module access is off — it closes every permission.	Turn on Module access in the role’s row.
I cannot see an add-in’s columns (e.g. Translation)	The add-in is not enabled for the organisation.	Request it on the Add-ins tab; the columns appear once it is on.

Related

Invite a colleagueYou assign the role at invitation time.

Edit the diary elementsHow the diary is built — governed by the roles' permissions.