User Roles & Permissions Guide

Complete guide to Gabnet 365's role-based access control system

Document Audience: Management, HR, System Administrators
Last Updated: June 4, 2026

---

Table of Contents

1. Overview
2. Role Hierarchy
3. Role Descriptions
4. Permission Categories
5. Module Access by Role
6. User Management Capabilities
7. Best Practices
8. Governance & Compliance

---

Overview

Gabnet 365 implements a hierarchical role-based access control (RBAC) system with four distinct user roles. This system ensures:

• Data Security: Users access only the information they need
• Accountability: Clear audit trails for all actions
• Operational Efficiency: Appropriate permissions for each job function
• Regulatory Compliance: Meet data protection requirements
• Scalability: Easy to manage as the organization grows

Key Principles

1. Least Privilege: Users receive minimum permissions needed for their role
2. Separation of Duties: Critical functions require multiple roles
3. Hierarchical Control: Higher roles can manage users below them
4. Audit Trail: All permission changes are logged
5. Location-Based Filtering: Non-admin users see only their location's data (where applicable)

---

Role Hierarchy

The tenant dashboard uses a 4-level hierarchy, with higher levels inheriting capabilities from lower levels:

Level 4: ADMIN (System Administrator)
    ↓
Level 3: MANAGER (Department Manager)
    ↓
Level 2: SUPERVISOR (Team Lead)
    ↓
Level 1: USER (Staff Member)

Platform Role: System Owner

System Owner is a platform-level role outside the tenant hierarchy. System Owners access /system to onboard and manage businesses. They can create tenants, activate or suspend businesses, and create the first tenant Admin during onboarding.

System Owners are not the same as tenant Admins:

Hierarchy Rules

• Admins can manage all users at any level
• Managers can manage Supervisors and Users (but not other Admins)
• Supervisors can manage Users only
• Users cannot manage other users

---

Role Descriptions

1. Admin (Level 4)

Typical Positions:

• IT Manager
• System Administrator
• Chief Technology Officer

Business Purpose: Complete system control for technical administration, security management, and system configuration.

Key Responsibilities:

• System configuration and settings management
• User account creation and role assignment for all levels
• Security policy enforcement
• System maintenance and updates
• Data backup and recovery
• Access to all modules and locations

Access Level: ✅ Full system access
✅ All modules and features
✅ System settings and configuration
✅ User management (all roles)
✅ All locations and data
✅ Advanced reports and exports
✅ Audit logs and system monitoring

Use Cases:

• Setting up new business locations
• Creating admin and manager accounts
• Configuring system-wide settings
• Managing integrations
• Troubleshooting system issues

---

2. Manager (Level 3)

Typical Positions:

• Department Heads
• Branch Managers
• Operations Manager
• Finance Manager
• Sales Manager

Business Purpose: Departmental oversight with full operational access to manage day-to-day business functions and team supervision.

Key Responsibilities:

• Department operations management
• Creating and managing Supervisor and User accounts
• Approving significant transactions
• Generating financial and advanced reports
• Monitoring team performance
• Cross-location visibility (if applicable)

Access Level: ✅ All operational modules (Inventory, Sales, Rentals, Services, etc.)
✅ Customer and product management
✅ User management (Supervisors and Users only)
✅ Financial reports and analytics
✅ Advanced reporting and data export
✅ Multi-location access (configurable)
❌ System settings and configuration
❌ Cannot manage other Managers or Admins

Use Cases:

• Reviewing daily sales performance
• Approving large transactions
• Managing team members
• Generating monthly reports
• Overseeing inventory across locations

---

3. Supervisor (Level 2)

Typical Positions:

• Team Leads
• Floor Supervisors
• Service Coordinators
• Shift Managers

Business Purpose: Operational oversight for specific teams or shifts with ability to manage daily operations and basic user management.

Key Responsibilities:

• Day-to-day operational oversight
• Managing User accounts within their team
• Monitoring team performance
• Handling customer service escalations
• Basic reporting and analytics
• Ensuring operational compliance

Access Level: ✅ Core operational modules (Inventory, Sales, Rentals, Services)
✅ Customer management
✅ Product viewing and basic management
✅ User management (Users only)
✅ Basic and financial reports
✅ Assigned location access
❌ Advanced system features
❌ Cannot manage Supervisors, Managers, or Admins
❌ Limited access to system settings

Use Cases:

• Processing daily sales transactions
• Assigning service tickets to technicians
• Creating user accounts for new team members
• Monitoring inventory levels
• Generating daily performance reports

---

4. User (Level 1)

Typical Positions:

• Sales Associates
• Service Technicians
• Warehouse Staff
• Customer Service Representatives
• Data Entry Clerks

Business Purpose: Operational staff with access to perform specific job functions without administrative capabilities.

Key Responsibilities:

• Executing daily operational tasks
• Processing transactions
• Updating records
• Customer interaction
• Following established procedures
• Reporting issues to supervisors

Access Level: ✅ Dashboard viewing
✅ Assigned operational tasks
✅ Own profile management
✅ Basic data entry and viewing
✅ Assigned location only
❌ Cannot manage other users
❌ Cannot delete sales or critical records
❌ Limited reporting capabilities
❌ No access to financial data
❌ No system configuration

Use Cases:

• Processing customer sales
• Creating service tickets
• Updating inventory counts
• Managing customer information
• Viewing assigned tasks

---

Permission Model

Gabnet 365 uses backend permissions in the format resource:action (for example sales:create, inventory:list). Each user has a permissions[] array loaded at login and refreshed via /api/auth/me.

Built-in roles

Default permission sets per role are defined on the backend. Admins can assign additional or custom permissions per user in the user create/edit forms.

Custom roles

Admins create roles at Settings → Roles (/dashboard/settings/roles) with a selected permission matrix. Assign roles to users when the backend supports role linkage.

Sidebar visibility

Navigation items appear when the user has any permission on that resource (or matches legacy Admin role gates):

Common actions

Key resources

customers, products, inventory, sales, rentals, users, locations, serviceTickets, suppliers, purchaseOrders, transferRequest, dismantleRequest, employees, dashboardAnalytics

For the full default matrix by role, see docs/ROLES-AND-PERMISSIONS.md in the repository.

---

Module Access by Role

Dashboard Access

All Roles: View dashboard with role-appropriate data

Inventory Management

Operations Available:

Sales Management

Operations Available:

Service Management

Operations Available:

---

User Management Capabilities

Who Can Manage Whom

ADMIN
├── Can create/edit/delete: Admins, Managers, Supervisors, Users
│
MANAGER
├── Can create/edit/delete: Supervisors, Users
├── Cannot manage: Admins, other Managers
│
SUPERVISOR
├── Can create/edit/delete: Users
├── Cannot manage: Admins, Managers, other Supervisors
│
USER
└── Cannot manage any users
    └── Can only edit own profile

User Creation Process

1. Role Selection: Manager selects appropriate role for new user
2. Profile Setup: Enter name, email, phone, department
3. Location Assignment: Assign user to business location
4. Supervisor Assignment: Link to immediate supervisor (organizational hierarchy)
5. Access Activation: User receives credentials and can log in

Permission Assignment Rules

• Automatic: Permissions automatically assigned based on selected role
• Hierarchy-Based: Cannot assign role higher than or equal to own role
• Location-Restricted: Non-admin users typically restricted to assigned location
• Audit Trail: All role assignments logged with timestamp and assigner

---

Best Practices

For Admins

✅ Do:

• Create separate admin accounts for each system administrator
• Regularly review user access and permissions
• Use manager accounts for day-to-day operations (not admin)
• Document all system configuration changes
• Implement strong password policies

❌ Don't:

• Share admin credentials across multiple people
• Give admin access to users who don't need it
• Make system changes without documentation
• Allow inactive admin accounts to remain enabled

For Managers

✅ Do:

• Review team access permissions quarterly
• Create users with minimum required permissions
• Document role assignment decisions
• Train supervisors on proper access management
• Monitor unusual access patterns

❌ Don't:

• Assign Manager role to users who don't need it
• Create "power users" with excessive permissions
• Share login credentials among team members
• Ignore access requests from team members

For Supervisors

✅ Do:

• Ensure team members have appropriate access
• Report access issues promptly to managers
• Monitor team member activities
• Request permission changes through proper channels

❌ Don't:

• Grant access beyond your authority
• Share supervisor credentials with team members
• Bypass security procedures

For All Users

✅ Do:

• Protect login credentials
• Log out when leaving workstation
• Report suspicious activity immediately
• Request access changes through supervisor
• Use assigned permissions appropriately

❌ Don't:

• Share login credentials
• Attempt to access unauthorized areas
• Perform actions outside role responsibilities
• Leave system unattended while logged in

---

Governance & Compliance

Audit Trail

Gabnet 365 maintains comprehensive audit logs:

• User Actions: All create, update, delete operations logged
• Login Activity: Successful and failed login attempts tracked
• Permission Changes: Role assignments and modifications recorded
• Data Access: Sensitive data access logged
• System Changes: Configuration changes documented

Access Reviews

Recommended Schedule:

Compliance Considerations

• Data Protection: Role-based access supports GDPR, CCPA compliance
• Financial Controls: Separation of duties for financial transactions
• Audit Requirements: Complete audit trails for regulatory compliance
• Access Certification: Regular access reviews demonstrate due diligence
• Incident Response: Role-based access limits breach impact

---

Support & Questions

For Role Assignment Questions

Contact your department manager or HR department

For Permission Issues

Submit a support ticket or contact your supervisor

For System Access

Contact IT administrators at admin@gabnet360.com

---

Document Information

Version: 1.0
Last Updated: June 4, 2026
Next Review: February 26, 2026
Document Owner: Gabnet Enterprise IT Department
Classification: Internal Use - Management Level

---

← Back to Documentation Home