Users, roles and permissions
You will be able to: Explain users, roles and permissions and how they combine; Name the standard roles and the extra limits on a user; Apply least privilege and separation of duties.
- Read not done yet
- Watched not done yet
- Self-check: not taken not done yet
- Lesson complete not done yet
A user is one sign-in. A role is a named bundle of permissions, such as Sales or Cashier. You give each user one or more roles, and the person may do everything their roles allow. This is called role-based access. Settings ▸ Users & Permissions (the Security Console) is where you manage it.
Show transcript
1. Open Settings, then Users & Permissions 2. The Users tab lists everyone who can sign in 3. Open the Roles tab: four system roles 4. Open the Accountant role to see its permissions 5. Scroll the permission table 6. Back on Users, press + New User to add a person 7. Lockouts and Sessions tabs show who is blocked or signed in
The permission table
A role's page shows a table: a row for each module and a column for each action (View, Create, Submit, Amend, Cancel, Print, Export, plus More for module-specific ones). Tick what the role may do. If people already hold a role and you remove permissions, Zeyto asks you to confirm.
| Standard role | What it is for |
|---|---|
| Admin | Can do everything and ignores the permission list. Keep very few. |
| Sales | Creates, submits and prints sales documents, sees items and stock, views reports. Cannot amend, cancel or export. |
| Cashier | Works the POS till and can look up sales documents and items. |
| Accountant | Accounting, VAT, Reports and Purchase in full, and can view Sales. |
The four standard roles keep their names, but their permissions can be changed, and you can make your own roles or press Clone role to start from a copy.
Extra limits on one person
- Branch limits: untick All branches and tick the branches the person may work in. Documents, POS and reports are then limited. Admin is never limited.
- Can see cost fields: without it, cost prices are hidden.
- Can edit rate / price: without it, a line whose rate differs from the item rate is refused.
- Can override credit limits: lets the person confirm a warning instead of meeting a hard stop.
- Max discount %: the largest line discount the person may give.
Hiding single fields and reports
The Form FLS tab hides or locks a line field (for example Rate / Price or Discount %) for chosen roles on sales, purchase or POS forms. The Report access tab closes a report, or a whole group of reports, to a role; those reports disappear from the list and are refused by Zeyto itself.
Rules to remember
- Users are never deleted. Set Status to Inactive to stop someone signing in; history stays.
- Zeyto refuses to deactivate, lock or remove the Admin role from the last active administrator.
- A button your role may not use can still be pressed; Zeyto then refuses and names the missing permission.
- A menu item tagged Add-on means the module is not in your licence, which is separate from your role.
Try it in the demo
- Open Settings ▸ Users & Permissions and look at the tabs across the top.
- On the Roles tab, click Accountant and read the permission table. Close it without saving.
- On the Security Map tab, pick any screen in the Form / Menu Access Catalogue and see which licence module and permission it needs.
Public demo company, sign in as admin / demoAdmin123. Data refreshes nightly.
- A user holds roles; roles hold permissions.
- Limit people by branch, cost visibility, price, discount and credit override.
- Users are set Inactive, never deleted; the last Admin is protected.
- Least privilege and separation of duties are the goals.
Check yourself
4 questions on this lesson. Not timed, not the exam, and you can try again. Score 60% or more, and read the lesson, to complete it.
1. What is a role in Zeyto?
2. The last active Admin user can be deactivated whenever you like.
3. How do you hide item cost prices from one particular person without changing their role?
4. Which are controls Zeyto offers to limit what a user can see or do?
Select all that apply.