Users, roles and security policy
You will be able to: Create a user with the right roles and branch limits; Build a role and hide or lock sensitive fields; Set the sign-in rules and handle lockouts and sessions.
- Read not done yet
- Self-check: not taken not done yet
- Lesson complete not done yet
A user is one sign-in. A role is a named bundle of permissions, such as Sales, Cashier or Accountant. A person can hold several roles and may do whatever their roles allow. The Admin role does everything and ignores the permission list, so give it to as few people as possible. Zeyto always keeps at least one active Admin.
Adding a user
- Open Settings ▸ Users & Permissions and press + New User.
- Type the Username (no spaces), Full Name and a Password that meets the Security Policy.
- Tick the roles. Zeyto pre-ticks Sales for a new user; untick it if wrong.
- Optionally limit Branches, set a POS PIN, then press Save.
Users are never deleted. Set Status to Inactive to stop someone signing in; their documents and history stay. You cannot make yourself inactive.
Personal limits on a user
- Can see cost fields: without it, cost figures are hidden.
- Can edit rate / price: without it, a line whose rate differs from the item rate is refused.
- Can override credit limits: lets the person confirm a warning instead of being hard-stopped.
- Max discount %: the largest line discount they may give.
Roles and field-level locks
On the Roles tab, tick permissions in the table: a row is a module, a column is an action (View, Create, Submit, Amend, Cancel, Print, Export), and More holds module-specific keys. Clone role starts a new role from a copy. The four built-in roles keep their names but their permissions can change. Form FLS hides, masks or locks a line field such as Rate / Price for chosen roles, and Zeyto checks the rule every time a document is saved. Report access closes whole report groups or single reports for a role.
Security Policy
| Setting | Range | Shipped |
|---|---|---|
| Minimum password length | 6 to 64 | 8 |
| Require a digit | on or off | on |
| Failures before lockout | 3 to 50 | 5 |
| Counting window (minutes) | 1 to 1440 | 10 |
| Lockout duration (minutes) | 1 to 1440 | 15 |
| POS PIN length (digits) | 4 to 8 | 4 |
A change never locks anyone out: existing passwords keep working and the stricter rule is checked the next time one is set. The policy covers the whole installation, not one company.
Lockouts and sessions
- Lockouts tab: Unlock clears the wrong-attempt count and any administrator lock. Lock stops a login at once, signs it out everywhere, and cannot be used on yourself or the last Admin.
- Sessions tab: sign out one session or everyone else, which frees seats immediately. Use it before a restore or an update.
- Sign-in activity: the latest 500 sign-in events with the address they came from.
- Setting a new password or making someone Inactive signs them out on every device within a few minutes.
Try it in the demo
- In the demo open Settings ▸ Users & Permissions and open a user (look only).
- Open the Roles tab and use Show only enabled on a role to see what it grants.
- Open Settings ▸ Security Policy and read the sentence under the lockout boxes.
Public demo company, sign in as admin / demoAdmin123. Data refreshes nightly.
- Users are never deleted; set them Inactive.
- Roles bundle permissions; Admin ignores them, so keep it rare.
- Form FLS and personal limits hide cost, lock rate and cap discounts.
- Security Policy sets password, lockout and PIN rules for the whole installation.
Check yourself
4 questions on this lesson. Not timed, not the exam, and you can try again. Score 60% or more, and read the lesson, to complete it.