Roles and permissions¶

What each kind of user may do. Your role decides which menu items you see and which buttons work. If a menu item or button is missing, your role does not include it; this is not a fault. See Frequently asked questions.

Control Tower¶

How it works¶

In the Control Tower, a role is a named bundle of permissions, and each person holds exactly one role. A permission is a kind of record plus an action on it, for example "View Order" or "Create Depot". Your organization's administrator manages roles on Roles & permissions and assigns them on Users.

Actions you may see: Create, View, Update, Delete, Accept and Execute. Not every action exists for every record.

Record	Actions available
Depot, Driver, Contract, Planning Intelligence Profile, User, Role	Create, View, Update, Delete
Vehicle	Create, Update, Delete
Customer	Create, Update, View
Order, Order Batch	Create, View, Delete
Validation Exception	Accept
Planner	View, Execute
Dispatch Plan	Create
Dispatch	View, Update
Control Tower	View

The two built-in roles¶

Every organization has two built-in roles. Neither can be renamed, edited or deleted, and their permissions cannot be changed.

Administrator holds every permission. When a new permission is introduced, Administrator receives it automatically. The person who sets up the organization is given this role.
Basic User Access holds every View permission and nothing else. When a new View permission is introduced, it receives it automatically.

Other roles are created by your organization and can be edited.

What is enforced today¶

The Users and Roles & permissions screens check your role. Without the matching permission the action is refused with a message such as "Your role (...) cannot do this (...)".
Rules that always apply: a person has one role; an email address is used by one person and cannot be changed; the organization must always keep at least one active Administrator; a role cannot be deleted while people hold it.
Deactivating a person only switches off their access to this application. Their sign-in account is untouched.
The other Control Tower screens (Live map, Finance, Billing, Contracts, Fleet and so on) do not show a role gate on screen. Your organization may still limit what you see; ask your administrator if something is missing.

You want to...	You need
See the Users list	View User
Add a user, or resend an invitation	Create User
Edit, activate, deactivate or revoke a user	Update User
See the Roles list	View Role (or any user permission)
Create a role	Create Role
Change a role's name or permissions	Update Role
Delete a role	Delete Role

Customer Portal¶

Customer Portal users hold one of four roles for each customer they can open. The same person can hold different roles for different customers. See Switching organisation or customer.

Role	In one line
Customer Administrator	Full access, including managing users and roles.
Customer Requester	Places and manages transport orders, and tracks them.
Site Manager	Runs the receiving site: delivery windows, dock capacity and equipment.
Finance Viewer	Views invoices, statements and order values. Cannot place or schedule.

Who can do what¶

Action	Administrator	Requester	Site Manager	Finance Viewer
See the Dashboard	Yes	Yes	Yes	Yes
View orders and deliveries	Yes	Yes	Yes	Yes
Place, edit, submit and cancel orders	Yes	Yes	No	No
Decide slot approvals on deliveries	Yes	Yes	No	No
Track shipments on the live map	Yes	Yes	Yes	No
View documents and proof of delivery	Yes	Yes	Yes	Yes
View bills and invoices	Yes	No	No	Yes
Approve or reject delivery windows, accept or decline alternatives	Yes	No	Yes	No
Confirm equipment is ready, block dock capacity	Yes	No	Yes	No
View facilities, docks and equipment	Yes	Yes (read only)	Yes	No
Manage facilities, docks, equipment and availability	Yes	No	Yes	No
Manage saved locations	Yes	Yes	No	No
Add and manage users and roles	Yes	No	No	No

Menu item	Administrator	Requester	Site Manager	Finance Viewer
Dashboard	Yes	Yes	Yes	Yes
Orders	Yes	Yes	Yes	Yes
Deliveries	Yes	Yes	Yes	Yes
Bills & invoices	Yes	No	No	Yes
Dock board	Yes	No	Yes	No
Window requests	Yes	No	Yes	No
Facilities, docks & MHE	Yes	Yes	Yes	No
Saved locations	Yes	Yes	No	No
Users and Roles & permissions	Yes	No	No	No

Every customer also has a built-in Basic User Access role. It can view orders, deliveries, tracking, documents, bills, delivery windows and facilities, but cannot place, change, approve or manage anything. Like Administrator it is fixed: it cannot be renamed, changed or deleted.

Good to know:

The role chip at the top right of the portal shows your role name for the customer you have selected.
The built-in Administrator role cannot be changed or deleted. A customer always keeps at least one active administrator.
On the Roles screen you can create roles with your own names, but the portal's menus follow the four standard roles by name. A role with a different name does not unlock any of the screens above.
Dashboard cards about delivery windows (such as Windows awaiting my approval) show only for Administrators and Site Managers.

Admin portal¶

The Admin portal is for platform administrators only. There are no further roles inside it: anyone who may use it can do everything on its screens.

A person appears in Platform admins after their first sign-in. Access itself is granted in the sign-in service, not in the portal.
A platform administrator can be set Inactive on that screen, which switches off their access to the Admin portal.
The first administrator of a customer organization is not a platform administrator. They sign in to that organization's Control Tower, not the Admin portal. See Organization admins.

Driver app¶

Drivers have no roles. A driver signs in to the driver app with their own account for their organization and sees only their own trips, stops, shift and messages. See Signing in.