Organisation roles and permissions
Everyone who works inside an Organization is given an organisation role. The role decides what that person can see and do in that organisation's books — from creating invoices to changing accounting settings. These roles are enforced: if your role doesn't include an action, Sales Scribe stops you — it isn't only hidden from the menu.
Organisation roles are separate from billing-account roles, which control the subscription, payment method and who belongs to the account. A person can have a different organisation role in each organisation they can access.
How roles work
A role is a bundle of permissions — the individual things you're allowed to do, grouped by area (customers, sales invoices, credit notes, payments, purchases, accounting, reports, and organisation settings). Sales Scribe checks your permissions on the server for every action, so:
- buttons and menu items you can't use are hidden, and
- even if you reach a restricted action another way, it is refused — you'll see an "access denied" page naming the permission your role doesn't include. Ask an administrator of the organisation if you need it.
Some roles are also limited to your own records rather than everyone's — see Your own records vs the whole organisation below.
The organisation roles
There are six roles, from most to least access.
Owner
Full control of the organisation. An Owner can do everything, including changing organisation settings and branding and managing people and their roles. Only an Owner can give someone the Owner role or change or remove another Owner, and an organisation always keeps at least one Owner.
Administrator
Full operational and administrative access — the same day-to-day powers as an Owner, including settings, branding and managing users and roles. The only things reserved for an Owner are the Owner-level controls above (assigning or removing an Owner).
Finance
Full access to the finances — sales, purchases, payments, accounting, the chart of accounts, tax handling and all reports, plus the audit history. A Finance user cannot administer the organisation itself: no changing organisation settings or branding, and no managing users or roles.
Accountant / Bookkeeper
For the person who keeps the books. Full access to customer payments, purchases and suppliers, sales invoices and credit notes, the chart of accounts and all reports. An Accountant cannot raise quotes, estimates or proforma invoices, change accounting settings or tax rates, create or edit products, or administer the organisation.
Sales
For salespeople. Can manage their own customers, quotes, estimates, proforma invoices and sales invoices (create, edit, issue and email), and can see products and their own sales reports. A Sales user cannot void or write off invoices, handle credit notes, record payments, touch purchases or accounting, or see other people's records.
Read-only
View-only access, for auditors, advisers or anyone who should look but not touch. A Read-only user can view records, reports and the audit history, but cannot create, edit or delete anything — and cannot see sensitive figures such as product cost and margin.
What each role can do — at a glance
| Can they… | Owner | Administrator | Finance | Accountant | Sales | Read-only |
|---|---|---|---|---|---|---|
| View records and reports | ✓ | ✓ | ✓ | ✓ | Own | ✓ |
| Create & issue sales invoices | ✓ | ✓ | ✓ | ✓ | Own | — |
| Void / write off an invoice | ✓ | ✓ | ✓ | ✓ | — | — |
| Quotes / estimates / proforma | ✓ | ✓ | ✓ | — | Own | — |
| Create & manage credit notes | ✓ | ✓ | ✓ | ✓ | — | — |
| Record & allocate payments | ✓ | ✓ | ✓ | ✓ | — | — |
| Purchases & suppliers | ✓ | ✓ | ✓ | ✓ | — | — |
| See product cost & margin | ✓ | ✓ | ✓ | ✓ | — | — |
| Accounting settings & tax rates | ✓ | ✓ | ✓ | — | — | — |
| See financial reports | ✓ | ✓ | ✓ | ✓ | — | ✓ |
| Organisation settings & branding | ✓ | ✓ | — | — | — | — |
| Manage users & roles | ✓ | ✓ | — | — | — | — |
| Assign / remove an Owner | ✓ | — | — | — | — | — |
"Own" means the person's own records only — see below. A blank means the action is not available to that role (though they may still be able to view the item if their role includes viewing).
Your own records vs the whole organisation
Most roles work across all of the organisation's records. The Sales role is different: it is limited to the records that person created. A salesperson sees and can open their own customers, quotes and invoices, but not those raised by colleagues. This keeps a sales team's work separate while everyone shares one organisation.
When your role doesn't allow something
You'll see the Access denied page, or a message in the window you're working in. It says which of these it is:
- Your role in this organisation is view-only. A Read-only role can look at everything it's allowed to see, but can't make any change. An Owner or Administrator (anyone who can manage the organisation's users) can change your role.
- Your role allows that only for records you created. Your role, such as Sales, reaches only your own records, and someone else created this one. Ask whoever created it, or an Owner or Administrator.
- This needs the permission "…". Your role doesn't include that action at all. An Owner or Administrator can give you a role that does.
Who can change roles, and the safety rules
Assigning roles is itself a permission — held by Owner and Administrator (and by a billing-account Owner/Admin, see below). A few rules keep things safe and prevent lock-outs:
- You can't grant more than you have. You can only give someone a role whose access is within your own.
- Only an Owner can create an Owner, or change or remove another Owner.
- The last Owner is protected — an organisation always keeps at least one.
- Every role change is recorded in the audit history.
Where roles are set
- When you invite someone — the invitation includes an organisation-role picker for each organisation you grant them. New members default to Read-only unless you choose otherwise, so nobody starts with more access than intended.
- Afterwards — an Owner or Administrator changes a member's role on Settings → Members & roles. (Granting or removing organisation access is done from the billing account's members page; the role itself is set here.)
See Manage members and their access.
Billing-account managers can administer roles too
A billing-account Owner or Admin can also manage an organisation's users and roles, and may assign any role, including Owner. This is deliberate: because they decide who is added to the account, they must be able to set people's roles and, if an organisation is ever left with nobody who can administer it, recover it. This bridge covers user and role administration only — it does not by itself give a billing manager the day-to-day operational access (creating or voiding documents, and so on) unless they also hold an organisation role that grants it. See Billing-account roles.
Choosing a role
- Owner / Administrator — people who run the organisation, including its settings, branding and members.
- Finance — a finance manager who needs everything financial but shouldn't administer the organisation.
- Accountant / Bookkeeper — an internal or external bookkeeper doing the day-to-day accounts.
- Sales — salespeople who should work with their own customers and sales documents only.
- Read-only — auditors, advisers or anyone who should look but not change anything.
As a rule of thumb, give each person the least access they need to do their job.