Roles and Permissions
Roles and permissions control what users can do in Rona ERP. Role-based access control (RBAC) ensures users only have access to the features they need — following the principle of least privilege.
Key concepts
- Roles group permissions together
- Users can have multiple roles
- Permissions are granular actions (read, create, update, delete)
- Permissions are module-specific (e.g., inventory.item.read)
- Follow the principle of least privilege
- Custom roles can be created for specific needs
Default roles
Admin
Full access to all features and system settings. Can create users, manage roles, and configure organization settings. Limit to trusted personnel.
Manager
Full access to operational features but no system administration. Can manage day-to-day operations but cannot change system configuration or user access.
Operator
Limited to specific operational tasks. Can perform day-to-day work but cannot make strategic decisions or access sensitive data.
Viewer
Read-only access to most features. Can view data and reports but cannot make changes — useful for auditors, executives, or external stakeholders.
Permission structure
module.entity.action module → which module (inventory, sales, manufacturing, ...) entity → which entity (item, order, batch, ...) action → what action (read, create, update, delete)
inventory.item.read View items inventory.item.create Create new items inventory.item.update Modify existing items inventory.item.delete Delete items sales.order.read View sales orders sales.order.create Create sales orders manufacturing.batch.read View production batches finance.invoice.issue Issue invoices
Custom roles
Create custom roles with specific permission combinations when default roles do not fit — department-specific roles, external partners with limited access, or compliance-driven permission sets.
| Quality module | Full permissions (read, create, update, delete) |
| Inventory module | Read-only — to view lot status |
| Manufacturing module | Read-only — to view batch status |
| Other modules | No access |
Assigning roles
- Assign the minimum roles needed for the job
- Review role assignments regularly
- Remove roles when job responsibilities change
- Document role assignment rationale
- Avoid role proliferation (too many custom roles)
Principle of least privilege
Permission enforcement
| Frontend UI | Buttons and forms hidden based on permissions |
| Backend API | Controllers check permissions before executing |
| Database | Row-level security (RLS) enforces tenant isolation |
Auditing role changes
| Role lifecycle | Role creation and modification |
| Permissions | Permission assignment to roles |
| Assignment | Role assignment to users |
| Removal | Role removal from users |
| Accountability | Who made the change and when |
Organization settings
Branding, currency, VAT, branches, and platform configuration.