Access Roles - Users and access

The screen where you decide what each user group may do. You pick a level for each area of your business and choose whether the group sees all records or only its own. Before you save, the screen tells you in plain words what that allows.

When to use it

You created a new group in User Group Manager and it needs its access.
Someone can see or do too much, or too little.
You want to check exactly which screens a group can open.

Before you start

The group must exist, so create it in User Group Manager first. Only the workspace owner and administrators can change access.

Where to find it

Setup > User > Access Roles.

How the screen is laid out

The groups list on the left, with how many people are in each. The Owner group is shown but locked.
Access Levels: one row per area of your business, plus one row for the whole company.
- For an area: Requester (raises documents and sees only their own), User (enters and edits that area's documents) or Manager (reads and approves, but cannot create).
- For the whole company: Accountant (posts to the books), Controller (reverses and cancels postings) or Owner (everything).
- Records: All records, Own group's, or Own only.
- Quick picks such as Storekeeper, Store Manager, Purchase Officer and Accountant fill the rows for you.
- A preview under the rows says what the group will be able to do.
All Screens: every screen on the menu with this group's access, including the workflow steps it may take (approve, post, reverse). Here you can allow or deny one screen, or change which records it shows, with a note saying why.
People: who is in which group. You can also move a person to another group here.

Adding a record

Select the group on the left.
On Access Levels, pick a level on each row the group needs, or use a quick pick.
Choose Records.
Read the preview, then save.
If one screen needs to be different from what the levels give, open All Screens, allow or deny it with a note, and click Save exceptions.
On People, put the right people in the group.

Tips and common mistakes

The point is one level per area. A person cannot be both User and Manager in the same area, so nobody can raise a document and approve it themselves there. Across different areas it is possible, and the screen points it out.
Manager cannot create, on purpose. Give User on the area as well only if the same person should both enter and approve, and you accept that.
"Own only" records makes Events, Out of Office and My Reminders show each person their own rows. Without it, those screens show everyone's.
Exceptions on All Screens are kept until you save them, and saving replaces the whole set.