Roles

A role says in plain words what a person may do in Stabiso. Giving one sets three things at once:

• their rights: read, prepare drafts, post, approve, the audit trail and exports, and administration (an administrator holds every right);
• the areas of the app they open: the groups of the sidebar (General ledger, Sales, Purchasing, Bank and currency, Assets and tax, Close and group, Reports, Stock, Service);
• which customers, contacts and deals they see: all of them, their sales teams' or only their own (sales teams).

Open Settings → Roles (an administrator; or type "roles" in Tell me).

The ready-made roles

Each role on the Roles tab says what it can and cannot do in sentences, before you give it. A ready-made role is not changed: New role makes your own from one of them (a title, the rights, the areas and which sales records its people see). An own role is changed or removed there too; a role somebody has cannot be removed until they have another.

What an area does

A person whose role opens only some areas sees only those groups in the sidebar, and the API and the AI assistants refuse them the rest with "your role does not open …" (area_closed). Some things are everyone's whatever the role: Home, search, approvals, notifications, their own settings, and reading the customers, vendors, products, cost centres and exchange rates every form picks from. Changing those still needs the area they belong to. An area only narrows what the rights allow: a person with read alone posts nothing in any area.

Giving a role

On the People tab, Give a role on a person's row: choose the role and, when it approves, confirm the approver declaration as on Settings, Users. Their rights, their areas and the sales records they see change at once, with the audit trail (role.give). A person whose rights were later changed by hand is shown as differs from the role; giving the role again puts it back. Your own row has no Give a role: another administrator changes yours.

See it as a person

See it as on a person's row shows the app as they see it: their sidebar, what they can and cannot do, which sales records they see and until when their access runs. It changes nothing and does not sign you in as them.

Rights nobody uses

Stabiso counts which rights and areas each person (and each API key acting for them) uses, once a day. After 90 days the Unused rights tab suggests taking away what someone did not use in that time:

• a right they never used (posting, approving, the audit trail, administration);
• an area their role opens that they never opened, or, for someone who opens every area, only the areas they used;
• the end of their access when they used nothing and did not sign in.

A suggestion waits until the person has been watched for 90 days and was given nothing more in that time. Taking one away is one click and is in the audit trail like any change on Settings, Users or Roles. Your own administration and the organization's last administrator are never suggested away. Reading is never suggested away either.

For developers

• REST: GET /v1/roles/areas, GET and POST /v1/roles, PATCH and DELETE /v1/roles/{role_id}, GET /v1/roles/people, PUT /v1/roles/people/{user_id}, GET /v1/roles/people/{user_id}/preview, GET /v1/roles/me, GET /v1/roles/suggestions and POST /v1/roles/suggestions/{suggestion_id}/apply. All but the areas and me are an administrator's.
• MCP: list_roles, see_access_as and unused_rights (an administrator's key).
• GET /v1/me gives the caller's areas (null: every area). An operation lies in the areas of its tags; an MCP tool in those of the REST operations it mirrors. A refusal is a 403 with code: area_closed and the area in details.area.
• The module is roles (ADR-0110); its tables are access_role, person_role and right_use.