Team, roles & permissions
Logins vs employees, the built-in roles, custom roles, and own-only access.
Enterprise customers can also sign in with SSO and provision users via SCIM — memberships and roles stay the same model.
Team vs Employees
| Team | HR → Employees | |
|---|---|---|
| What | Login accounts and their roles | People records: contracts, leave, payroll, documents |
| Who manages | Administrator / Owner | HR |
| Link | A login may be linked to an employee for self-service | An employee may have no login at all |
Built-in roles
Profile menu → Roles & Permissions. Every company starts with:
| Role | What they can do |
|---|---|
| Owner | Everything |
| Administrator | Everything except ownership of the company |
| Member | Work in all licensed modules, no approvals |
| Viewer | Read-only (plus HR self-service) |
| HR Manager | Manage and approve HR, read master data, analytics |
| Sales Manager | Manage and approve Sales, see every agent's documents, read inventory |
| Sales Agent | Own quotations, orders, invoices and POS receipts |
| Procurement Manager | Manage and approve Procurement, read inventory |
| Field Technician | Execute assigned work orders, read assets, partners and products |
| Shop Floor Operator | Confirm production operations |
| Driver | Vehicles, routes and cargo manifests |
| Portal Client / Portal Supplier | Portal access only |
Custom roles
Create a role and tick permissions one by one. Each module lists its resources with read / create / update / delete, and where relevant approve, post or execute. A role can only grant permissions inside the modules your company is licensed for.
HR adds two field groups on top of employee access. View compensation and Edit compensation cover salary, bank account, and payslip amounts. View personal data and Edit personal data cover national ID, birth date, address, and documents. A role that can open Employees does not see those fields until the group is ticked. Existing roles that could already read or edit employees keep the matching group. The person can still open their own record.
Master Data adds field groups on Products, Partners, and Banks. A role can edit products without being able to change allow negative stock or costing / standard cost, and edit partners without changing credit hold / limit / group, discount / payment terms, or partner bank accounts. Company bank IBAN / account / write-off tolerance need Edit payment details. Sales pricing authority floors (agent max discount and margins) need Update pricing settings, separate from editing price lists. Existing roles that already had the matching product/partner/bank/price-list rights keep the new groups.
Own-only vs view-all
Sales roles without View all see only documents where they are the sales agent. Approvers always see what is waiting for them in My Approvals.
Segregation of Duties (SoD)
Profile menu → Access → Segregation of Duties (/security/sod). Companies get a default rule set of conflicting permission pairs (purchasing, sales, finance, inventory, POS, people, system) with risk levels high / medium / low. A newly created company starts with every default rule on. Any default rule an existing company is missing is added turned off, and owners and administrators get one notice in the bell. A rule the company already has is left as stored.
| Behaviour | High | Medium / low |
|---|---|---|
| Assigning roles or changing role permissions | Blocked unless an active mitigation exists | Warned — proceed only after acknowledgement |
| Mitigations | Reason, owner, expiry date, compensating control (e.g. second approver, periodic review). Expired mitigations become open violations again. | |
| Runtime | Nobody can approve or post a document they created, last edited, or submitted for approval. Stock counts add Post a stock count you started or counted (on by default): the person who started the count or entered a line cannot post it. Turn that rule off to allow it. A count with no starter and no counter is not blocked. Production orders add Settle a production order you confirmed or received (on by default, category manufacturing): the person who confirmed an operation or received output cannot settle that order. Release and confirm by the same person stay allowed. Turn the rule off to allow self-settle. A blank confirmer, receiver, or settler is not blocked. | |
| Report | Conflict report per person with filters and CSV export for auditors. |
Requires settings.sod.*. Rule changes, mitigations, and blocked assignments are audit-logged. Owner and Administrator roles are reported but not blocked on assignment (they inherently hold broad access).
Inviting people
Profile menu → Team → Invite: e-mail plus roles. The person receives a link, sets a password, and is in. Suspend or remove access from the same page.
Logins are global across companies. If someone already has an Uktupus account, add them only by invitation — they accept while signed in. You cannot attach their e-mail as a member and set a new password; that would take over their account in every company they belong to. Creating a team member with a password is only for a brand-new e-mail that has never signed up.
Role changes apply at next login
After you change someone's roles, ask them to log out and back in.