> For the complete documentation index, see [llms.txt](https://hub.equipme.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hub.equipme.io/dokumentation/settings/roles-and-permissions.md). # Roles and rights Managing roles and permissions: system roles, custom roles, assigning users, allowing or denying individual permissions, automatic supervisor role. **Path:** Settings → **"Roles and rights"** "Configure your employees' permissions by assigning them roles. You can combine roles by assigning multiple roles to an employee." The permissions of multiple roles add up. ## System roles | Role | Description | | ---------------------------------- | ----------------------------------------------------------------------------------- | | **"Administrator"** | Full access to the organization; may assign roles | | **"Controller"** | Read-only access to the entire organization | | **"Planner"** | May plan and prepare configurations, but not place orders | | **"Purchaser"** | May place orders with the supplier | | **"Location Manager (Planner)"** | May manage services for specific locations | | **"Location manager (purchaser)"** | May manage and order services for specific locations | | **"Team Manager"** | May view and approve order requests from all employees in their department | | **"Supervisor"** | Manages their employees, approves orders for their team and configures new services | | **"Portfolio Manager"** | Manages the internal service offering | | **"Business owner"** | Manages the services assigned to them in the inventory | | **"User"** | Sees their own profile and their own services (self-service) | | **"Automation Administrator"** | Only with the automation module (see [Automation](/dokumentation/automation.md)) | For an overview of which role gets which view, see [Roles and views](/dokumentation/getting-started/roles-and-views.md). ## Assigning users to a role 1. Click the role in the list. 2. Tab **"Users"** → **"Add"** → select users → **"Save"**. With "Delete" you remove users from the role. Changes take effect immediately; the user sees them after reloading the page. You can also assign roles when [creating an employee](/dokumentation/organization/employees.md#creating-an-employee). Some roles are assigned automatically: * **"Team Manager"**: anyone who receives the group role "Manager" in a group (not "Deputy Manager"), * **Location manager roles**: via the manager box on the [location](/dokumentation/organization/locations.md#location-managers-manager), * **"Supervisor"**: see below. ## Custom roles * **"New"**: enter "Name" and "Description". * Tab **"Permissions"**: set individual permissions to **"Allowed"** or **"Denied"** and save. * **"Delete"**: all assigned users lose the permissions from this role. System roles may contain additional permissions that are not shown here; some system roles cannot be changed. {% hint style="warning" %} **"Denied" always takes precedence.** A denied permission applies even if another role of the same user allows it. {% endhint %} ## Configurable individual permissions | Permission | Meaning | | -------------------------------------------------- | ---------------------------------------------------------------------------------------- | | **"Record service instances & inventory"** | Record existing stock without approval and order | | **"Remove service instances & inventory"** | Immediately write off active, self-provisioned services | | **"Access to employees for the location manager"** | Location managers may manage employees of their location and their services | | **"Restricted portfolio manager"** | Manages only services of their own organizational units | | **"Restricted fulfillment user"** | Processes only internal orders of their own organizational units | | **"Skip approval"** | May skip the approval when ordering (only with simple approval) | | **"Access to the entire marketplace"** | May request all Marketplace services, even without self-service release or matching tags | | **"Show prices and costs"** (role "User") | See prices and costs in self-service | | **"Manage home office"** (role "User") | Maintain their home office address in self-service themselves | ## Permissions of an individual employee Employee detail page → tab **"Permissions"**: shows all roles and permissions of the employee. There you can allow or deny individual permissions for that employee. You change permissions that come from roles via the role. ## Automatic supervisor role Role **"Supervisor"** → tab **"Settings"** → **"Automatically assign this role"**: * **On (default):** Anyone entered as supervisor for another employee, manually or via HR sync, automatically receives the role "Supervisor". * **Off:** The supervisor relationship remains saved (e.g. for approval), but the role is not assigned. ## Frequently asked questions **How do I prevent employees from seeing prices?** Role "User" → "Permissions" → set "Show prices and costs" to "Denied". **A user cannot sign in.** They have no role, are locked or were not invited. Check the "Permissions" and "Account" tabs on the employee. **Who may order?** Administrators, purchasers and "Location manager (purchaser)" (for their locations) may order. Visibility in the Marketplace does not mean permission to order. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hub.equipme.io/dokumentation/settings/roles-and-permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.