> For the complete documentation index, see [llms.txt](https://hub.equipme.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hub.equipme.io/pro/administration/roles-and-permissions.md).

# Roles and permissions

Roles and permissions in Equipme Pro: provider roles for sales, portfolio, purchasing, warehouse, fulfillment, billing and automation, custom roles, permissions, portal roles.

**Path:** "Administration" → "Roles and rights"

With roles, you define which areas of Equipme Pro your employees can see and edit. The permissions of several roles add up; for example, you combine "Warehouse Manager" and "Fulfillment Operator" for a person in the warehouse.

Access: **"Administrator"** role.

The page has two tabs:

| Tab                    | Content                                                          |
| ---------------------- | ---------------------------------------------------------------- |
| **"Provider"**         | Roles within your provider company, i.e. for working in Pro      |
| **"Customer portals"** | Roles your employees receive in your customers' customer portals |

## "Provider" tab

"Configure user permissions within your provider entity by assigning roles to them. You can combine roles by assigning multiple roles to a user."

### System roles

| Role                           | Description (from the app)                                                                    | Typical menu items                                            |
| ------------------------------ | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
| **"Administrator"**            | Full access at the supplier level or to selected customers; can assign roles                  | all, incl. "Administration"                                   |
| **"Billing reader"**           | Access to customer billing                                                                    | "Sales" → "Billing"                                           |
| **"Account Manager"**          | Can access all customers, manage them and create new customers                                | "Sales" → "Customers"                                         |
| **"Sales"**                    | Can create new customers and manage them; no access to existing customers                     | "Sales" → "Customers"                                         |
| **"Reseller"**                 | Like "Sales", but with limited editing of customers and without prices                        | "Sales" → "Customers"                                         |
| **"Portfolio Manager"**        | Manages the provider's service offering                                                       | "Portfolio Management", "Administration" → "Integrations"     |
| **"Portfolio Controller"**     | Read access to the service offering                                                           | "Portfolio Management" (read-only)                            |
| **"Purchasing Manager"**       | Manages order proposals, purchase orders and financing agreements                             | "Purchasing"                                                  |
| **"Purchasing Controller"**    | Read access to purchase orders and financing agreements                                       | "Purchasing" (read-only)                                      |
| **"Warehouse Manager"**        | Books stock in, out and between locations and receives incoming goods                         | "Warehouse"                                                   |
| **"Warehouse controller"**     | Read access to warehouse and inventory                                                        | "Warehouse" (read-only)                                       |
| **"Fulfillment Manager"**      | Plans and processes customer orders independently of the processes defined in service mapping | "Fulfillment", "Operations" → "Service instances"             |
| **"Fulfillment Operator"**     | Processes customer orders according to the processes defined in service mapping               | "Fulfillment", "Operations" → "Service instances"             |
| **"Fulfillment Controller"**   | Read access to the items of customer orders                                                   | "Fulfillment" (read-only), "Operations" → "Service instances" |
| **"Automation Administrator"** | Full access to the automation module                                                          | "Automation"                                                  |
| **"Automation User"**          | Processes tasks that flows create for people                                                  | –                                                             |

{% hint style="info" %}
**Fulfillment Manager or Operator?** The "Fulfillment Operator" works strictly according to the process defined in service mapping. The "Fulfillment Manager" may deviate from it, e.g. skip required attributes, set a status despite a stored process, cancel orders or take over reservations of other orders. Assign the manager role selectively.
{% endhint %}

{% hint style="info" %}
"Picking", "Production" and "Shipping" in the "Fulfillment" menu only appear with write permissions in fulfillment (e.g. "Fulfillment Operator") and if your organization uses warehouse management, i.e. at least one warehouse has been created or you have access to the warehouse (e.g. as "Warehouse controller").
{% endhint %}

You cannot rename system roles. "Note: System roles may include additional permissions according to their description that cannot yet be viewed/configured via this view." For immutable system roles, editing individual permissions is disabled.

### Assigning users to a role

1. Click the role in the list.
2. **"User"** tab → **"Add"** → select users ("Select the users you want to add to the current role.") → save.

Use **"Delete"** to remove the role from the selected users. You can also assign roles directly when [creating a user](/pro/administration/users.md#creating-a-new-user).

{% hint style="warning" %}
A user without a role can no longer sign in to Pro. Before removing a role, check whether the user still has another one.
{% endhint %}

### Custom roles

If the system roles are not sufficient, you create your own roles:

1. **"New"** → **"Create role"** dialog with **"Name"** and **"Description"** → **"Save"**.
2. Open the role → **"Permissions"** tab → allow or deny individual permissions → **"Save"**.
3. **"User"** tab → add users.

You change the name and description via the pencil icon next to the role name. To delete several custom roles, select them in the list and click **"Delete"**; the assigned users then lose the permissions from these roles.

### Individual permissions

The **"Permissions"** tab of a role or user lists individual permissions with the columns **"Allowed"** and **"Denied"**. Particularly important for providers:

| Individual permission                  | Meaning                                                                                                                                                        |
| -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **"Confirm received customer orders"** | Can review and confirm received customer orders to release them for processing – prerequisite for the ["Order Inbox"](/pro/sales/order-reception.md) menu item |
| **"Manage customer settings"**         | Can turn individual customers' portal settings such as order authorization or premium features on and off; requires access to customer management              |

Depending on the configuration, further individual permissions appear, e.g. "Record service instances & inventory" or "Remove service instances & inventory".

{% hint style="warning" %}
**Deny beats allow.** If you deny a permission in a role, this applies to all users of that role – even if they are allowed the permission via another role.
{% endhint %}

## "Customer portals" tab

"Configure user permissions within your customer portals. For each permission, you can control which user is assigned the respective role in which customer."

This lets your employees work directly in a customer's customer portal – e.g. to order for a Hosted customer or prepare configurations. The following customer roles are available:

| Role                | Meaning in the customer portal                                                  |
| ------------------- | ------------------------------------------------------------------------------- |
| **"Controller"**    | Read-only access to selected customers                                          |
| **"Planner"**       | Read access to selected customers; can manage them, e.g. prepare configurations |
| **"Purchaser"**     | Can place orders on behalf of selected customers                                |
| **"Administrator"** | Full access to selected customers                                               |

1. Click the role.
2. **"Add"** → select users.
3. In the **"Clients"** column, select the customers in which the user receives the role.

Use **"Delete"** to remove the role from the selected users – "This also applies to these roles in all other customers".

What the roles allow in the customer portal in detail is described in the customer guide (see customer guide, "Roles and permissions").

### Automatic access to customer portals

Some provider roles automatically come with roles in the customer portals:

| Provider role               | Automatically in the customer portal                     |
| --------------------------- | -------------------------------------------------------- |
| **"Administrator"**         | "Administrator" in all existing and new customers        |
| **"Account Manager"**       | "Planner" in all existing and new customers              |
| **"Sales"**, **"Reseller"** | "Planner" in the customers the person created themselves |

## Frequently asked questions

**An employee doesn't see a menu item.**

They don't have the right role. Check in the [user details](/pro/administration/users.md#permissions) under "Permissions" which roles they have. Changes take effect after reloading the page.

**How do I give an employee access to a single customer only?**

Via the "Customer portals" tab: select a role, add the user and select only this customer in the "Clients" column. Don't give them a role such as "Administrator" or "Account Manager" that automatically applies to all customers.

**Why is the "Customer portals" tab empty?**

The roles only appear if your own role allows creating customers (e.g. "Administrator").

**Who can confirm customer orders?**

Anyone with the individual permission "Confirm received customer orders"; administrators always have it.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hub.equipme.io/pro/administration/roles-and-permissions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.