Roles and permissions

Overview

Access in Arthiva is granted per module, per action. A user's effective access is the union of the roles they hold and their direct grants, limited to the modules your organization is entitled to. Permissions live in Settings → User Management; SSO never changes them.

The permission matrix

Wherever you set access — inviting, editing a user, or defining a role — you'll see the same matrix: one section per module, with independent per-action checkboxes. For example, Logistics splits into Create, Edit, View, Cancel, Ship, Receive, Inspect, Refund, and Repair, and Purchasing separates viewing and editing orders, raising requisitions, recording deliveries, quality inspection, invoice capture and clearing, and viewing versus managing budgets.

• Actions are independent. Someone who can Receive a return can't necessarily Inspect or Refund one — grant exactly what the job needs. If you grant an action without View, the app nudges you to add View too, so the user can open what they act on.
• Admin (full module access) at the top of each module section grants every action in that module — and nothing outside it.
• Org admin (full access) grants everything below plus user and workspace management. Org admin is the only way to get those management powers; no module grant confers them.

Reusable roles

The Roles tab holds reusable permission bundles — define "Returns Agent" or "Warehouse Operator" once, then assign it to any number of teammates. Create one with New role: name it, describe it, and tick its permissions.

• Roles union with a user's direct grants; removing a role removes only what the role contributed.
• Changing a role's permissions, adding or removing members, and deleting a role all require a written reason, and every change is audited. Deleting a role asks you to type its name to confirm.

Changing a user's access

Open Edit user on any row. When you change roles, grants, or the org-admin switch, the Access change notes field becomes required — say why the access is changing; it goes into the audit history. You can't edit your own access, and platform (Arthiva) staff can't be edited from here.