Back to Getting Started

Getting Started

Easedesk roles & permissions — RBAC explained

Easedesk ships with 7 predefined roles (Admin, Accountant, HR Manager, Sales Manager, Sales Rep, Inventory Manager, Viewer). Each maps to module-level permissions you can customise.

5 min read·Updated 2026-06-30

Quick answer

Easedesk's role-based access control (RBAC) controls who can do what. There are 9 predefined roles + the Owner. Each role is a bundle of permissions across 46 modules × 6 actions (view/create/edit/delete/approve/export). You can edit any predefined role or create new custom roles.

The Owner role

The Owner is created automatically at signup. It has wildcard permissions across all modules. There can be only one Owner — you can transfer ownership in Settings → Account → Transfer Ownership.

Predefined roles

These are seeded into your workspace by the base pack:

  • Admin — all operations except billing/owner-transfer
  • Accountant — books, GST, TDS, expenses, banking
  • HR Manager — HR, payroll, attendance, recruitment, performance
  • Sales Manager — full sales pipeline + CRM
  • Sales Rep — create leads/quotes/orders (no delete/approve)
  • Inventory Manager — stock, procurement, GRN, transfers
  • Viewer — read-only across enabled modules

Industry roles

Industry packs add domain-specific roles: Production Supervisor and QC Inspector for Manufacturing; Cashier and Store Manager for Retail; Front Office for Hospitality; Site Engineer for Construction.

Custom roles

Create your own role from Settings → Users & Roles → Roles tab → New Role. Pick a name, then check the specific module.action permissions to grant.

Department scoping

A user's access can be further restricted to specific departments. Set this in the user profile — list views then filter to records owned by those departments only.

Frequently asked questions

Can I edit a predefined role?
Yes. Predefined roles can have their permissions edited, but they cannot be deleted (so you don't accidentally lock yourself out).
How is access enforced?
Permissions are checked server-side on every API call. The UI hides actions you can't perform, but the security boundary is at the server.
What is 'department scope'?
A flag on the role: 'all' (no filter), 'assigned' (only user's allowed departments), or 'own' (only their own employee department).
rbacrolespermissionssecurityadmin

Related articles

Still have questions?

Use the AI Assistant inside Easedesk (it has access to your data), or reach our team.

Contact support

Command Palette

Search for a command to run...