Built-in Roles — SanadiqCloud

Product version: 1.0.0+1
Last updated: 2026-10-07
Audience: Tenant Owners, Tenant Employees

A. Overview

SanadiqCloud separates account type (identity tier for your user) from business roles (tenant-scoped permissions inside an organization).

Every new organization starts with ten built-in business roles. They are created once, when the organization is created, so you don't have to build common roles from scratch. Only Owner is locked. The other nine are starter roles: you can rename them, change their permissions, or delete them like any custom role, and SanadiqCloud never changes or recreates them afterwards.

The sections below describe each role's starting permissions. Once you edit a starter role, your version applies.

New permissions in later releases are added to Owner automatically. Starter roles keep the permissions you gave them; grant new ones yourself when you want a role to use a new feature.

Older organizations: roles created before this change (including a retired Operator role, or legacy Manager / Employee roles) are now editable too and keep their current permissions until you change them. New starter roles such as Warehouse Clerk are not added to existing organizations; create them as custom roles if you need them.

B. Dual model: account type vs business roles

• Tenant owner account (account_type=tenant_owner) carries membership and ownership actions: invite/remove users, create/edit/delete custom roles, assign roles, and related ownership grants. That capability is not duplicated fully by the Owner business role alone.
• Business roles grant module permissions (product, inventory, sales, finance, billing, media, notification, settings). Assign exactly one business role to each member for operational access.
• The Owner business role is auto-assigned to the organization creator (via auth after TenantCreatedEvent) and is the only role with is_owner=true. It is the only built-in role that cannot be edited, deleted, or assigned to another member.

C. Owner

Full control of organization operations, settings, and business modules.

Permissions (business role)

• Full CRUD on product, inventory, sales, finance, billing, media, and notification.
• tenant:settings:read / tenant:settings:update
• tenant:admin

Membership / ownership

Invite, suspend, remove members and manage custom roles remain with the tenant owner account type, not solely this business role.

Owner-only permission

support:access:approve — approve, reject and revoke support access requests from SanadiqCloud staff. It is not part of Administrator or any other built-in role and cannot be added to a custom role.

D. Administrator

Manages daily operations and organization settings. Membership and ownership actions remain with the tenant owner account.

Permissions

• Full CRUD on product, inventory, sales, finance, media, and notification.
• Billing: read / create / update (no delete).
• tenant:settings:read / tenant:settings:update
• tenant:admin

Cannot do (by design)

• Delete billing records.
• Act as the account-type owner for membership unless the user also has tenant_owner account type.
• Approve support access requests (support:access:approve is Owner only).

E. Inventory Manager

Responsible for inventory operations, stock levels, warehouses, and inventory workflows.

Permissions

• Full product + inventory categories.
• Media: read + create only.

F. Sales Manager

Responsible for customers, sales (draft → confirm), sales invoices, and sales reporting permissions.

Permissions

• Full sales category.
• Product and inventory: read only.
• Media: read + create.

G. Finance Manager

Responsible for the tenant Finance ledger (accounts, journals, periods, cash, expenses, reports, posting status). Does not manage SaaS Billing or Sales operations.

Permissions

• Full finance:* set used by Finance Core (account / journal / period / cash / expense / report / posting as seeded).
• Does not grant billing:* or sales write permissions.

H. Warehouse Clerk

Handles daily warehouse work: counts, transfers, pick lists, and stock requests.

Permissions

• Read warehouses, bin types, physical locations, stock pools, stock items, stock movements, and customer returns.
• Adjustments and counts: read + create (lines can be entered when the adjustment is created).
• Transfers: read + create + update (ship and receive).
• Pick lists: read + create + update (through completion and issue).
• Requisitions: read + create.
• Product: read only. Support: operational.

Cannot do (by design)

• Submit, approve, or reject adjustments and counts, or record count lines on an open count — the Inventory Manager does this.
• Submit, approve, or reject requisitions.
• Create, edit, or delete warehouses, bin types, stock pools, or suppliers.
• Set stock directly, add stock items, or create or reverse manual stock movements.
• Receive, inspect, or restock customer returns.
• See inventory statistics and valuation, or use finance or sales.

Note: shipping and receiving a transfer uses the same permission as approving, reversing, and cancelling it, so a Warehouse Clerk can do all of these on transfers. The same permission also lets them receive loads into and unload any representative's stock pool.

I. Sales Clerk

Serves customers at the counter: records and confirms sales and collects invoice payments.

Permissions

• Customers: read, create, update.
• Sales: read, create, update (edit drafts, confirm, cancel).
• Invoices: read + update (record payments).
• Inventory: read stock pools, stock items, physical locations, and pick lists (to build sales and follow fulfillment).
• Product: read only. Support: operational.

Cannot do (by design)

• Delete sales or customers.
• Process returns.
• See sales statistics.
• Use finance.

Note: recording a payment on an invoice uses the same permission as reversing a payment, recording a refund, and voiding an invoice, so a Sales Clerk can also do these. Use Sales Manager rights if this must be limited to managers.

J. Sales Representative

Sells from the stock in their own custody and hands collected cash to finance. Sees only their own records. See Sales representatives.

Permissions

• sales:sale:own — own sales, own invoices (read and collect payment), customer search.
• sales:customer:create.
• inventory:custody:read / inventory:custody:update — own custody stock.
• finance:custody:read / finance:custody:settle — own custody cash and settlements.
• Product: read only. Support: operational.

Cannot do (by design)

• See the organization's customer list, invoices, other stock pools, or the finance ledger.
• Void invoices, refund, reverse payments, or confirm their own cash settlement.

K. Accountant

Records journals and expenses, submits e-invoices, and reads financial reports.

Permissions

• Read: chart of accounts, journals, fiscal years and periods, cash and bank accounts, expenses, financial reports, posting status, e-invoice submissions, and all cash custody books and settlements.
• Create and post journals (including other revenue and opening balance replacement).
• Record expenses.
• Submit invoices to the tax authority.
• Support: operational.

Cannot do (by design)

• Create or edit accounts in the chart of accounts.
• Close or reopen fiscal years and periods, or bootstrap finance setup.
• Create cash accounts, edit payment method mappings, or transfer cash between accounts.
• Configure the e-invoicing profile and credentials.
• Confirm or reject cash settlements.

L. Viewer

Read-only access to products, inventory, sales, finance, and media.

Permissions

• Read-only access to the product catalog, inventory (including statistics and valuation), customers, sales, invoices, returns, sales statistics, the finance ledger and reports, cash settlements, and the media library.

Cannot do (by design)

• Create, change, approve, or delete anything.
• Open or reply to support cases.
• See settings or billing.

M. Comparison summary

Next: Custom Roles — create roles with exactly the permissions you need.

Related: Assigning Roles | Roles & Permissions Overview