Docs/Roles Permissions/Built-in Roles — SanadiqCloud

Built-in Roles — SanadiqCloud

Product version: 1.0.0+1
Last updated: 2026-08-03
Audience: Tenant Owners, Tenant Employees

A. Overview

SanadiqCloud separates account type (identity tier for your user) from business roles (tenant-scoped permissions inside an organization).

Layer What it controls Examples
Account type Membership / ownership capabilities for organization users tenant_owner, tenant_employee
Business role Day-to-day module access inside an organization Owner, Administrator, Inventory Manager, …

Every organization is seeded with six built-in business roles. These roles are system-owned: they cannot be renamed, deleted, or permission-edited by organization accounts. You can assign them as-is or combine them with custom roles.

Role (DB name) Display Can be deleted?
Owner Tenant Owner No
Administrator Administrator No
Inventory Manager Inventory Manager No
Sales Manager Sales Manager No
Finance Manager Finance Manager No
Operator Operator No

Legacy rename: older tenants may still have Manager / Employee. On sync, those are renamed to Administrator / Operator when the new name is not already present.

B. Dual model: account type vs business roles

  • Tenant owner account (account_type=tenant_owner) carries membership and ownership actions: invite/remove users, create/edit/delete custom roles, assign roles, and related ownership grants. That capability is not duplicated fully by the Owner business role alone.
  • Business roles grant module permissions (product, inventory, sales, billing, media, notification, settings). Assign exactly one business role to each member for operational access.
  • The Owner business role is auto-assigned to the organization creator (via auth after TenantCreatedEvent) and is the only role with is_owner=true.

C. Owner

Full control of organization operations, settings, and business modules.

Permissions (business role)

  • Full CRUD on product, inventory, sales, billing, media, and notification.
  • tenant:settings:read / tenant:settings:update
  • tenant:admin

Membership / ownership

Invite, suspend, remove members and manage custom roles remain with the tenant owner account type, not solely this business role.

D. Administrator

Manages daily operations and organization settings. Membership and ownership actions remain with the tenant owner account.

Permissions

  • Full CRUD on product, inventory, sales, media, and notification.
  • Billing: read / create / update (no delete).
  • tenant:settings:read / tenant:settings:update
  • tenant:admin

Cannot do (by design)

  • Delete billing records.
  • Act as the account-type owner for membership unless the user also has tenant_owner account type.

E. Inventory Manager

Responsible for inventory operations, stock levels, warehouses, and inventory workflows.

Permissions

  • Full product + inventory categories.
  • Media: read + create only.

F. Sales Manager

Responsible for customers, sales (draft → confirm), sales invoices, and sales reporting permissions.

Permissions

  • Full sales category.
  • Product and inventory: read only.
  • Media: read + create.

G. Finance Manager

Responsible for billing, payments, and financial records within the organization.

Permissions

  • Billing: read / create / update (no delete).
  • Sales: read only (all sales:*:read).

H. Operator

Performs daily operational tasks with create and read access. No delete or administrative actions.

Permissions

  • Product, inventory, sales, media, notification: read + create only (no update, no delete).
  • No settings or tenant:admin.

I. Comparison summary

Area Owner Administrator Inventory Mgr Sales Mgr Finance Mgr Operator
Product Full Full Full Read — Read + create
Inventory Full Full Full Read — Read + create
Sales Full Full — Full Read Read + create
Billing Full No delete — — No delete —
Media Full Full Read + create Read + create — Read + create
Notification Full Full — — — Read + create
Settings R/W R/W — — — —
tenant:admin ✓ ✓ — — — —

Next: Custom Roles — create roles with exactly the permissions you need.

Related: Assigning Roles | Roles & Permissions Overview