Custom Roles — SanadiqCloud

Product version: 1.0.0+1
Last updated: 2026-08-03
Audience: Tenant Owners and users with role:create / role:update / role:delete

A. Why Custom Roles?

Built-in roles cover common patterns. Custom roles let you grant exactly the permission set a function needs (warehouse clerk, finance reader, etc.).

B. Navigation

1. Side rail Team → Roles (/settings/users-roles).
2. Search the roles table; open a row for detail.
3. Create opens /settings/users-roles/form.

Custom roles are always organization-scoped. Built-in system roles cannot be renamed, deleted, or permission-edited from this UI.

C. Creating a Role

Form fields

Save succeeds with pop(true) so the list can refresh.

Permissions

Permissions are edited on role detail (/settings/users-roles/:id) via the permission editor (catalog keys such as product:read, inventory:warehouse:update, tenant:user:create, role:assign, …). Toggle the CRUD-style matrix for domains your catalog exposes, then save.

Exact permission keys follow the live permission catalog in the app — use the editor as source of truth.

D. Editing / Deleting

1. Open role detail.
2. Update name/description/permissions as allowed.
3. Delete (danger zone) confirms, then returns success to the list.

Deleting a role removes that permission set from users who only had that role.

E. Assigning the Role

After create, assign from Team > Members → Assign role. See Assigning Roles.

F. Best Practices

Example: warehouse-heavy custom role

There is no built-in Engineering Manager role. Create a custom role and grant the Warehouse tab plus day-to-day inventory reads, without billing or warehouse delete:

Toggling Inventory (all areas) → Read in the editor grants every inventory:*:read key, including Warehouses. That is the supported way to give a custom role Warehouse view without listing each area. It does not grant create/update/delete.

Related: Overview | Built-in Roles | Assigning Roles