Roles & Permissions Overview — SanadiqCloud
Product version: 1.0.0+1
Last updated: 2026-08-03
Audience: Tenant Owners, Tenant Employees (with role permissions)
A. Model
User → Roles → Permissions → Feature access
Effective access is the permissions of the member's single tenant business role, plus any platform grants tied to your account type (for example tenant_owner vs tenant_employee). Missing permission → UI hides actions and/or API returns forbidden.
Each organization member has exactly one business role at a time. Re-assigning replaces the previous role.
Organization roles (SaaS)
| Scope | Managed in app |
|---|---|
| Tenant / organization roles | Side rail Team → Roles (/settings/users-roles) |
Built-in roles are seeded when an organization is created. Custom roles are tenant-scoped. See Built-in Roles and Custom Roles.
B. Navigation (organization)
- Open side rail Team (
/settings/team). - Explore tiles (permission-gated):
| Tile | Path | Gate (typical) |
|---|---|---|
| Members | /settings/members |
tenant:user:read or owner |
| Invites | /settings/invites |
tenant:user:create or owner |
| Roles | /settings/users-roles |
role:read |
Team URLs sit under /settings/… but the Team rail tab is highlighted — not the Settings hub alone.
C. Permission Shape
Permissions look like resource:action or domain:resource:action (e.g. product:read, inventory:warehouse:update, tenant:user:create).
Role detail uses a permission editor (CRUD-style matrix from the tenant permission catalog).
D. Common Team Permissions
| Operation | Permission |
|---|---|
| View members | tenant:user:read |
| Invite | tenant:user:create |
| Update member / active | tenant:user:update |
| Remove member | tenant:user:delete |
| View roles | role:read |
| Create role | role:create |
| Update role / permissions | role:update |
| Delete role | role:delete |
| Assign roles to user | role:assign |
Tenant Owner membership is protected and cannot be removed/demoted through normal member actions.
E. Related Flows
- Invite someone: Invites
- See who belongs: Members
- Create/edit roles: Custom Roles
- Assign roles: Assigning Roles
Next: Built-in Roles