Access control and permissions
Decide who can open each screen, and who can create, edit or delete records, in each company you run on AYBN ERP.
In short
Access in AYBN ERP is built from four things: the company a user belongs to, the role they have in that company, the screens that role is granted, and the actions allowed on each screen. Sales users can be given access to sales workflows without automatically receiving access to sensitive accounting functions.
One person, one login
Individual accounts
Each person signs in with their own email and password, verified by email. There is no shared company login.
Added by your administrator
An organisation administrator adds users to the company and chooses their role at the same time.
Several companies, one login
A user can belong to more than one company, with a different role in each. They switch companies explicitly, and the data shown always belongs to the selected company.
Rights per screen, not all-or-nothing
Company roles
Each company has its own roles. A company can have more than one administrator.
View, create, edit and delete
For each screen, a role is granted view, create, edit or delete rights separately, plus post, cancel and approve where the screen has them. Someone can view invoices without being able to change or cancel them.
Nothing by default
A new non-administrator role starts with no screens. Your administrator grants each screen explicitly.
Sensitive GST actions follow invoice rights
Generating an e-Invoice or e-Way Bill needs the right to create sales invoices; cancelling one needs the right to cancel invoices.
Limit what each person can reach
Module-level access
Screens are grouped by area: sales, purchasing, inventory, accounting, GST reports and administration. Grant whole areas or single screens.
Store-level users
Stock screens and purchase documents can be limited to the stores (godowns) a user is assigned to. Administrators without store assignments work across all of their company’s stores.
Company boundary
A user never sees another company’s records unless they are a member of that company too.
Administration stays with administrators
Organisation administrators
Administrators manage the company’s users, roles and screen grants.
Activate and deactivate users
Deactivate a user when they leave. They can no longer sign in, and any open session stops working. A user who also belongs to another company is deactivated by AYBN on request.
Settings need their own rights
Financial years, document series and print setup are separate screens, so changing them can be limited to the people responsible.
Split the work the way your business runs
These are examples of roles you can set up yourself. AYBN does not force a fixed set of roles.
Sales team
Leads, orders, challans and sales invoices, without access to journals, ledgers or bank accounts.
Store staff
Challans and stock transfers for their own stores, without access to accounting reports.
Accounts team
Payments, expenses, journals and reports, with view-only access to sales documents.
Your accountant or CA
View-only access to ledgers, GST reports and ITC screens for review.
Maker-checker for purchasing
Purchase orders and supplier payments can require approval by someone other than the person who prepared them.
- Upcoming
Approval workflows for more documents
Maker-checker approvals for more kinds of document are coming.
Good permission management
AYBN enforces the permissions you set. Choosing the right ones is up to your administrators.
Starts non-administrator roles with no screens.
Grants only the screens and actions each person needs.
Checks the delete right on the server for every delete.
Gives delete rights to as few people as possible. Prefer cancelling documents, which keeps them on record.
Blocks sign-in and ends sessions for deactivated users.
Deactivates users on their last day.
Shows each role’s grants in one place.
Reviews roles regularly, especially after people change jobs.
Related pages
Documentation: users & roles
Set up roles and grant screens step by step.
Auditability
See who created and changed records.
Security overview
All the controls in one place.
See roles and permissions in a live demo
We will set up roles that match your team and show what each person sees.