Permissions & Role Templates

AxiomBlue does not use fixed job-title roles. Each employee holds a list of individual permissions, and you set them on the employee's own record. Role templates are a shortcut for filling that list quickly.

How a permission is written

A permission is a colon-separated path, from the broadest part of the product down to one action. erp:operations:jobs:view grants viewing job records. erp:finance:ar:send grants issuing and sending invoices.

Three rules govern how a granted permission is read:

• Parents grant children. Someone holding erp:operations:jobs can do everything under it — view, create, edit, assign, complete and delete. You do not grant each leaf separately.
• Full Management grants the ordinary actions. A permission ending :manage covers view, create, edit, delete and the financial view under the same parent.
• The wildcard * grants everything. Platform administrators hold it. It also bypasses the plan-tier cap described below.

One deliberate exception: erp:operations:jobs:view-own is enough to reach the jobs list, where the employee sees only jobs assigned to them.

The permission groups

The permissions screen sorts every permission into seven groups. Each group expands to show its permissions, and each permission expands again to show its fine-grain actions.

• Sales & CRM — CRM Dashboard, Leads, Pipeline, CRM Tasks, Automations, Email Templates, Questionnaires, CRM Reports, Quotes, Customers.
• Finance — Accounts Receivable, Accounts Payable, Payments, Banking, Suppliers.
• Operations — Jobs, Job Series, Scheduling, Crew Management, Skills, Inventory, Job Costing.
• People & HR — Employees, Timesheets, Leave Management.
• Projects — Projects, Tickets, Sprint Planning.
• Messaging — SMS.
• Settings & Other — Documents, Billing Rules, Xero Integration, Business Settings, Own Profile.

Two permissions worth understanding

Both control money. Both are separate from the everyday permission for the same record.

• Job Financial Information (erp:operations:jobs:financials) — the job's Financial Summary. That means contract value, costs, margin, billing breakdown, claims and profitability. Someone can hold Edit Jobs and enter time and materials without it.
• Employee Financial Details (erp:hr:employees:financials) — pay rates and salary. The employee directory itself opens with View Employees, so this is what keeps a colleague's pay out of it.

Role templates

A template fills the permission list in one action. Six ship with AxiomBlue:

• Field Worker (Mobile Only) — view assigned jobs, clock in and out, upload documents, browse inventory, add and edit materials and notes, request own leave, keep own timesheets.
• Field Supervisor — everything a Field Worker has, plus view and edit all jobs, manage job materials, assign and complete jobs, view team schedules, approve leave and timesheets.
• Office Employee — quoting, invoicing, job management, CRM and basic finance, plus own leave and timesheets. No admin. Sees job financials but not employee pay details.
• Operations Manager — full operations, scheduling, crews, quoting, HR oversight including leave and timesheet approval, inventory and costing. Read-only finance. Sees job financials but not employee pay details.
• Finance Manager — full finance: AR, AP, banking, payments, customers, suppliers and purchase orders. Read-only operations and timesheets. Sees job financials and employee pay details.
• Business Owner (Full Access) — every permission in the catalogue.

A template replaces the current list rather than adding to it. After applying one you can toggle individual permissions on or off.

Apply a template or set permissions by hand

1. Go to Employees > All Employees and open the employee.
2. Select the Permissions tab.
3. Apply a role template — choose one from the dropdown at the top. AxiomBlue applies it immediately and confirms with a toast.
4. Adjust individual permissions — expand a group, then toggle the permission. Expand a permission to reach its fine-grain actions.
5. Select Clear All to strip every permission and start again.

Changes save as you make them. There is no separate save step.

What you should see

A summary card near the top reads <n> of <n> available permissions granted, and each group header shows its own granted count. Those counts are what the employee sees reflected in their sidebar on their next page load.

Two limits on what you can grant

Your plan. A permission outside your subscription tier shows Upgrade Required and cannot be toggled. Applying a template that includes such a permission skips it, and the toast tells you how many were skipped.

Your own access. Unless you are a business owner, you can only grant permissions you hold yourself. The screen says so under the summary card.

How permissions shape the sidebar

The sidebar hides any section the employee has no permission for. A person with finance permissions only sees Banking & Expenses and Reports, and not Jobs & Crews or Sales.

Plan gating works differently. A page your plan does not include stays in the sidebar with a padlock icon beside it. Selecting it explains which plan unlocks the feature, so you can see what upgrading adds.

Permissions only take effect once the employee can sign in. See Managing Users.