Adjust permissions with profiles
By default, each user has the permissions of their role. The Profiles and rights screen lets you create reusable profiles, and add or remove permissions for a user without changing their role.
How permissions apply
- Base profiles: one per role. They apply to any user without custom settings and cannot be edited.
- Company profiles: created by you, and assignable to any user in the company's branches.
- Exceptions: permissions added (added) or removed (removed) for a single user.
Permissions are grouped by module: Management, Invoicing, Master data, Purchasing, Customer account, Accounting, Configuration, Administration and Imports / exports. Examples: Create and edit (create, edit, validate, delete, convert and send documents), Record a payment, Cancel with credit note, Company / branch configuration, Add a user, Excel import of customers. Each permission is described in the list. Permissions of the action type apply to an operation rather than a screen.
Create a profile
Open Profiles and rights, Profiles tab, then click New profile.
Enter a Name (required) and a Description.
Under Start from…, choose Empty profile, a role or an existing profile, then click Next.
Select or clear the permissions. Filter by module on the left, or use Search for a permission. The All and None buttons apply to a whole module.
Click Create profile.
Each profile then offers Edit, Duplicate, Deactivate and Delete. From a base profile, View permissions shows its content and Create a profile from this role gives you a starting point.
Adjust a user's permissions
Users tab: find the person (filters All, Customized, Role permissions), then click Manage permissions.
Under Starting point, keep Current role, choose a company profile, or change the role (Change role (base profiles)).
Turn a permission on or off to create an exception for this user.
If needed, enter a Reason (audit log), then click Save and confirm.
To undo everything, the Revert to role permissions button (circular arrow on the user's row) puts the user back on their role's permissions: their profile and exceptions are deleted, after confirmation.
What CAPPS refuses
A profile that is still assigned to users can be neither deactivated nor deleted: first assign another profile to those users. Two profiles cannot have the same name (A profile with this name already exists.).
You cannot change your own permissions: Your own permissions are changed by another permission manager.
Permissions marked accounting (closing, bank reconciliation, manual matching, and so on) are not set here but in Accounting governance, in the permissions section. The History takeover (numbering) permission is never granted through a profile: only the company owner assigns it.
Without the permission to manage permissions, the screen opens in Read only mode: you see the profiles and permissions, with View buttons instead of Edit.