Every permission explained

The full list of permissions an administrator can grant, what each one lets a person do, and which standard roles include it.

Permissions are stored on each person, not looked up from the role every time. A role is a template: applying it copies its permissions onto the person, and an administrator can then add or remove single permissions for that person. So two people with the same role can differ. See Roles & permissions.

System Administrators hold every permission. The list has 164 permissions in 32 areas.

Dashboard

Permission	What it allows	Standard roles holding it
View Dashboard `view_dashboard`	Open the home dashboard and its summary cards.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Auditor, Clinical, ICT Admin

Events

Permission	What it allows	Standard roles holding it
View Events `view_events`	See events the user is invited to or that are published to their groups.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Auditor, Clinical, ICT Admin
Add Events `add_events`	Create new events and choose their audience.	HOD, CMD / Exec, HR
Edit Events `edit_events`	Change the details, time or audience of existing events.	HOD, CMD / Exec, HR
Delete Events `delete_events`	Remove events from the calendar.	CMD / Exec
View all events `view_all_events`	See every event, including ones the user is not an audience of.	CMD / Exec, Auditor
Export events `export_events`	Download the filtered event list as CSV.	Administrators only

Meetings

Permission	What it allows	Standard roles holding it
View Meetings `view_meetings`	See meeting rooms, their status and history.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Auditor, Clinical, ICT Admin
Create Meetings `add_meetings`	Start or schedule new meeting rooms.	Administrators only
Edit Meetings `edit_meetings`	Change meeting details and settings.	Administrators only
Delete Meetings `delete_meetings`	End or permanently delete meetings.	Administrators only

Projects

Permission	What it allows	Standard roles holding it
View Projects `view_projects`	See projects, milestones and tasks in the user's groups.	HOD, CMD / Exec, HR, Accounts, Auditor
Add Projects `add_projects`	Create new projects and their milestones.	HOD, CMD / Exec, HR
Edit Projects `edit_projects`	Change project details, budget, milestones and tasks.	HOD, CMD / Exec, HR
Delete Projects `delete_projects`	Remove projects.	Administrators only
Approve Projects `approve_projects`	Approve, reject, pause or resume projects.	CMD / Exec
Export projects `export_projects`	Download the filtered project list as CSV or PDF.	Administrators only

Users

Permission	What it allows	Standard roles holding it
View Users `view_users`	See the staff directory and user profiles.	HOD, CMD / Exec, HR, Auditor, ICT Admin
Add Users `add_users`	Create user accounts and send invitations.	HR
Edit Users `edit_users`	Change personal details, employment and permissions of users.	HR, ICT Admin
Delete Users `delete_users`	Permanently remove user accounts.	Administrators only
Reset User Password `reset_user_password`	Set a new temporary password for another user.	HR, ICT Admin
Deactivate Users `deactivate_users`	Block a user from signing in without deleting their record.	HR
Reactivate Users `reactivate_users`	Restore sign-in for a deactivated user.	HR
Export users `export_users`	Download the filtered staff list as CSV or Excel, choosing the columns.	HR
Impersonate users `impersonate_users`	Sign in as another user for support; every action is audited against both accounts.	Administrators only
View user permissions `view_user_permissions`	See the effective permissions granted to other users.	HR, ICT Admin
Edit locked record fields `edit_locked_user_fields`	Change phone number and date of birth after a user has locked their record.	HR
Reset user onboarding `reset_user_onboarding`	Send a user back through first-login onboarding.	HR

User Groups

Permission	What it allows	Standard roles holding it
View User Groups `view_user_groups`	See departments, units and the organisation tree.	HOD, CMD / Exec, HR, Assets, Auditor, ICT Admin
Add User Groups `add_user_groups`	Create departments and units.	HR
Edit User Groups `edit_user_groups`	Rename, re-parent, activate or deactivate groups and change their head.	HR
Delete User Groups `delete_user_groups`	Remove groups.	Administrators only

Requests

Permission	What it allows	Standard roles holding it
View Requests `view_requests`	See requests you submitted or are assigned to (same as "View own requests").	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Auditor, Clinical, ICT Admin
Add Requests `add_requests`	Submit new requests and upload supporting files.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Clinical, ICT Admin
Edit Requests `edit_requests`	Add or remove attachments on any request that is still pending.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Clinical, ICT Admin
Delete Requests `delete_requests`	Withdraw any pending request on behalf of its submitter.	Administrators only
Approve Requests `approve_requests`	Act on approval-chain steps assigned to you (recommend / approve).	HOD, CMD / Exec, HR
View Request Types `view_request_types`	See the configured request types, their forms, templates and chains.	Procurement, Auditor
Add Request Types `add_request_types`	Create request types with the form and template builders.	Administrators only
Edit Request Types `edit_request_types`	Change a request type's form fields, document template and approval chain.	Administrators only
Delete Request Types `delete_request_types`	Remove request types that no request uses.	Administrators only
View own requests `view_own_requests`	See requests the user submitted or is named as an approver on.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Auditor, Clinical, ICT Admin
View all requests `view_all_requests`	See every request across the organisation.	HOD, CMD / Exec, HR, Auditor
Export requests `export_requests`	Download the filtered request list as CSV.	Administrators only
Manage request templates `manage_request_templates`	Design the forms and document templates used by request types.	Administrators only

Payments

Permission	What it allows	Standard roles holding it
View Payments `view_payments`	See payment requests and their status.	CMD / Exec, Accounts, Procurement, Auditor
Add Payments `add_payments`	Raise new payment requests.	Accounts, Procurement
Edit Payments `edit_payments`	Change payment requests before they are decided.	Accounts
Delete Payments `delete_payments`	Remove payment requests.	Administrators only
Approve Payments `approve_payments`	Act as an approver on payment workflows.	CMD / Exec
Manage payment types `manage_payment_types`	Create and configure payment types, their forms and approval routing.	Administrators only
Export payments `export_payments`	Download the filtered payment list as CSV.	CMD / Exec, Accounts
Process payments `process_payments`	Mark approved payments as paid and record the disbursement.	Accounts

Invoices

Permission	What it allows	Standard roles holding it
View Invoices `view_invoices`	See invoices and quotes in the user's groups.	CMD / Exec, Accounts, Procurement, Auditor
Add Invoices `add_invoices`	Create invoices and quotes.	Accounts
Edit Invoices `edit_invoices`	Change invoices and record payments against them.	Accounts
Delete Invoices `delete_invoices`	Remove invoices.	Administrators only
Approve Invoices `approve_invoices`	Approve invoices and see invoices across all groups.	CMD / Exec
Generate Invoice PDF `generate_invoice_pdf`	Download invoices as PDF.	Accounts, Auditor
Verify Invoices `verify_invoices`	Verify invoice authenticity through the public verification code.	CMD / Exec, Accounts
Send Invoices by Email `send_invoices`	Email invoices to customers.	Accounts
Export invoices `export_invoices`	Download the filtered invoice list as CSV.	CMD / Exec, Accounts

Customers

Permission	What it allows	Standard roles holding it
View Customers `view_customers`	See customer records.	CMD / Exec, Accounts, Procurement, Auditor
Add Customers `add_customers`	Create customer records.	Accounts, Procurement
Edit Customers `edit_customers`	Change customer details and stage.	Accounts, Procurement
Delete Customers `delete_customers`	Archive customer records.	Administrators only
Export customers `export_customers`	Download the filtered customer list as CSV.	Administrators only

Expenses

Permission	What it allows	Standard roles holding it
View Expenses `view_expenses`	See recorded expenses.	CMD / Exec, Accounts, Procurement, Auditor
Add Expenses `add_expenses`	Record new expenses.	Accounts, Procurement
Edit Expenses `edit_expenses`	Change recorded expenses.	Accounts
Delete Expenses `delete_expenses`	Archive recorded expenses.	Administrators only
Export expenses `export_expenses`	Download the filtered expense list as CSV.	CMD / Exec, Accounts

Accounts

Permission	What it allows	Standard roles holding it
View Accounts `view_accounts`	See ledger accounts, balances and transactions.	CMD / Exec, Accounts, Auditor
Create Accounts `create_accounts`	Open new ledger accounts.	Accounts
Edit Accounts `edit_accounts`	Change account details.	Accounts
Manage Accounts `manage_accounts`	Add funds, transfer between accounts and deactivate accounts.	Administrators only
Export accounts `export_accounts`	Download accounts and their transactions as CSV.	Accounts

Payroll

Permission	What it allows	Standard roles holding it
View Payroll `view_payroll`	See payroll runs, allowances and deductions.	CMD / Exec, HR, Accounts, Auditor
Add Payroll `add_payroll`	Create payroll runs, allowances and deductions.	Accounts
Edit Payroll `edit_payroll`	Change payroll runs, allowances and deductions.	Accounts
Delete Payroll `delete_payroll`	Remove payroll runs, allowances and deductions.	Administrators only
Export payroll `export_payroll`	Download payroll runs as CSV.	Accounts

Leave

Permission	What it allows	Standard roles holding it
View Leave `view_leave`	See leave requests and balances.	HOD, CMD / Exec, HR, Auditor
Add Leave `add_leave`	Request leave.	HR
Edit Leave `edit_leave`	Change leave requests.	HR
Delete Leave `delete_leave`	Remove leave requests.	HR
Approve Leave `approve_leave`	Approve or reject leave requests.	HOD, CMD / Exec, HR

Reports

Permission	What it allows	Standard roles holding it
View Reports `view_reports`	Open the reports area.	HOD, CMD / Exec, HR, Accounts, Procurement, Assets, Auditor

Audit Logs

Permission	What it allows	Standard roles holding it
View Audit Logs `view_audit_logs`	See the audit trail of every recorded action.	CMD / Exec, HR, Auditor, ICT Admin
Export audit logs `export_audit_logs`	Download the filtered audit trail as CSV; the export itself is recorded.	Auditor

Approvals

Permission	What it allows	Standard roles holding it
View Approvals `view_approvals`	See items waiting for the user's decision.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Auditor, Clinical, ICT Admin
Approve Approvals `approve_approvals`	Approve or reject items assigned to the user.	HOD, CMD / Exec, HR
Add Approvers `add_approvers`	Add approvers to an item in progress.	HOD, CMD / Exec, HR
Manage Approvers `manage_approvers`	Reassign or remove approvers on any item.	CMD / Exec
Manage approval workflows `manage_approval_workflows`	Design sequential and parallel approval workflows.	Administrators only
View approval history `view_approval_history`	See past decisions across the user's scope.	HOD, CMD / Exec, HR, Auditor
View approval trends `view_approval_trends`	See turnaround, overdue and volume trends for approvals.	CMD / Exec, Auditor
Delegate approvals `delegate_approvals`	Hand the user's pending approvals to someone else for a period.	Administrators only
Export approvals `export_approvals`	Download approval history as CSV.	Administrators only

System settings

Permission	What it allows	Standard roles holding it
View system settings `view_settings`	Open system settings, modules and health.	CMD / Exec, ICT Admin
Edit system settings `edit_settings`	Change system settings, theme and enabled modules.	ICT Admin
View notification tools `view_notification_tools`	Open the notification diagnostics tab in settings.	ICT Admin
Send test notifications `send_test_notifications`	Send test push and in-app notifications.	ICT Admin

Team

Permission	What it allows	Standard roles holding it
View Team `view_team`	See teams, their members and tasks.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Auditor, Clinical, ICT Admin
Add Teams `add_teams`	Create teams.	HOD, CMD / Exec, HR
Edit Teams `edit_teams`	Change team details and members.	HOD, CMD / Exec, HR
Delete Teams `delete_teams`	Remove teams.	HR

Timesheets

Permission	What it allows	Standard roles holding it
View Timesheets `view_timesheets`	See timesheets.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Auditor, Clinical, ICT Admin
Add Timesheets `add_timesheets`	Submit timesheets.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Clinical, ICT Admin
Edit Timesheets `edit_timesheets`	Change timesheets.	HOD, CMD / Exec, HR, Clinical
Delete Timesheets `delete_timesheets`	Remove timesheets.	HR

Performance

Permission	What it allows	Standard roles holding it
View Performance `view_performance`	See performance reviews.	HOD, CMD / Exec, HR, Auditor, Clinical
Add Performance `add_performance`	Create performance reviews.	HOD, CMD / Exec, HR
Edit Performance `edit_performance`	Change performance reviews.	Administrators only
Delete Performance `delete_performance`	Remove performance reviews.	HR

Memos

Permission	What it allows	Standard roles holding it
View Memos `view_memos`	Read memos addressed to the user or their groups.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Auditor, Clinical, ICT Admin
Add Memos `add_memos`	Create memo drafts.	HOD, CMD / Exec, HR, Records
Edit Memos `edit_memos`	Change memo drafts.	HOD, CMD / Exec, HR
Delete Memos `delete_memos`	Remove memos.	CMD / Exec
Submit memos `submit_memos`	Send memo drafts for approval.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Clinical, ICT Admin
Approve memos `approve_memos`	Approve or reject memos before they are published.	HOD, CMD / Exec, HR
Publish memos `publish_memos`	Publish approved memos to their audience.	CMD / Exec

Memo templates

Permission	What it allows	Standard roles holding it
View memo templates `view_memo_templates`	Open the memo template library and preview each template on the letterhead.	CMD / Exec, Auditor
Add memo templates `add_memo_templates`	Create memo templates with their header fields, layout and approval chain.	Administrators only
Edit memo templates `edit_memo_templates`	Change a memo template's header fields, layout, approval chain or status.	Administrators only
Delete memo templates `delete_memo_templates`	Remove memo templates no memo was written from.	Administrators only
Manage memo templates (full) `manage_memo_templates`	Everything above: view, add, edit and delete memo templates.	Administrators only

Registry

Permission	What it allows	Standard roles holding it
View registry desk `view_registry`	Open the file of each registry office the user belongs to: every finalised request dispatched to it.	Records, Auditor
View global registry `view_global_registry`	Open the global registry: every finalised request across all registries, including ones filed before dispatch existed.	Records, Auditor, ICT Admin
Export registry `export_registry`	Download a registry file as CSV.	Records
Manage registries `manage_registries`	Choose which units act as registry offices.	ICT Admin

Documents

Permission	What it allows	Standard roles holding it
View Documents `view_documents`	See documents shared with the user or their groups.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Auditor, Clinical, ICT Admin
Add Documents `add_documents`	Upload documents.	HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Clinical
Edit Documents `edit_documents`	Change document details, tags and sharing.	HOD, CMD / Exec, HR, Procurement, Records
Delete Documents `delete_documents`	Remove documents.	Records
Export documents `export_documents`	Download the filtered document list as CSV.	Administrators only

Fixed Assets

Permission	What it allows	Standard roles holding it
View Fixed Assets `view_assets`	See the fixed asset register.	HOD, CMD / Exec, HR, Procurement, Assets, Auditor, Clinical, ICT Admin
Add Fixed Assets `add_assets`	Register new assets.	Procurement, Assets, ICT Admin
Edit Fixed Assets `edit_assets`	Change asset details, location and status.	Procurement, Assets, ICT Admin
Delete Fixed Assets `delete_assets`	Remove assets from the register.	Assets
Export fixed assets `export_assets`	Download the filtered asset register as CSV.	Administrators only

Role & Permissions

Permission	What it allows	Standard roles holding it
View Roles `view_roles`	See role templates and their permissions.	CMD / Exec, HR, Auditor, ICT Admin
Add Roles `add_roles`	Create role templates.	ICT Admin
Edit Roles `edit_roles`	Change role templates and their permissions.	ICT Admin
Delete Roles `delete_roles`	Remove role templates.	ICT Admin

Mails

Permission	What it allows	Standard roles holding it
View Mails `view_mails`	Open the mailboxes the user has access to.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Auditor, Clinical, ICT Admin
Compose Mail `compose_mail`	Write and send new messages.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Clinical, ICT Admin
Reply to Mail `reply_mail`	Reply to received messages.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Clinical, ICT Admin
Forward Mail `forward_mail`	Forward received messages.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Clinical, ICT Admin
Delete Mail `delete_mail`	Move messages to trash or delete them.	Records

Mail Control

Permission	What it allows	Standard roles holding it
View Mail Control `view_mail_control`	Open mail administration.	Records, ICT Admin
Add Mail Account `add_mail_account`	Create shared and personal mailboxes.	ICT Admin
Edit Mail Account `edit_mail_account`	Change mailbox details.	ICT Admin
Delete Mail Account `delete_mail_account`	Remove mailboxes.	ICT Admin
Assign Mail Account `assign_mail_account`	Grant users and groups access to mailboxes.	ICT Admin
View Analytics `view_mail_analytics`	See mail volume and read messages across mailboxes for audit.	CMD / Exec, Auditor, ICT Admin
Manage External Mail Policy `manage_mail_policy`	Control which mailboxes may send to external addresses.	ICT Admin

AI Assistant

Permission	What it allows	Standard roles holding it
Access AI Assistant `view_ai_assistant`	Chat with the AI assistant; tools still respect the user's other permissions.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Auditor, Clinical, ICT Admin

Templates & branding

Permission	What it allows	Standard roles holding it
Manage form schemas `manage_form_schemas`	Build the custom forms used by request, payment and memo types.	ICT Admin
Manage document templates `manage_document_templates`	Design printable templates with variables.	Records, ICT Admin
Manage branding `manage_branding`	Change the letterhead, footer and logo used on generated documents.	ICT Admin

Claw engine

Permission	What it allows	Standard roles holding it
View Claw actions `view_claw_actions`	See the actions the Claw engine has catalogued for the user.	Employee, HOD, CMD / Exec, HR, Accounts, Procurement, Records, Assets, Auditor, Clinical, ICT Admin
Manage Claw engine `manage_claw_engine`	Configure the Claw engine schedule, rules and reminders.	ICT Admin