Skip to content
IWB AIStop waiting for reports. Ask how the business is doing and get answers from your own data.See how it works
Roles and permissions

Let everyone see what their job needs, and nothing more

You decide what each role can do in every module, and which records and fields it sees. IWB shows step by step why a record is visible to someone, or where access stops.

Request a demoGet a quote

Runs in your browser. In the cloud or on your own server, it's the same IWB.

01

Set up a role once for everyone in the same job

You give the same role to everyone who does the same job, so when you change the role, access changes for all of them. For each module, pick Views, Edits, or Full access, then choose which records the role works on: all records, the team's, subordinates', or their own. Teams and subordinates come from the org chart in Human Resources.

  • Set viewing and editing scopes separately, so a role can see all records and edit only its own
  • Sensitive information such as purchase price and standard cost is hidden by default
  • A field you hide stays off screens, lists, exports, and printouts
  • Exporting to Excel or CSV is a separate permission in each module

02

Let each branch see only its own orders

People in each branch see only their own branch's orders in lists, searches, and reports, and can't open others from a link. The role opens the module, and a record rule decides which records show based on a condition: branch, sales rep, amount, or status. Before you save, you see how many people will see less today.

  • Start from ready-made rules for branch, ownership, amount, and status
  • A record can stay visible but locked, such as canceled invoices
  • An extra visibility rule lets a team lead also see the team's quotes
  • People with full access (Owner) aren't affected by record rules

03

Keep invoicing and collections in different hands

A segregation of duties rule keeps both ends of a task from landing with the same person. IWB scans roles, delegations, and personal permissions together and shows the people who break a rule today in a separate list. Under a four-eyes rule, whoever prepares a record can't approve it.

  • Turn a rule on with "Warn only" first, resolve the conflicts, then switch to "Block"
  • While a blocking rule is broken, that person can't get a new role or delegation
  • Ready-made rules for sales, purchasing, finance, and access management

04Details

Keep permissions right as your team changes

  • Roles for departments

    Give a role to a department, and anyone who joins it later gets the role automatically. You can include sub-departments too.

  • Time-limited roles

    Give a role with a start and end date, such as for the length of a project. Once the end date passes, the role is removed.

  • Roles per company

    In a group of companies, grant a role so that it is valid only in the company you choose.

  • Delegation

    When someone is on leave, the roles you choose pass to a delegate for a date range and end when it's over. You can also delegate approval tasks only.

  • Record-level sharing

    Open a record to a person, role, or unit without changing anyone's role. If you like, the share ends on a date you set.

  • View as this person

    With a separate permission, look at the screens through a user's eyes. The session ends after 15 minutes and is logged as an impersonation session.

  • Another admin grants access increases

    No one can give themselves a role or widen a role they hold. Another admin has to make that change.

  • Two-step verification

    Each user turns it on from their profile with an authenticator app and gets 10 recovery codes. Users can see their open sessions and end any of them.

05In modules

Where it helps most

06Related features

Tools that work alongside it

All features

07

Frequently asked questions

Are there built-in roles?

Yes. Built-in roles such as Owner, Manager, Accounting, and Sales come with IWB. There are built-in roles for warehouse, lab, and field teams too. You can edit built-in roles other than Owner, or duplicate them to build your own, but you can't delete them. The Owner role sees and does everything, and only an Owner can grant it.

What happens if a person has several roles?

Access from all of their roles is combined, and the widest applies. To close a field for that person only, add a personal field restriction; it takes precedence over their roles.

Can every field be hidden or masked?

You can hide ordinary fields or make them read-only for each role. Tax IDs, national ID numbers, and IBANs show masked to people without permission, with the last 4 digits visible. Numeric fields such as amounts are hidden instead of masked. ID, status, date, and link fields are needed for the workflow and stay locked.

Are hidden fields hidden in accounting reports too?

A hidden field doesn't appear on screens, in lists, in exports, or in printouts. The trial balance, statutory ledgers, VAT return, and e-Ledger are legal outputs, so their columns stay complete. You decide who can open these reports with the access level in Accounting.

Are permission changes tracked?

Yes. Changes to roles, assignments, rules, and delegations are written to the security log. Before you save, IWB shows what changed and whose access will change.