How rights work: rights, roles and users

Access in Quiddly is decided in three layers: a right is one permission, a role is a named bundle of rights, and a user is given one or more roles. A user can do something when at least one of their roles holds the right for it. Nothing is granted to a user directly.

This page explains the model and what to check when a user cannot see or do something. To create users and roles, see Setup User Administration.

Rights, roles and users

Layer	What it is	Where you manage it
Right	One permission, for example to search invoices or to open a bookkeeping export. Every right has a fixed name that you type exactly as written. All rights, with the screens and API endpoints they open, are in the rights catalogue.	Not edited. Added to a role.
Role	A named group of rights. The code is written in capitals.	Environment > Users > Roles
User	A person, or an integration, with one or more roles. The rights of all the user’s roles add up.	Environment > Users > Users, action Manage roles

Things that do not affect access:

• Departments. The Department on a user is for tracking and grouping users. It carries no rights.
• Login and MFA. Roles decide what a user may do, not how the user logs in. Changing a role does not trigger a new MFA setup. MFA is reset separately, with Reset MFA in the same action menu.

Standard roles and your own roles

Quiddly delivers standard roles, see Standard Roles. A user created by a super user in the Operations Portal gets the SYSTEM role, and a client user created in the Client Portal gets the CLIENT role. A service account created in the Client Portal under Configure > Integrations also gets the CLIENT role.

Quiddly adds rights to the standard roles when a release introduces them. A role you create yourself is not changed by a release: when a new feature needs a new right, add it to your own role as well.

Super users can add rights to any role, standard roles included. To give a user limited access, build a role of your own with only the rights wanted, assign it, and remove the broader role from the user in Manage roles. A user keeps the rights of every role still assigned.

Who can change roles

Only Super Users can create a role, add or remove rights on a role, and assign or remove a role on a user. The Super User column in the user list shows who they are. For anyone else these actions are refused, even when their role holds the rights to open the screens.

Which clients a user can see

Rights decide what a user may do, not which clients. There is no right that limits an operator to some of the clients. A client user only works on their own client, or on the clients they are connected to when your environment has more than one client per user, where they choose the client after logging in.

The Client Portal and the Operations Portal

Many menu items, cards and buttons in the Client Portal are shown only when the signed-in user holds the right behind them. Client users get their rights from the CLIENT role. For what a client user can see, the CLIENT role is where to add or remove a right. The change affects all client users. To limit a right to some users, create a role with that right, assign it to those users in Manage roles, and remove the right from CLIENT.

When you open the Client Portal from the Operations Portal, with the Client portal icon on the client page, you are not signed in as one of the client’s users. The portal runs as your own user, so your roles decide what you see. A screen that works for the client can therefore be missing for you. Add the right to the role you use, for example SYSTEM. You also need the rights to open the Client Portal as a client, which are in the rights catalogue.

Two roles to check

If a client user sees a card or a menu item and you do not when you open the portal as the client, the right is missing on your role. If you see it and the client user does not, it is missing on CLIENT.

When a change takes effect

The system checks a user’s roles on every request, but both portals read the user’s rights when they start. After you change a role, ask the user to log out and log in again. A page reload also reads the rights again.

Add a right to a role

1. Go to Environment > Users > Roles.

2. Find the role, for example CLIENT or SYSTEM, and press the pencil on its row. Manage rights opens and lists the rights the role holds.

3. In Assign right, type the name of the right exactly as it is written in the rights catalogue. The name is case sensitive.

4. Press Assign. The right is added to the list.

To remove a right, use the bin icon on its row in the same window. A right that does not exist, or that the role already holds, is refused with a message. The window states that only super users can assign rights.

Find the right behind a screen

1. Open the rights catalogue and search the page (Ctrl+F or Cmd+F) for the name of the screen or the button.
2. The Operations Portal column lists where the right is used in the Operations Portal, and Client UI where it is used in the Client Portal.
3. If a screen shows an access error, read the message. The error returned by the system names the right the user is missing.

Common cases

What the user sees	What to check
A card, a menu item or a button is missing in the Client Portal, for example the Limit Summary or Latest Notes on the dashboard, or Export under Bookkeeping	The CLIENT role lacks the right. Add it, or give the user a role that holds it. See the Client UI column in the catalogue.
It works for the client but not when you open the Client Portal as the client	Your own role, for example SYSTEM, lacks the right.
A section of the Operations Portal menu shows a padlock for a user with a role of your own	The role lacks the right to read modules. Modules is also what unlocks Factoring, Debt Collection, Lending and AML, so check this before assuming the module is not enabled. SYSTEM already holds it. Ask the user to log in again after adding it.
A list in the Operations Portal shows an error, or a column layout cannot be saved	The role lacks the rights to read and save the user’s own table settings.
Register Invoice shows a message that something could not be loaded	The role lacks a right to read the reference data the page needs. Check the message and the catalogue.

See also: Setup User Administration, Standard Roles and the rights catalogue.

Guides for features that need a right of their own: the Client Portal dashboard (Limit Summary, Latest Notes, Financing Rate), unplaced payments, Client Portal reports (query reports and system reports) and SIE files.