Roles and permissions

A login can do what its role lists, and nobody manages someone above them.

The admin ladder

OwnerRuns the platform. Only the Owner makes super admins.
Super adminRuns ISPs from the Platform menu and may change anything in any ISP.
ISP administratorFull access to their own ISP. May add other administrators of that ISP, nothing higher.
StaffHold what their role grants. May manage other staff only within their own rights and below their rank.
Partner loginResellers, sub-resellers and retailers, with a limited set of partner rights.

The last active administrator of an ISP cannot be switched off or deleted. Topping up a staff balance needs the administrator level or above.

Default roles

Every new ISP starts with the built-in ISP Admin role and six staff roles. Rename them, change their permissions or add your own under Staff → Roles.

ISP AdminCreated with every ISP; not shown among roles you can give, cannot be edited or deleted. It exists as a hook so new permissions can be granted to administrators; administrators are a level (full access to their ISP), not a role.

ManagerRuns the office: everything except staff logins, roles, the ISP's settings and deleting. Only ISP administrators (and above) may give it.

AccountantThe money desk: payments, invoices (including custom and reversal), bank transfer slips, online payments, partner top-ups, money reports, the ledger, cash book and expenses, salaries (view and pay).

Recovery officerCollects at the door: finds subscribers, takes payments, renews, sees invoices and the dues and expiring reports.

SupportPhone and complaints: subscribers (view and edit), disconnect sessions, notes, session log, complaints, chat, message log. No money.

TechnicianIn the field: subscriber and router status, internet on/off, disconnect, sessions, bandwidth usage report, complaints, inventory view and manage.

Counter staffThe front desk: adds subscribers, renews, takes payments, sees invoices and expiring report, handles complaints.

Every permission

These are the switches on a role’s Permissions page, with their exact labels.

Permission	Key
See the dashboard	`dashboard.view`
See subscribers and their details	`subscriber.view`
Add subscribers	`subscriber.create`
Renew, and switch auto-renew on or off	`subscriber.renew`
Turn a subscriber's internet off and on	`subscriber.net`
Disconnect a live session	`subscriber.disconnect`
Set or reset a customer's portal password	`subscriber.portal`
Edit details and connection (PPPoE password, static IP, MAC lock), reset the MAC	`subscriber.edit`
Change the package now, charging or crediting the difference	`subscriber.package`
Set the expiry by hand and give grace days	`subscriber.expiry`
Give a discount on every renewal	`subscriber.discount`
Add, open and delete documents	`subscriber.documents`
See and write notes and the change history	`subscriber.notes`
Download the subscriber list (CSV)	`subscriber.export`
Add and remove a subscriber's extra service fees (charged on each renewal)	`subscriber.fees`
Delete subscribers	`subscriber.delete`
See invoices	`invoice.view`
Make custom invoices	`invoice.create`
Reverse invoices (money goes back, a renewal's days are taken back)	`invoice.reverse`
Take cash or bank payments and add balance	`payment.receive`
See online payments	`onlinepay.view`
Ask a gateway about a payment again	`onlinepay.manage`
Check bank transfer slips, approve or reject them	`banktransfer.approve`
Prepaid cards: make, sell, print, switch off (partners: buy their own)	`card.manage`
See packages	`package.view`
Add packages	`package.create`
Change packages (speed, price, quota, burst) and archive them	`package.edit`
Policies: groups of RADIUS attributes for packages, expired and disabled subscribers	`policy.manage`
Tax and extra fee groups for packages	`fee.manage`
Allocations: a package's speed by time of day	`allocation.manage`
See partners and their wallets	`partner.view`
Add partners	`partner.create`
Edit partners and credit limits	`partner.edit`
Give packages to partners and set what they pay	`partner.packages`
See own packages, costs and margins (partner logins)	`mypackages.view`
Set what own customers pay (partner logins)	`partner.prices`
Top up partner wallets	`partner.topup`
Send wallet money to a partner below	`partner.transfer`
Add and manage partner logins	`partner.logins`
Delete partner logins	`partner.login_delete`
Send bank transfer slips for their own wallet (partner logins)	`partner.bank_transfer`
Sales	`report.sales`
Collections	`report.collections`
Dues	`report.dues`
Partner-wise	`report.partners`
Expiring soon	`report.expiring`
Bandwidth usage and the regulator (PTA) summary	`report.usage`
Ledger: every account's balance and every entry in the books	`ledger.view`
See routers (NAS)	`nas.view`
Add and change routers, setup scripts	`nas.manage`
See items, stock and movements	`inventory.view`
Add items, record stock in and out, give equipment to subscribers	`inventory.manage`
See complaints	`ticket.view`
Open complaints for customers, reply, assign, resolve	`ticket.manage`
Resolve and close complaints	`complaint.close`
Chat with customers (own, assigned and unassigned conversations)	`chat.use`
See every conversation of the ISP (each view is logged)	`chat.view_all`
Assign and transfer conversations	`chat.assign`
Notification rules and templates	`notify.rules`
Send bulk notifications	`notify.bulk`
App keys for the chat API	`chat.api`
See sent SMS and WhatsApp messages	`message.view`
Write notices	`notice.manage`
Send a message to chosen subscribers	`message.send`
See the cash book and cash in hand	`cash.view`
Record expenses and bank deposits, cancel entries	`cash.create`
See salaries, dues and advances	`salary.view`
Pay salary, give advances, take repayments, cancel entries	`salary.pay`
Add employees, set salaries and the salary settings	`salary.manage`
ISP details	`settings.isp`
Branches, and moving subscribers between them	`branch.manage`
Areas and sub-areas	`area.manage`
Billing and reminders	`settings.billing`
SMS, WhatsApp and email	`settings.messaging`
Payment gateways	`settings.gateways`
Staff users	`user.manage`
Delete staff logins	`user.delete`
Roles and permissions	`role.manage`
See the activity log (who changed what)	`log.view`
System status: RADIUS, worker, backups, disk	`system.view`
Login log, session log, and who had an IP address at a time	`log.sessions`
Design system page (development builds only)	`design.view`