Role management

A role is a named set of permissions. Users are given roles, and their roles decide what they may see and do in TrakIT. The Role Management page is where a system administrator creates the roles, chooses what each one allows, and gives roles to users.

To open it, select Admin > Role Management. The page heading is User Role Management. Only system administrators can open it.

The page has four tabs:

Role Masters: the list of roles, where you add, change and delete them.
User Role Assignment: which roles each user holds.
Role Customisation: what each role may do, and an export of who can do what.
Workflow Access: which events and data fields of a workflow each role sees and can update.

How roles work

Permissions add up. A user can do anything that any of their roles allows. To give someone more, give them another role, or add the permission to one of their roles.
Sections and actions. Permissions are grouped by section, such as Invoices or Work Orders, and the sections by group, such as Finance or Operations. Each section has actions: usually Read, Create, Update and Delete, and others of its own, such as Approve. Every help page ends with Who can use this page, which names the section and the actions a role needs, for example Read in the Invoices section. Those are the names you switch on in the Role Customisation tab. Roles and permissions lists every section and what each of its actions allows.
System administrators do not need roles. A user who is a system administrator, as set on the user’s record (see User), can do everything, sees every menu and is not limited by custom filters or workflow access.
Company roles. A role can be global, for all companies, or for one company. A company role can be given only to users whose own company it is.
Internal and external roles. Internal roles are for your own users. External roles are for external users, who sign in to the portal: they have their own sections, in the Portal group, and an external user holds one role at most. An internal user cannot hold an external role, or the other way round.
Restricted roles. TrakIT Support can mark a role as restricted, for example a role for HR. Only TrakIT Support can change a restricted role or give it to users.

Under the heading, the Internal / External list chooses which roles every tab shows. It starts on Internal. The Workflow Access tab is not shown for External.

Role Masters tab

The Role Masters tab lists the roles, by name. Roles Found gives how many there are. To find a role, type part of its name in Search and press Enter. To see all the roles again, empty Search and press Enter.

Column	Shows
Role	The role’s name, with its description under it.
Company	The company the role is for. Empty for a global role.
Users	How many users hold the role, locked users included.
Actions	How many permissions the role has on the Role Customisation tab.
Menu Access	Internal roles only: All, or how many top-level menus the role hides, for example 2 hidden. See Menu Access.
Custom Filters	How many custom filters apply to the role, or -.
Restricted	Yes for a restricted role.
Default Page	The page users with the role open after signing in, if TrakIT Support has set one. A default page on the user’s own record comes first.
Updated By	Who changed the role last, and how long ago.
Pencil (Edit)	Opens the role, to change or delete it. Restricted roles have no pencil.

Add a role

Choose Internal or External at the top of the page.
On the Role Masters tab, select Add New Role.
In Add Role, enter the Role Name.
In Company, choose the company if the role is for one company only, or leave [Global].
To start from an existing role, choose it in Clone Role.
Enter a Description.
Select Save.

TrakIT says Role saved successfully. A new role has no permissions, unless you cloned one: choose them next on the Role Customisation tab.

Field	What to enter
Role Name	Up to 50 characters. Required. It cannot be SysAdmin, and special characters such as `<`, `>`, `#` or `@` are refused. Two global roles, or two roles of the same company, cannot have the same name.
Company	[Global] for a role any company can use, or the one company the role is for. It cannot be changed later.
Clone Role	Optional. A role of the same kind, internal or external, to copy. The new role gets all its permissions, its workflow access and its menu access. The field appears when there is a role to copy.
Description	What the role is for. Up to 500 characters. Required. It cannot contain HTML tags.

Message	What to do
Role Name is required, Description is required	Fill in the field.
Role Name specified cannot be used	Choose another name.
Role Name has invalid characters	Remove the special characters.
Unable to save. The Role Name already exists.	Choose another name, or add the role for one company.

Change a role

Select the pencil (Edit) on the role’s row.
In Update Role, change the Role Name or Description, the role’s custom filters or, for an internal role, its menu access.
Select Update.

The Company is shown but cannot be changed.

To delete the role, select the cross (Delete Role) at the bottom left of Update Role. The role is deleted straight away, without a confirmation, together with its permissions and workflow access. A role that users still hold cannot be deleted: TrakIT says Role is in use and cannot be deleted. Kindly contact support team. Remove it from its users on the User Role Assignment tab first.

A role that is the only role allowed on a form, a custom page or a document cannot be deleted either: TrakIT says This role is the only role allowed on, then how many forms, custom pages and documents, Allow another role on them first, or they would open to every role. Add another role to their access, or remove the limit, first.

When you change an internal role, Menu Access lists the top-level menus in two parts: Desktop, the menu of the full application, and PWA, the sidebar of the mobile app. A ticked menu is shown to users with the role.

Clear the menus the role’s users do not need.
Select Update.

A user sees a menu if any of their roles shows it. A menu is hidden only when every role the user holds hides it.
A user’s own record can hide more menus, but never bring back one that all their roles hide. See User.
At least one menu must stay ticked in each part: otherwise TrakIT says At least one Desktop menu item must be ticked or At least one PWA menu item must be ticked, and saves nothing.
Hiding a menu only removes it from the menu. Users can still open a page they have the permissions for, for example from a link.
Menus that TrakIT Support has hidden for everyone, and menus for system administrators only, are not listed.

Custom filters

A custom filter limits the records the users of a role see, for example only some work orders, entities, invoices or documents. TrakIT Support writes the filters. Lists limited by one show Custom Filters Active.

When you change a role, and filters exist for roles, Custom Filters lists them. Tick the filters that apply to the role and select Update.

A user sees only the records that pass the filters of all their roles. Custom filters do not apply to system administrators.

User Role Assignment tab

The User Role Assignment tab shows the roles each user holds. You can also give roles on the user’s record: see User.

The Users list shows the users who are not locked and are not system administrators: internal users, or external users when External is chosen at the top. It shows 20 users per page, by name.

Column	Shows
User ID, User Name	The user.
Company	The user’s company.
Roles	The roles the user holds.

To find a user, type part of their user ID, name or one of their roles in Search and press Enter, or select the funnel. The cross clears the search.

Select a user to see Roles Assigned to the user, on the right:

Column	Shows
Role	The role, with its description. A company role shows its company in brackets.
Assigned	Who gave the role, and how long ago.
Cross (Remove Role)	Removes the role from the user straight away, without a confirmation. A restricted role, or a role of a company other than the user’s, can be removed by TrakIT Support only: TrakIT says This role can only be removed by TrakIT Support.

Assign a role

Select the user in the Users list.
Select Assign Role.
In Assign Role, choose the role in Select Role.
Select Assign.

TrakIT says User Role saved successfully. Select Role offers the roles the user does not hold yet: global roles and the roles of the user’s company, internal or external like the user.

An external user holds one role at most. Once they have one, Assign Role is not shown: to change their role, remove the current one first.

Message	Means
All the available roles has been already added.	The user already holds every role they can have.
The role is restricted and cannot be assigned	Only TrakIT Support can give a restricted role.
Cannot have same role name more than once	The user already holds a role with the same name: a global role and a company role can share a name, but a user can hold only one of them.
A portal user can hold only one role. Remove the current role before assigning another.	Remove the external user’s current role first.

Role Customisation tab

The Role Customisation tab sets what a role may do.

In Select Role, choose the role. A company role shows its company in brackets.
Select a group, such as Finance, to show its sections, then a section, such as Invoices, to show its actions.
Turn on the switch of each action the role may do, and turn off the others. Select: All or None sets every action of the section at once.
Select Save.

TrakIT says Role Actions updated successfully. Please save changes made shows while you have changes that are not saved. If you choose another role, switch between Internal and External or open another tab before saving, TrakIT asks you to confirm that you want to lose them.

The bar of each section says how much of it the role has: [No Permission], [Partial] or [Full Permission].
Next to each action, Roles with Access lists the roles that have it, with the selected role highlighted, or None.
Some actions need another one. Create, Update and Delete need Read, for example, and in Work Orders, Upload Document needs View Document List. Turning an action on turns on the one it needs; turning an action off turns off the ones that need it. When you save, TrakIT also turns on any action that a switched-on action needs.
A section marked Access Restricted, such as Employee Master, can be changed only by TrakIT Support. Its switches are greyed out.
External roles have only the sections of the portal, in the Portal group: Jobs & Work Orders, Transporter Work Orders, Invoices, Vendor Bills, Documents, Reports, Dashboard and Profile.

Each save is recorded in the action log as Role Actions Updated, with the permissions granted and removed.

Export action permissions

The export lists, for every action of every section, the roles and the users that have it. It covers all roles of the kind chosen at the top, internal or external, whichever role is selected.

On the Role Customisation tab, select Export All Actions….
In Export Action Permissions, choose the User Company: to list only the users with access to that company, or – All Companies –.
Turn on Include Locked Users: to include locked users.
Select Export.

The Excel file has a row for each action, under a heading for each group, with these columns:

Column	Shows
Section	The section, such as Invoices.
Action	The action, such as Approve.
Roles With Access	The roles that have the action.
Users With Access	The users who hold one of those roles. System administrators appear only if they hold such a role.

If none of the users it would list holds a role with permissions, TrakIT says No Actions For export.

Workflow Access tab

The Workflow Access tab sets, for one workflow and one internal role, which events and data fields the role’s users see on the workflow’s work orders, and which they can update.

This is not the same as giving a user access to a workflow, which is done on the user’s record.

In Select Workflow, choose the workflow. The list holds the active workflows.
In Select Role, choose the role.
In the Events and Data Fields lists, choose the Access for Role of each event and field. Set All to: Hidden, View Only or Default sets every row of the list at once.
Select Save.

TrakIT says Role Access updated successfully. Changing the workflow or the role, or opening another tab, loses the choices you have not saved.

Access for Role	The role’s users
Hidden	Do not see the event or field.
View Only	See it but cannot change it, even if the role can update events and data.
View & Update	The default. The role’s permissions in the Work Orders section decide: View Events & Data lets them see it, Update Events & Data also lets them change it.

Each row shows the Event Name or Data Name, with its specific information in grey, and its Code. A name in italics with * is for information only.

A user with several roles gets the most access any of them gives: if one role hides a field and another shows it, the user sees it.

If the role does not have View Events & Data in the Work Orders section, the tab says Selected Role does not have ‘View’ access for Events and Data. and lists nothing. Give the role that permission on the Role Customisation tab first.
If the role does not have Update Events & Data, the tab says so, and the third choice reads [View Only] and cannot be chosen.

Who can use this page

Only system administrators can use this page. It checks that you are one, rather than a permission in your roles: other users who select Admin > Role Management see Authorization Failed.

Users who are not system administrators can give roles to other users on the user’s record, with Assign/Remove User Roles in the User Management section. See User.

Restricted roles, the default page of a role, and the sections marked Access Restricted are handled by TrakIT Support.