👑 User Role System & Hierarchy
ℹ️ Role-Based Access Control: EcoHexagon implements a hierarchical RBAC system with four distinct user roles: Full Access > Admin > Project Manager > Team Member
Role Hierarchy Overview
▼
👤
Level 1
Team Member
Basic user access
- Assigned tasks only
- Personal productivity
- Limited access
👨💼
Level 2
Project Manager
Project-specific management
- Managed projects
- Team coordination
- Project financials
⚙️
Level 3
Admin
Platform administration
- System configuration
- User management
- Most settings
👑
Level 4
Full Access
Complete platform access
- Unrestricted access
- System maintenance
- No restrictions
👤 Team Member (Basic Role)
▼
Permission Level: Basic user access
Typical Users: General staff, contractors, part-time workers
Access Capabilities
- ✅ Task Management: View and manage assigned tasks only
- ✅ Time Tracking: Submit timesheets and track personal time
- ✅ Project Access: Access assigned projects and related information
- ✅ Client Information: View client information for assigned projects
- ✅ Team Communication: Participate in team communications
- ✅ Productivity Tools: Access personal productivity tools (notes, to-do, reminders)
Access Restrictions
- ❌ User Management: Cannot manage other users or change permissions
- ❌ Administration: No access to administrative settings
- ❌ Financial Data: Cannot view financial information (invoices, payments)
- ❌ Reporting: Limited reporting access (personal reports only)
- ❌ Project Creation: Cannot create or manage projects independently
✅ Ideal For: General employees, freelancers and contractors, junior team members, task-focused roles
👨💼 Project Manager (Mid-Level Role)
▼
Permission Level: Project-specific management
Typical Users: Team leads, department heads, project coordinators
Access Capabilities
- ✅ Project Management: Full access to managed projects and their resources
- ✅ Team Management: Manage project team members and assignments
- ✅ Task Creation: Create and assign tasks within projects
- ✅ Project Financials: View and manage project-related financial information
- ✅ Project Reporting: Access project-specific reports and analytics
- ✅ Timeline Management: Manage project timelines and deadlines
- ✅ Stakeholder Communication: Communicate with project stakeholders
Access Restrictions
- ❌ Project Scope: Cannot access projects not under their management
- ❌ Company Financials: Limited access to company-wide financial data
- ❌ User Permissions: Cannot change user roles or permissions
- ❌ System Administration: No access to system administration settings
- ❌ Module Management: Cannot manage company-wide modules or integrations
✅ Ideal For: Project managers, team leaders, department supervisors, client relationship managers
⚙️ Admin (Administrative Role)
▼
Permission Level: Platform administration
Typical Users: IT administrators, operations managers, senior staff
Access Capabilities
- ✅ Platform Settings: Access to most platform settings and configurations
- ✅ User Management: User management and role assignment (except Full Access role)
- ✅ System Configuration: System configuration and customization
- ✅ Business Data: Access to all projects, clients, and business data
- ✅ Analytics: Comprehensive reporting and analytics access
- ✅ Integrations: Email and integration management
- ✅ Module Control: Module activation and deactivation
Access Restrictions
- ❌ Full Access Users: Cannot create other Full Access users
- ❌ System-Level Functions: Limited access to certain system-level functions
- ❌ Financial Controls: May not have access to all financial controls
- ❌ Backup Operations: Cannot perform certain backup/restore operations
✅ Ideal For: System administrators, operations managers, senior supervisors, IT support staff
👑 Full Access (Highest Permission Level)
▼
Permission Level: Complete platform access
Typical Users: Company owners, executive leadership, system owners
Access Capabilities
- ✅ Unrestricted Access: Unrestricted access to all platform functionality
- ✅ Complete User Management: Complete user management including role assignments
- ✅ System-Level Configuration: System-level configuration and maintenance
- ✅ All Business Data: All financial and business data access
- ✅ System Maintenance: Backup, restore, and system maintenance operations
- ✅ Complete Settings: Complete settings and integration management
- ✅ Security Access: Audit trail and security log access
Access Restrictions
🔓 No Restrictions: Full Access role has complete system access with no functional limitations.
⚠️ Security Note: Full Access should be limited to company owners and primary system administrators due to unrestricted access capabilities.
✅ Ideal For: Company owners and executives, primary system administrators, senior management, business owners
⚙️ User Account Configuration
ℹ️ Account Management: Configure user accounts through Team Members → [User] → Account Settings tab with comprehensive control over user access and security.
Account Settings Interface
▼Navigation Path
Team Members → [Select User] → Account Settings tab
Interface Elements
- 📝 Basic Account Information: Edit user details and contact information
- 👑 Role Assignment Controls: Manage user permission levels
- 🔒 Account Status Management: Control login and activity status
- 🔑 Password Management: Reset and update user passwords
- 💾 Save Functionality: Apply all configuration changes
Basic Account Information
▼Email Configuration
Example: ajpoliters@gmail.com
- 🎯 Purpose: Primary login credential and communication address
- 📋 Requirements: Valid email format, unique across platform
- ⚡ Impact: Changes affect login and email notifications
Email Configuration Steps
- Navigate to user's account settings
- Update email address in email field
- Verify email format is correct
- Save changes
- User should verify email access for notifications
Password Management
- 🔒 Password Field: Secure password input (masked)
- 🔒 Retype Password: Confirmation field for security
- 🛡️ Security: Passwords are encrypted and securely stored
🔐 Password Best Practices:
- Minimum 8 characters recommended
- Include uppercase, lowercase, numbers, and symbols
- Avoid common words or personal information
- Regular password updates recommended
Role Assignment Management
▼Role Selection Interface
- 📋 Control Type: Dropdown selector
- 🎯 Available Options: All four role types
- 👤 Current Selection: Displays user's current role
- 🔧 Purpose: Assign appropriate permission level to user
Role Assignment Process
- Assess User Needs: Determine appropriate role based on job function
- Select Role: Choose from dropdown menu
- Consider Impact: Review permissions being granted or removed
- Apply Changes: Save configuration to activate new role
- Verify Access: Confirm user has appropriate access
Role Change Considerations
- ⬆️ Permission Inheritance: Higher roles include all lower role permissions
- ⚡ Immediate Effect: Changes apply immediately after saving
- 🔄 Session Impact: User may need to log out and back in
- 📚 Training Needs: Users may need training for expanded access
Account Status Controls
▼Login Status Management
Disable Login Checkbox
Purpose: Temporarily prevent user access without deleting account
Use Cases for Disabling Login
- ⏸️ Temporary Suspension: Short-term access restriction
- 🏖️ Leave of Absence: Extended time away from work
- 🔍 Security Concerns: Potential security incident investigation
- 🔧 Account Under Review: Account maintenance or evaluation
Activity Status Management
Mark as Inactive Checkbox
Purpose: Set user account to inactive status while preserving data
Status Control Differences
🚫
Disable Login
- Prevents access to platform
- Keeps user "active" in system
- Maintains data associations
- Reversible by unchecking
😴
Mark Inactive
- Changes user status to inactive
- Affects reporting and visibility
- User data remains accessible
- System treats as inactive user
🔐 Comprehensive Permission Matrix
ℹ️ Permission Overview: Detailed access control matrix showing exactly what each role can access across all platform modules and administrative functions.
Module Access Permissions
▼| Module/Feature | Team Member | Project Manager | Admin | Full Access |
|---|---|---|---|---|
| Dashboard | ✓ Personal view | ✓ Project view | ✓ Company view | ✓ Complete access |
| Projects | ✓ Assigned only | ✓ Managed projects | ✓ All projects | ✓ All projects |
| Tasks | ✓ Personal tasks | ✓ Project tasks | ✓ All tasks | ✓ All tasks |
| Clients | ✓ View only | ✓ Project clients | ✓ All clients | ✓ All clients |
| Invoices | ✗ No access | ✓ Project invoices | ✓ All invoices | ✓ All invoices |
| Orders | ✗ No access | ✓ Project orders | ✓ All orders | ✓ All orders |
| Contracts | ✗ No access | ✓ View only | ✓ Manage all | ✓ Manage all |
| Estimates | ✗ No access | ✓ Project estimates | ✓ All estimates | ✓ All estimates |
| Team Members | ✓ View only | ✓ Project team | ✓ All users | ✓ All users |
| Reports | ✓ Personal only | ✓ Project reports | ✓ All reports | ✓ All reports |
| Settings | ✗ No access | ✗ No access | ✓ Most settings | ✓ All settings |
| File Manager | ✓ Personal files | ✓ Project files | ✓ All files | ✓ All files |
| Messages | ✓ Personal | ✓ Team messages | ✓ All messages | ✓ All messages |
Administrative Functions Matrix
▼| Administrative Function | Team Member | Project Manager | Admin | Full Access |
|---|---|---|---|---|
| User Management | ✗ | ✗ | ✓ | ✓ |
| Role Assignment | ✗ | ✗ | ✓ Limited | ✓ Complete |
| System Settings | ✗ | ✗ | ✓ | ✓ |
| Integration Configuration | ✗ | ✗ | ✓ | ✓ |
| Email Settings | ✗ | ✗ | ✓ | ✓ |
| Module Management | ✗ | ✗ | ✓ | ✓ |
| Permission Configuration | ✗ | ✗ | ✓ | ✓ |
| Backup/Restore | ✗ | ✗ | ✗ | ✓ |
| System Maintenance | ✗ | ✗ | ✗ | ✓ |
| Security Logs | ✗ | ✗ | ✓ Limited | ✓ Complete |
📊 Legend:
- ✓ - Full access to function
- ✓ Limited - Restricted access (some limitations apply)
- ✗ - No access to function
🔒 Permission Workflows & Security Management
User Creation & Setup Workflow
▼New User Setup Process
- Plan User Role: Determine appropriate permission level
- Navigate to Team Members: Access user management section
- Add New Member: Click "Add Member" or similar button
- Enter Basic Information:
- Full name
- Email address
- Initial password
- Assign Role: Select appropriate role from dropdown
- Configure Account Status: Set login and activity status
- Save Configuration: Apply user settings
- Communicate Credentials: Securely share login information
- Provide Training: Orient user to their access level and responsibilities
Initial User Training Checklist
- ☐ Platform Login: Platform login and navigation
- ☐ Role-Specific Access: Role-specific feature access
- ☐ Available Modules: Available modules and tools
- ☐ Reporting: Reporting capabilities
- ☐ Communication: Communication channels
- ☐ Support Resources: Support and help resources
Permission Modification Workflow
▼Changing User Roles
- Assess Need for Change: Determine why role change is needed
- Access User Account: Navigate to Team Members → User → Account Settings
- Review Current Permissions: Understand current access level
- Select New Role: Choose appropriate new role from dropdown
- Consider Impact:
- What access is being gained?
- What access is being lost?
- Does user need training?
- Apply Changes: Save new role configuration
- Verify Access: Confirm user has appropriate new permissions
- Provide Training: Train user on new capabilities if applicable
- Document Change: Record reason for role change
Permission Troubleshooting
❌
User Cannot Access Feature
- Verify user's role includes required permissions
- Check if related module is enabled
- Confirm user's account status is active
- Verify feature is available in current plan
⚠️
User Has Too Much Access
- Review user's role assignment
- Consider changing to more restrictive role
- Disable specific permissions if needed
- Monitor user activity for compliance
Security Management Controls
▼Account Security Scenarios
⏸️
Temporary Access Restrictions
Scenario: User needs temporary access suspension
Steps:
- Access user account settings
- Check "Disable Login" option
- Save changes
- Document reason for suspension
- Set reminder to re-enable when appropriate
🚪
Account Deactivation
Scenario: User leaving organization
Steps:
- Change role to Team Member (minimal access)
- Check "Mark as Inactive" option
- Check "Disable Login" option
- Save changes
- Transfer critical data ownership
- Document deactivation date and reason
🔑
Password Reset Process
Scenario: User forgot password or security concern
Steps:
- Access user account settings
- Generate new temporary password
- Enter password in both password fields
- Save changes
- Securely communicate new password to user
- Require user to change password on next login
Access Control Best Practices
▼Regular Permission Audits
- 📅 Monthly Review: Check user roles align with job functions
- 📊 Quarterly Audit: Comprehensive permission review
- 📋 Annual Assessment: Full security and access evaluation
- 🔄 Change-Based Review: Review permissions when roles change
Security Monitoring
- 🔐 Login Monitoring: Track user login patterns
- 📝 Permission Changes: Log all role and permission modifications
- 🔍 Unusual Activity: Monitor for suspicious access patterns
- ❌ Failed Attempts: Track failed login attempts
Client Portal Access Management
▼Client Portal Invitation System
Location: /clients/view/[client_id]
Key Features
- 📧 Invitation System: Send invitation system for client portal access
- 👁️ Data Visibility: Client-specific data visibility controls
- 📋 Access Tabs: Multiple access tabs for different client needs
- 🔗 Integration: Client management tools integration
Client Permission Scope
✅
Clients Can Access
- Their own project information
- Personal invoices and payment history
- Relevant documents and files
- Communication history
- Order and estimate status
❌
Clients Cannot Access
- Other clients' information
- Internal team communications
- Administrative functions
- Sensitive business data
- System configuration settings
🔒 Security Considerations:
- Limited access - clients only see their own data
- Secure authentication with strong password requirements
- Session management with automatic logout for security
- Client data properly secured and protected
Common Permission Issues & Solutions
▼User Cannot See Expected Features
🔍
Possible Causes
- Insufficient role permissions
- Module not enabled
- Account status issues
- Browser/cache problems
🔧
Resolution Steps
- Verify user's role and permissions
- Check module activation status
- Confirm account is active with login enabled
- Clear browser cache and retry
- Test with different browser/device
Permission Changes Not Taking Effect
❓
Possible Causes
- User still logged in with old session
- Browser cache issues
- System sync delays
✅
Resolution Steps
- Ask user to log out and back in
- Clear browser cache
- Wait a few minutes for system sync
- Verify changes were saved correctly