Bundling Permissions Into Reusable Roles

Roles vs Raw Groups

Assigning a user several individual technical Access Groups one by one is tedious and error-prone to repeat for every new hire in the same position. A Role bundles a whole set of groups (and optionally specific record rules/model access) into one named, reusable package — assign the role once instead of remembering every underlying group.

Creating a Role

1. Go to Settings > Users & Companies > Roles (developer mode) → Create.
2. Name it after the job function it represents (e.g. "Accountant," "Warehouse Clerk," "Sales Manager").
3. Add the underlying Groups this role should grant.
4. Assign the role to one or more users.

Time-Bounded Assignments

Each user-to-role assignment can have a From and To date — the role automatically activates and deactivates on schedule. This is genuinely useful for:

• Temporary cover while someone is on leave (grant their role to a colleague for the exact leave period).
• A contractor or seasonal hire who should automatically lose elevated access on a known end date, without anyone needing to remember to revoke it manually.
• A planned, scheduled promotion where the new access should kick in on a specific future date.

When to Use a Role vs Assigning Groups Directly

If a specific access combination will only ever apply to one person, assigning groups directly is simpler. Once you have more than one person who should share an identical access profile, or you expect the access pattern to be assigned/revoked repeatedly (new hires, leave cover), define it as a Role instead — it becomes a single source of truth you can audit and adjust in one place rather than across every affected user.