Roles, permissions, and RBAC

EDGE Sword separates modules (what features exist) from permissions (what a user may do).

Please note:

• A user never sees a module disabled for the tenant, even if their role includes related permissions — enable modules under Enable and manage modules or the Configure your workspace walkthrough.
• Run periodic access reviews with the Workspace security checklist after role changes.
• Some resources use nested grants (employee fields/sections, report entity export). Configure them on the full-page role editor — Roles in Settings.

Modules vs permissions

Concept	Controls
Enabled modules	Whether a feature appears for the tenant
Role permissions	Whether a user can read, write, or administer inside that feature

flowchart TB
  Tenant[Tenant workspace] --> Modules[Enabled modules]
  Tenant --> Roles[Roles]
  Roles --> Perms[Permissions resource.action]
  Modules --> Nav[Navigation and features]
  Perms --> Actions[Allowed actions inside modules]
  Nav --> User[What the user sees]
  Actions --> User

A user never sees a module that is disabled for the tenant, even if their role includes related permissions.

Permission shape

Permissions look like resource.action — for example customers.read or pos.kitchen. Admins receive broad access via the admin role.

Scope style	Meaning
read	All records the role can access in that resource
read_own	Only records owned by the user
read_team	Records owned by the user's team
Nested .field.* / .section.*	Column and profile-section limits (employees, and similar)

Common newer keys

Key	Purpose
home.people_feed	Welcome / celebrations / joiner cards on Home
reports.read / reports.create / reports.export.*	Table reports hub
employees.read + .fields_configured / .section.* / .field.*	Directory view with optional section limits
employees.read_reports + nested section/field keys	Managers: reports only, with optional section limits
employees.update_own + nested fields + .approval / .approval.type.*	Self-edit selected fields; optional manager / user / department approver
esign.send / esign.create	Covenant desk visibility (signers-only do not see Covenant nav)

Configure employee nested grants from the role Fields › panels — step-by-step: Limit employee sections, fields, and self-edit approval.

Assign roles

1. Open Settings → Roles & Permissions — see Roles in Settings for the full-page UI
2. Create or edit a role and select permissions (including nested pickers where shown)
3. Assign the role to members under Manage members

Use least privilege: grant only what each job needs. Set each role's default landing page under Start modules per role and Home cards under Home page and sidebar preferences after permissions are defined. Pair this guide with the Workspace security checklist for periodic reviews. New members should be invited via Add users and invite teammates with the smallest viable role.