Contacts and roles
A contact is one person at one company. Their role decides what they may do; the company they point at decides what they see.
Create a contact
- Go to CRM › Contacts.
- Select New contact.
- Enter the Email. This is the identity: it is unique per tenant and it is what the person signs in with.
- Enter First name, Last name, Phone and Job title. Job title is free text ("Werkstattleiter", "Leiter Einkauf") and grants nothing.
- Pick the Organization. This is the field that gives the person their company's prices, terms and order history.
- Pick the Role. See the ladder below. New contacts default to
buyerunless another role is flagged as the default. - Set the Order approval limit if the role approves. Empty means no ceiling.
- Set the Locale. It drives the shop language and the language of transactional mail. Only the store's supported locales are accepted.
- Tick Primary contact if this is the person you address by default.
- Save.
The role ladder
Five roles, least to most privileged. Each is a bundle of permission keys.
| Role | Typically | May place an order? |
|---|---|---|
viewer | An apprentice, a technician checking availability | No |
requester | Anyone who needs a signature before spending | Submits for approval |
buyer | The person who orders consumables day to day | Yes |
approver | A department head, a site manager | Yes, and signs others' |
admin | The customer's own shop administrator | Yes, plus manages people |
The permissions behind them are visible on CRM › Roles:
| Permission key | What it allows |
|---|---|
catalog.read | See products and prices |
carts.manage | Create and edit own carts and order lists |
orders.create | Place an order directly |
orders.request | Submit an order for approval instead of placing it |
orders.approve | Approve submitted orders, up to order_approval_limit |
orders.read | See the organization's orders |
addresses.manage | Maintain the organization's addresses |
contacts.read / contacts.manage | See / manage the organization's people |
organization.manage | Edit the organization's master data |
Permissions are derived from the role every time they are read and never stored on the person, so changing a role's permission set cannot leave a stale grant behind on somebody.
role. The role is a closed list of five values and
it is what authorization reads. A role column full of "Einkauf" and
"Werkstatt" grants nobody anything the moment permissions are enforced. Job
titles belong in job_title.Change what a role grants
You can re-map the built-in roles to different permission keys, for example if
buyer at your customers should not see the whole order history:
- Go to CRM › Roles.
- If the list is empty, select Load the built-in roles. Until a tenant has its own rows, every buyer is answered from the five built-ins and there is nothing to edit. Loading them writes the same permissions down, so nobody's access changes.
- On a role's row, select Permissions.
- Tick the keys the role should grant and save.
The permission editor replaces the whole set. Anything left unticked is revoked. Check the role's own page for its current grants before you edit.
Two limits to know about:
- You cannot create a sixth role.
contacts.roleis constrained to the five keys, so a new role would be one nobody could hold. - A store setting can lock the ledger. With custom roles switched off, the built-in five are enforced whatever is stored.
Approval limits
order_approval_limit is an amount. The right to approve comes from the role;
the limit says how far it reaches. It is denominated in the market's currency
and is not converted. Empty means no ceiling.
Set it on the people who approve, and leave it empty on people who do not. A
limit on a viewer has nothing to act on.
Who is the primary contact
is_primary marks the one person you address by default. Promoting somebody
always demotes the previous primary; two people cannot both hold the flag. A
store setting can additionally prevent the last primary contact of a company
from being demoted or deleted, so checkout never meets a company with nobody to
address.
What to check
- Open the contact. The rail shows the role, the approval limit and whether they are the primary contact.
- The Role & permissions section shows the grants this person holds right now, and whether they may act on them. A contact who is blocked or whose registration is still pending keeps the role but cannot act on it.
- The Organization & status section links to the company. If it is empty, this person has no company prices.
- The Contacts list has queues for Awaiting approval, Active, Invited, Blocked and Rejected. Use them instead of filtering by hand.
Next
- Self-registration — let people ask for an account instead of creating each one.
- Approval rules — turn roles and limits into a purchase policy.