Roles & permissions

Within an organization, every administrator has a role and a set of permissions. Together they decide what that person can see and do.

The Owner

The Owner is the top access level in an organization. An Owner can do everything in that organization, on every feature and every record, regardless of the individual permission settings.

An Owner cannot be disabled or removed. To change who owns an organization, transfer ownership, which reassigns the role to another user.

Two protections apply:

• A user linked to the owning admin account can be off-boarded as an employee without losing their admin access. Ownership changes only when you transfer it.
• The Owner bypasses the permission and scope checks, but not subscriptions. If the organization does not subscribe to a module, nobody can use it, including the Owner. See Modules & subscriptions.

Administrators

Everyone else who manages the organization is an administrator with a custom set of permissions. Permissions combine two things:

• Actions are what the administrator can do, such as view employee records, manage leave requests, run payroll, or export reports.
• Data scope is the records the actions apply to. Scope can cover specific branches, departments, agencies (outsource companies), work groups, units, or meetings.

User states

Status	Meaning
Active	Verified and enabled. The user can access the organization.
Pending	Invited, but has not verified or signed in yet. No access until they do.
Disabled	Access has been turned off. Owners cannot be disabled.

How permissions are checked

A feature works for an administrator only when all of the following apply:

1. The action is granted to the user.
2. The user’s data scope includes the record.
3. The organization subscribes to the module that contains the feature.

Note

Granting an action is only the first step: the organization must also subscribe to the module, and the user’s scope must include the records.

Managing users and access

Owners, and users with the relevant permission, manage administrators under Settings → Users. From there you can:

• Add an administrator, typically by linking an existing employee or providing a name and email. Eban Register emails an invitation, and the user stays Pending until they verify and sign in.
• Resend invitation to chase an administrator who has not accepted yet.
• Edit permissions in the access editor across four tabs:
  • Identity: name, email, linked employee, verification, and enabled state.
  • Permissions: which feature actions the user is granted.
  • Scope: which branches, departments, agencies, work groups, units, and meetings their actions apply to.
  • Review: a summary of the access before saving.
• Disable access for a user (not available for the Owner).
• Apply templates: predefined permission bundles, so consistent role setups can be reused.

The Users list shows each user’s Name, Email, and Roles (badged, including Owner), and the number of permissions they hold. A Disabled or Pending account also shows a status badge.

Why can’t I see a menu item?

It is almost always one of three reasons:

1. The action is not granted to you.
2. Your scope does not include the records.
3. The module is not subscribed.

Ask your organization’s Owner or an administrator to check your access under Settings → Users if something you need is missing.