Roles and Permissions

​

Open Roles And Permissions

1. Open Admin.
2. Choose Roles.
3. Review the role list.
4. Use Duplicate on a system role or Create custom role when the defaults do not fit.

​

Understand System And Custom Roles

• System roles are Arcus defaults. They are locked so updates stay consistent.
• Custom roles are entity-specific access profiles created by your admins.
• Assigned users show whether a role is actively used.
• Permission count helps compare broad roles to narrow roles.

The role picker currently includes Owner, Admin, Manager, Accountant, Staff, Warehouse, Sales, Auditor, and Viewer. Owner is hidden from assignment controls when the acting user is not allowed to grant owner-level access. When a system role is close but too broad, duplicate it and remove the permissions that do not belong. When a system role is too narrow, duplicate it and add only the missing permissions needed for the job.

​

Create A Custom Role

1. Choose Create custom role, or duplicate a locked system role.
2. Enter a name that matches the job, such as AP Clerk, Shipping Lead, or Inventory Auditor.
3. Add a short description so future admins know why the role exists.
4. Review each permission group.
5. Select only the permissions required for the user’s real work.
6. Save the role.
7. Assign it from Organization Users or Entity Team.
8. Review the Role Coverage Report after assignment.

The role editor has two required choices: a role name and at least the permission set you intend to grant. Description is optional, but it is the best place to explain why the role exists, such as “Warehouse lead can adjust counts but cannot approve payments.” System roles cannot be edited directly. If you open a system role for editing, Arcus blocks the edit and tells you to duplicate it instead.

​

Permission Groups To Review Carefully

Use a second reviewer for high-risk roles when possible.

​

Assign Roles Safely

Roles are assigned from user management surfaces.

• Use Organization Users when inviting a person or managing entity memberships.
• Use Entity Team for day-to-day role changes inside the active entity.
• Use Location Access when the user should only work in certain warehouses or locations.
• Use Custom Permissions only when a one-off override is truly needed.

Prefer a clean custom role over many user-specific overrides. Roles are easier to audit and easier to explain during onboarding and offboarding. Custom permissions override the selected role’s default permissions for one user. Keys that are omitted fall back to the role default. In the editor, checked means allowed and unchecked means denied. Use Reset all to role defaults when the exception is no longer needed.

​

Use Role Coverage Report

Open Admin, then Role Coverage Report. The report shows active users, their role, custom role, and effective permissions after role defaults and overrides are applied. Use it for:

• Onboarding review after assigning a role.
• Offboarding review before removing final access.
• Quarterly access review.
• Troubleshooting a permission-denied report.
• Confirming custom overrides did not grant more access than intended.
• CSV review when a compliance reviewer needs the effective permission matrix outside Arcus.

​

Troubleshoot Permission Problems

​

Common Blocks

• System role cannot be edited: duplicate it, then edit the custom copy.
• Save is disabled: role name is required.
• Permission key is confusing: compare it with the page or action the user needs, then verify with Role Coverage.
• User has access in sandbox but not production: roles are assigned per entity.
• New location is invisible to a user: update location access after adding the location.
• Role cleanup is overdue: export or review Role Coverage, remove stale overrides, and deactivate unused custom roles only after users are reassigned.

​

Related Articles