Roles & permissions matrix

Access in CargoSurge is controlled by role (what modules you can use and which actions you can take) and branch scope (which subset of records within those modules you can see).

Overview

Every user has exactly one role. The role grants module-level permissions — VIEW / CREATE / EDIT / APPROVE / DELETE / EXPORT. Modules are: forwarding, road, wms, finance, reports, admin, crm, vendors.

Role	Forwarding	Road	WMS	Finance	CRM	Vendors	Reports	Admin
tenant_admin	Full	Full	Full	Full	Full	Full	Full	Full
admin	Full	Full	Full	Full	Full	Full	Full	Full
manager	V·C·E·Ap	V·C·E·Ap	V·C·E·Ap	V·Ap	V·C·E	V·C·E	V·E	—
operator	V·C·E	V·C·E	V·C·E	V	V	V	V	—
sales	V·C·E	—	—	V	V·C·E	V	V	—
accountant	V	V	V	Full	V	V	V·E	—
viewer	V	V	V	V	V	V	V	—
forwarding_operator	V·C·E	—	—	—	—	V	V	—
road_operator	—	V·C·E	—	—	—	V	V	—
wms_operator	—	—	V·C·E	—	—	V	V	—
driver	—	V (mobile only)	—	—	—	—	—	—

Legend: V = View, C = Create, E = Edit, Ap = Approve. Full = V+C+E+Ap+Delete+Export.

Role guidance

tenant_admin / admin — reserve for people who set up the tenant and approve big changes. Most tenants have 2–3 admins (never just 1 — if that person leaves you're locked out; never 10+ — audit log becomes noise).

manager — department heads. Can approve what the operators in their team create.

operator — your bread-and-butter ops role. Assign this by default and only upgrade if someone genuinely needs more.

sales — a dedicated sales role with CRM and quoting access, but no finance or operational execution. Protects the ops team from sales touching bookings after they convert.

accountant — finance focus. Read-only on ops modules, full access on finance. If you run Zoho / QuickBooks externally, this role is still useful for dispute handling in CargoSurge.

Module-scoped operators (forwarding_operator, road_operator, wms_operator) — for larger teams where people specialise. A road dispatcher doesn't need to see forwarding quotes; limit their view.

viewer — shareholders, auditors, external consultants. Can see everything, change nothing.

driver — mobile app only; can never log into the web app. Drivers see only their assigned trips.

Branch scope

Any user (other than admin) can be further scoped to a branch — they'll only see records tagged to that branch. Common pattern: a Dubai-branch operator can't see Abu Dhabi's bookings.

Leave the branch scope empty to mean "see all branches" — this is the default.

Portal users

Portal users are a separate concept from tenant users — they're your customers logging into the customer portal at portal.cargosurge.co.com. They see only their own data and don't have tenant-user-style roles.

Changing a role

Settings → Users → {user} → Change Role. The change takes effect on the user's next request (middleware re-reads the role). If the change is security-critical, also Force Logout to terminate their current session.

Common pitfalls

Need more granularity?

The built-in roles cover 95% of cases. If you have a genuinely specialised team (e.g. a Customs-Only role), contact sales — Enterprise plans can define custom roles with a specific module/action matrix.