Managing a user's access (per-company ACLs)

What you'll learn#

• What the Manage Access dialog does and how it relates to roles
• How to grant, revoke, and change access for specific resources
• How the selected company's own setup limits what you can grant
• What happens when you uncheck a resource

What this dialog configures#

The Manage Access dialog controls a user's per-resource access level in a specific company. It's the tool you reach for when the user's role-derived default isn't quite right — they need more access on some things, less on others, or the company they belong to has a different mix than their primary one.

For each resource the user can reach (Documents, Workflows, Users, Departments, and so on), the dialog lets you:

• Check it — the user can use that resource. Pick an access level for them on it.
• Uncheck it — the user has no access to that resource in this company. They won't see it in their sidebar, won't see it on their dashboard, and the backend will reject any attempt to use it.

Each company is configured independently. Most users don't need any adjustments in this dialog at all — the defaults applied when they were created are correct for them.

Opening Manage Access#

1. Open Settings → Users in the sidebar.
2. Find the user — search by name or username if needed.
3. Click the three-dot menu at the end of their row.
4. Choose Manage Access.

The dialog opens with the user's first company pre-selected. If you want to configure a different one, pick it from the company dropdown at the top.

The module / resource tree#

The main area is a list of modules (Document Flow, Utilities, HR, Settings). Each module is a collapsible row showing:

• A checkbox for the module as a whole (all / partial / none states).
• A count badge like 2/5 meaning 2 of the module's 5 resources are currently granted.
• A chevron — click the row to expand.

When you expand a module, you see its resources (e.g., Document Flow → Documents, Document Types, Approval Flows, My Tasks, Workflow Admin). Each resource has:

• A checkbox — granted or not.
• An access-level dropdown that appears only when the resource is checked.

Module-level check / uncheck#

Clicking the module-level checkbox toggles every resource inside it:

• If all are currently checked → unchecks them all (revokes access to the whole module for this company).
• If none are checked → checks them all (grants access at the most permissive level allowed).
• If mixed → fills in the missing ones to make a full set.

Useful for quickly granting or revoking an entire module's worth of access.

Granting access to a resource#

1. Expand the relevant module (chevron row or module checkbox).
2. Find the resource you want to grant.
3. Check the checkbox. An access-level dropdown appears next to it.
4. Pick the access level — Operator, AppAdmin, ReadOnly, and so on. See Access levels explained for what each level means.
5. Repeat for any other resources you want to adjust.
6. Click Save at the bottom.

The change takes effect immediately on save. The user may need to refresh their browser (or sign out and back in) to see the new sidebar entries.

What access levels you can pick#

The dropdown only shows the levels the company itself is configured for on that resource. A company with Operator as its maximum on a resource won't let you grant AppAdmin to any user on it — the most you can do is Operator.

This is by design. A user can't have more power on a resource than the company has enabled for that resource. If you need to grant a higher level than the dropdown allows, the company's own module configuration needs adjusting first — see Assigning modules and resources to a company in the Company Management section.

Revoking access#

To take a resource away from a user in this company:

1. Find the resource row.
2. Uncheck the checkbox.
3. Click Save.

Switching between companies#

The user may belong to several companies, each configured independently.

1. Use the Select company dropdown at the top of the dialog to switch.
2. The tree reloads to show the ACLs for the newly-selected company.
3. Make the changes you want and click Save — the save applies only to the currently-selected company.
4. Switch to another company if you need to configure it too, and repeat.

Each company is a separate save. If you change settings in Company A and then switch to Company B without saving first, your Company A changes will be lost.

Common questions#