Roles & permissions

v2 replaces numeric codes with string permission keys grouped by area, e.g. sales.create, buyins.void, system.settings.manage.

Principles#

• The server decides. Hiding a button is a convenience; every API route checks the key.
• Row-level scope. Writes respect the same outlet restrictions as reads — you cannot change a record you could not see.
• Grant only what you hold. An administrator can give a role only keys they hold themselves, and can manage only users whose role is within their own permissions.
• System roles are protected. Built-in roles cannot be edited away by name tricks.
• * is break-glass. The only unrestricted key; reserved for the owner.

Coming from v1#

v1's numeric codes (120, 175, 999…) do not exist in v2. Each v2 installation starts with its own roles; build them from the keys listed in Permission keys.