Users and roles

Three roles decide what a person can do in DockingWare: a global platform role, a per-company membership role, and a per-company enterprise role. This chapter explains each one, the Members screen where you manage them, and what each enterprise role can open and do.

1. The short version

1. Three roles: a global platform role (ADMIN or USER), a membership role per company (ADMIN or USER), and an enterprise role per company (12 values).
2. Membership ADMIN opens Members, Company Settings, Opening Inventory, Audit Logs, Notifications, and Observability. Enterprise role decides which sidebar sections appear and which actions pass.
3. Manage members on Administration > Members. Membership ADMIN, or enterprise ADMIN or OWNER, can open it.
4. Every member has a membership role and an enterprise role. Membership ADMIN always pairs with enterprise ADMIN.
5. OWNER is not assignable in the app. Only OWNER can assign OWNER.

2. Three roles, not one

Global platform role

Every user has one global role: ADMIN (platform admin) or USER. It never grants company access by itself. It decides only the platform-only screens: Users, What’s New, and Design System.

Membership role

Membership role is per company: ADMIN or USER. It decides who manages the company:

• Members, Company Settings, Opening Inventory, Audit Logs, Notifications, and Observability need membership ADMIN.

Enterprise ADMIN or OWNER also qualifies for those screens.

Enterprise role

Enterprise role is per company, with 12 values: OWNER, ADMIN, MANAGER, WAREHOUSE_SUPERVISOR, WAREHOUSE_OPERATOR, INVENTORY_CLERK, PROCUREMENT_MANAGER, SALES_MANAGER, ACCOUNTING_MANAGER, MARKETPLACE_MANAGER, ANALYST, READ_ONLY.

It decides which sidebar sections appear and which actions pass, through the permission registry. Section 7 lists every role.

How the roles combine

• Membership ADMIN forces enterprise ADMIN. Enterprise ADMIN forces membership ADMIN.
• Otherwise the member keeps the enterprise role chosen on the Members screen.
• A member with no enterprise role set is treated as MANAGER.
• A person is a company admin when the active membership role is ADMIN, or the active enterprise role is ADMIN or OWNER. A person is a platform admin only when the global role is ADMIN.

The Members screen shows all three at once: the Membership role column, the Enterprise role column, and the Login role column, which shows the global platform role. The Login role never grants company access by itself.

3. Members screen

Open Administration > Members. The header reads “Manage membership and enterprise role for” followed by the company name.

The table columns are User, Membership role, Enterprise role, Login role, Default, Actions.

Each row shows the name and email, a membership-role dropdown (USER or ADMIN), an enterprise-role dropdown with a one-line hint, the global Login role, a Default badge or a Make default button, and a row-actions menu.

• Empty state: “No company members found.” Loading state: “Loading company members…”
• You cannot change your own roles. Your own row’s dropdowns are disabled, and the server answers “You cannot change your own role”.
• Only OWNER can change the OWNER role. The server answers “Only an owner can change the owner role”.
• A role change is refused if the company would be left with no owner or admin: “This company must keep at least one owner or admin”.
• A role change does not end the person’s session. It applies on their next request, and the sidebar picks it up on their next app load. Tell the person to reload.

Two read-only reference screens sit nearby:

• Roles (Administration > Roles) lists the 11 assignable roles with a “Typical use” description each.
• Permissions (Administration > Permissions) shows one table per tenant domain with role and allowed actions.

Both need Administration view, so MANAGER can open them and READ_ONLY cannot.

4. Add a member

The add form fields are User email, Name (only when creating), Role, Enterprise role (“Choose a role”), Default checkbox, Create user if not found checkbox, and the Add member button.

• Adding requires an email: “User email is required”. A non-ADMIN add requires an enterprise role: “Choose an enterprise role”.
• Adding a person who already has an account issues no temporary password and no forced change.
• If the person does not exist and “Create user if not found” is off, the hint reads: “This user does not exist yet. Enable “Create user if not found” to create the account and add it to this company.”
• After creating a user, the banner shows “User created and added to company.” and “Temporary password: ”. Copy the temporary password at once. If you close the banner, it cannot be shown again; reset the password to get a new one.
• Adding a duplicate member fails with “User is already a member of this company”.
• Choosing membership ADMIN forces enterprise ADMIN. Choosing USER clears ADMIN.
• Default makes this company the new member’s default company, the one sign-in lands in first.
• A member created here gets global role USER only, never ADMIN. To make someone a platform admin, use the Users screen (section 6).

New accounts start with a temporary password and a forced password change (chapter 2, section 4).

5. Change a member’s roles

• Membership dropdown to ADMIN: saves membership ADMIN and enterprise ADMIN together, with “Member role updated”. The enterprise dropdown locks and displays ADMIN.
• Membership dropdown to USER: needs an enterprise role. If none is chosen, the screen shows “Choose an enterprise role” and waits. It does not save.
• Enterprise dropdown: saves with “Enterprise role updated”. Picking ADMIN also sets membership role to ADMIN.
• Make default: saves with “Default company updated”.

The enterprise-role selector labels roles in sentence case (“Sales manager”, “Read only”). Under the selector, a one-line hint describes the role. With nothing selected, the hint reads “Choose what this person can see.”

OWNER is not in the assignable list. The selector offers the other 11 roles.

6. Remove a member, reset a password

Row actions are Reset password and Remove. There is no per-member disable.

Remove

Remove asks “Remove from this company?” and on success shows “Company member removed”.

• Removing the last admin is refused.
• Removing a member’s last active company membership is refused: “Cannot remove the user’s last active company membership”.
• If the removed membership was the default, the earliest remaining membership becomes default.
• Removal stops the person’s access on their next request: with no membership row, the server answers 403 “User is not assigned to the requested company”.

Reset password

Reset password asks “Reset password for ? They will be required to change it on next login.” On success it shows “Password reset” plus a dialog: “Password reset for ”, “Share this temporary password once. The user must change it on next login.”, with Copy password and Close.

• The reset sets a temporary password, forces a change on next login, and ends the person’s other sessions.
• Reset is refused for a platform administrator: “Cannot reset password for a platform administrator”.

Platform admins: the Users screen

Administration > Users is platform-only. Its header reads “Admin Users” with the line “Manage system users, activation state, and company memberships. Invitation email flow is out of scope; new users receive a temporary password once.”

• The table columns are User, Global role, Status, Companies, Actions. Each row offers View / Edit.
• The Create user dialog asks for Email, Name, Global role (USER or ADMIN), an Active checkbox, and a Create user button.
• A user detail shows Deactivate user / Activate user. Deactivating ends the user’s sessions.
• The Company memberships form defaults to role USER and enterprise role WAREHOUSE_OPERATOR. Add saves with “Membership added”.
• Changing the enterprise role saves with “Enterprise role updated” and forces membership ADMIN when the enterprise role is ADMIN, else USER.
• Changing the membership role saves with “Membership role updated” and resets the enterprise role to the legacy default (ADMIN to ADMIN, USER to WAREHOUSE_OPERATOR).
• Removing a membership asks “Remove from ?” and shows “Membership removed”.

7. What each enterprise role can open and do

The permission registry is the authority for this table. A sidebar section shows when the role holds view or admin in the section’s domain. Home is filtered link by link: Dashboard and Analytics are checked separately.

Sections in order: Home, Catalog, Inventory, Warehouse Operations, Procurement, Inbound Logistics, Sales, Marketplaces, Accounting, Fulfillment Intelligence, Administration.

Three registry domains have no sidebar sections: SaaS Platform, Enterprise Platform, and AI Platform. They cover platform administration, not company screens. OWNER holds view, admin, configure on SaaS Platform; view, admin, configure, export on Enterprise Platform; view, admin on AI Platform. ADMIN holds view, admin on SaaS Platform; view, admin, configure on Enterprise Platform; view, admin on AI Platform. MANAGER holds view on SaaS Platform; view, export on Enterprise Platform; view on AI Platform. ANALYST holds view on AI Platform. READ_ONLY holds none on SaaS Platform.

8. Quick answers

I cannot open Members. Members needs membership ADMIN, or enterprise ADMIN or OWNER. Ask an admin.

I changed a role and nothing changed. A role change applies on the person’s next request and the sidebar updates on their next app load. It does not end their session. Ask the person to reload.

I see USER next to a company. That is the membership role. The enterprise role is the next column. Membership role decides who manages members. Enterprise role decides which screens open.

I removed a member and they are still in. Removal stops their access on their next request. Ask them to reload. If they still get in, their membership row may not be gone; check Members again.

The admin closed the temporary password banner. The password shows once. Reset the password again to get a new one, and copy it this time.

I need to block one member of one company. Members has no disable. Remove the member, or ask a platform admin to deactivate the whole account across all companies.

OWNER is missing from the role list. OWNER is not assignable in the app. Only OWNER can assign OWNER.