Roles and permissions

Roles and permissions

Access to the connector is controlled by a single role picker on each user (Settings > Users > 3PL Connector): Read Only, Ops or Admin. Each level includes everything below it, and every button in the app is role-aware - users simply do not see actions they cannot perform.

What each role can do

Capability Read Only Ops Admin
See dashboard, all Operations pages, Sync Log yes yes yes
Open instances, mappings, providers (read) yes yes yes
See credentials / Connection tab no no yes
Run operations (push orders, polls, inventory sync, match) no yes yes
Send an order / create a return from the sales order no yes yes
Push products, add in bulk, mark as existing no yes yes
Retry / acknowledge Sync Log entries no yes yes
Email Support from a log entry no yes yes
Process an unmatched return's receipt no no yes
Re-open an acknowledged error no no yes
Fetch Despatch Now (manual despatch pull) no no yes
Create/edit instances, mappings, settings, providers no no yes
Activate / pause instances no no yes

Notes on the model:

  • Ops runs, Admin configures. An Ops user can trigger any flow on an instance but cannot alter what the flow does - settings, mappings and credentials are Admin-only. Operations triggered by Ops run with the same authority as the scheduler and are attributed to the user in chatter and the Sync Log.
  • Read Only is genuinely read only - no operation buttons render, and the access layer would refuse changes even to a hand-crafted request.
  • Multi-company: every connector record carries its company; users see only instances (and orders, logs, returns…) of companies they belong to.

Data safety by design

  • Credentials are visible only to Admins and are redacted in every Sync Log request header.
  • Support emails never leak personal data. The Email Support button masks customer names, addresses, emails and phone numbers in everything it prepares - the email body and the downloadable request/response files - erring on the side of masking too much.
  • Nothing is created behind your back: product matching never creates products, unmatched returns never move stock without a person, credit notes are always drafts.
  • Complete audit trail: configuration changes are tracked on the instance; every operation is chatter-logged with its user; every API call is in the Sync Log with payloads.