Administration
Roles & permissions
The module × action grid that decides what each role may see and do, the 11 roles every company starts with, and how to edit them or add your own.
Every screen and every save in Harbor TMS is checked on the server against a permission: a module (Loads, Invoices, Carriers …) and an action (view, create, edit, delete, approve, export). A role is a set of those permissions. A person can hold several roles, and they get everything any of their roles allows. Each company has its own copy of the grid, so you can divide the work the way your brokerage does.
- Where
- Administration → Roles & permissions (/roles)
- Who can open it
- Users · view. By default: the Owner only
- Who can edit a role
- Users · edit
- Who can add a role
- Users · create
- Grid size
- 25 modules × 6 actions
- Saves to
- The company's Role table and the audit log
The six actions
| Action | Letter below | Lets a person |
|---|---|---|
| view | V | Open the module's screens and read its data |
| create | C | Add new records |
| edit | E | Change existing records, send documents, record payments |
| delete | D | Remove records |
| approve | A | Decide items on Approvals and owner-level gates |
| export | X | Download CSV, Excel or PDF exports |
Any action implies view. If you tick edit without view, view is added for you, because a permission nobody can reach is no use.
The 11 starting roles
| Role | Label in the app | In short |
|---|---|---|
| admin | Owner / CEO | Everything, always. Locked |
| manager | General Manager | Runs the whole operation except users and billing |
| finance | Finance Manager | Invoices, receivables, payables, advances, expenses, P&L |
| accounts | Accounts Team | Reads the money screens and exports; cannot change them |
| compliance | Compliance Manager | Approves carriers; sees the audit log |
| compliance_team | Compliance Team | Reads carriers, compliance and approvals |
| sales | Sales Manager | Their own loads and customers only (R9) |
| ops | Transportation Manager | Loads, legs, dispatch, tracking, carriers |
| dispatch | Dispatch / Carrier Team | Loads, dispatch, carriers, tracking |
| tracking | Tracking Team | Reads loads, tracking and dispatch |
| viewer | Viewer (read-only) | The dashboard only |
Default grid
This is what a new company starts with. · means no access. Your company may have changed it since.
| Module | Owner | GM | Finance | Accounts | Compl. | Compl. team | Sales | Transport | Dispatch | Tracking | Viewer |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Dashboard | VCEDAX | VCEDX | VCEX | VX | VCEX | VX | VCEX | VCEX | VCEX | VX | V |
| Loads | VCEDAX | VCEDX | VCEX | VX | VCEX | · | VCEX | VCEX | VCEX | VX | · |
| Legs | VCEDAX | VCEDX | · | · | · | · | · | VCEX | · | · | · |
| Pipeline | VCEDAX | VCEDX | · | · | · | · | VCEX | VCEX | · | · | · |
| Tracking | VCEDAX | VCEDX | · | · | · | · | · | VCEX | VCEX | VX | · |
| Dispatch | VCEDAX | VCEDX | · | · | · | · | VCEX | VCEX | VCEX | VX | · |
| Customers | VCEDAX | VCEDAX | · | · | · | · | VCEX | · | · | · | · |
| Carriers | VCEDAX | VCEDAX | · | · | VCEAX | VX | · | VCEX | VCEX | · | · |
| Approvals | VCEDAX | VCEDAX | VCEAX | · | VCEAX | VX | · | · | · | · | · |
| Compliance | VCEDAX | VCEDX | · | · | VCEX | VX | · | · | · | · | · |
| Invoices | VCEDAX | VCEDX | VCEX | VX | · | · | VCEX | · | · | · | · |
| Receivables | VCEDAX | VCEDX | VCEX | VX | · | · | · | · | · | · | · |
| Payables | VCEDAX | VCEDAX | VCEAX | VX | · | · | · | · | · | · | · |
| Advances | VCEDAX | VCEDAX | VCEAX | · | · | · | · | · | · | · | · |
| Statements | VCEDAX | VCEDX | VCEX | · | · | · | · | · | · | · | · |
| Commissions | VCEDAX | VCEDX | · | · | · | · | · | · | · | · | · |
| Expenses | VCEDAX | VCEDX | VCEX | · | · | · | · | · | · | · | · |
| P&L | VCEDAX | VCEDX | VCEX | · | · | · | · | · | · | · | · |
| Reports | VCEDAX | VCEDX | VCEX | VX | · | · | VCEX | VCEX | · | · | · |
| Documents | VCEDAX | VCEDX | VCEX | VX | · | · | VCEX | · | · | · | · |
| Audit | VCEDAX | VCEDX | · | · | VCEX | VX | · | · | · | · | · |
| Users | VCEDAX | · | · | · | · | · | · | · | · | · | · |
| Company | VCEDAX | VCEDX | · | · | · | · | · | · | · | · | · |
| Integrations | VCEDAX | VCEDX | · | · | · | · | · | · | · | · | · |
| Billing | VCEDAX | · | · | · | · | · | · | · | · | · | · |
The pattern behind it:
- Every role except the read-only ones (Accounts Team, Compliance Team, Tracking Team, Viewer) can create and edit in its modules.
- Owner, General Manager, Finance Manager and Compliance Manager can approve where their role reaches Approvals, Carriers, Customers, Advances or Payables.
- Only the General Manager (besides the Owner) can delete.
- Everyone except Viewer can export.
Rules that are tied to a role, not the grid
A few freight rules name a role directly, on top of the grid:
| Rule | Who |
|---|---|
| Recording advance proof (R4) | Finance Manager, Accounts Team or Owner, who can also open the Advance ledger |
| Releasing a short advance | Owner only |
| Seeing only your own loads (R9) | Anyone holding the Sales Manager role |
| Sales performance board | Owner, General Manager, Finance Manager |
| Agent handover report | Owner only |
| Two-factor sign-in required | Owner and Finance Manager |
What you see
A row of role chips across the top picks the role. For the chosen role you see how many people hold it, how many of the 25 modules it reaches, and the grid itself: one row per module, one column per action, each cell marked Allowed (a tick) or Not allowed (a dash). The marks differ in shape as well as colour, so the grid reads in greyscale. The module column stays put as you scroll.
The Owner role shows Locked · full access and cannot be edited, so the company can never lock itself out.
Edit a role
Pick the role
Click its chip.Click Edit
The button reads "Edit Dispatch / Carrier Team", for example.Tick and untick
Click any cell to toggle it. You cannot switch to another role until you save or cancel.Save
Changes apply to everyone holding the role from their next page load.
The audit entry role.permissions lists exactly what changed, for example +invoices.create -carriers.edit.
Add a role
Click Add a role
In the page header.Name it
For example "Night desk". The name becomes a code (night_desk) and must be new.Choose Start from
"No access — I will tick what it needs", or "A copy of" any existing role.Save, then edit
The new role appears as a chip. Edit its grid as above, then give it to people on Users.
The audit entry is role.create. A role you add is never overwritten by a backup restore.
Giving roles to people
You assign roles on Users. You can only hand out a role whose permissions are all within your own access, so someone allowed to invite cannot create an owner.