Core concepts
Roles and permissions
How access works in Harbor: 11 starting roles, 25 modules, 6 actions, and why a person with two roles gets the union of both.
The idea in one paragraph
Every staff member holds one or more roles. Each role is a grid of modules (areas of the software, like Loads or Invoices) × actions (view, create, edit, delete, approve, export). A person can do something if any of their roles allows it: access is the union of their roles, and no role ever takes access away. Each company edits its own grid on Roles & permissions, and the sidebar, every page and every save follow it immediately.
The six actions
| Action | Lets a person |
|---|---|
| view | Open the screens of that module and read its records |
| create | Add new records |
| edit | Change existing records |
| delete | Remove records |
| approve | Make decisions: approve a carrier or customer, decide a credit request, release an advance |
| export | Download CSV, Excel or PDF exports of that module's data |
The 25 modules
| Module | Covers |
|---|---|
| dashboard | The dashboard, and the assistant |
| loads | Load board, new load, load record, rate board, lanes, rate requests, Container 360, arrival notices |
| legs | Splitting a load into legs |
| pipeline | The quote-to-paid pipeline board |
| tracking | Tracking and check calls |
| dispatch | Shipments board, tasks & exceptions, appointments, Auto pilot |
| customers | Customer records |
| carriers | Carrier records |
| approvals | The approvals queue and credit limits |
| compliance | Carrier compliance review and vetting |
| invoices | Invoices, debit and credit notes |
| receivables | Customer payments and aging |
| payables | Carrier bills and payments |
| advances | The advance ledger |
| soa | Statements of account |
| commissions | Agent commissions |
| expenses | Operating expenses |
| pnl | Company P&L |
| reports | Reports and sales performance |
| documents | Document center and delivery orders |
| audit | The audit log |
| users | Users, roles, security, transfer accounts |
| company | Company profile, portal control, backup & restore |
| integrations | The integrations page |
| billing | The company's own Harbor subscription |
The 11 starting roles
A new company starts with these. You can change any of them except the Owner, and add your own.
| Role | Code | Starts with |
|---|---|---|
| Owner / CEO | admin | Everything. Cannot be edited, so a company can never lock itself out |
| General Manager | manager | Almost everything except users and billing; can approve and delete |
| Finance Manager | finance | Loads, invoices, receivables, payables, advances, statements, expenses, P&L, reports, documents, approvals; can approve |
| Accounts Team | accounts | Loads, invoices, receivables, payables, reports, documents: view and export only |
| Compliance Manager | compliance | Carriers, compliance, approvals, loads, audit; can approve |
| Compliance Team | compliance_team | Carriers, compliance, approvals, audit: view and export only |
| Sales Manager | sales | Loads, pipeline, dispatch, customers, invoices, reports, documents. Own loads only (R9) |
| Transportation Manager | ops | Loads, legs, pipeline, dispatch, tracking, carriers, reports |
| Dispatch / Carrier Team | dispatch | Loads, dispatch, carriers, tracking |
| Tracking Team | tracking | Loads, tracking, dispatch: view and export only |
| Viewer (read-only) | viewer | The dashboard, view only |
Every role except Viewer can export what it can see. Roles that are not read-only can create and edit in their modules. The exact starting grid is on Roles & permissions.
Rules on top of the grid
Some limits apply whatever the grid says, because they are freight rules:
- Sales see only their own loads (R9).
- Finance-only staff see only delivered loads (R5).
- Only finance, accounts or the owner can record advance proof, and only the owner can release a short advance (R4).
- Two-factor sign-in is required for anyone holding Owner or Finance (Signing in).
- Nobody can give a role more than they hold themselves.
How it is enforced
Customers and carriers are not staff
Portal users (your customers' and carriers' people) do not have roles. They sign in separately, see only their own company's loads, and what they may do is set per company on Portal control.