Your sales team quotes. Your admin takes payments. Your fitters see jobs. Nobody sees what they shouldn’t.
IBIOS has four built-in roles and a set of permission flags. Assign a role, adjust individual permissions, and every team member gets exactly the access they need — nothing more.
JWT authentication. bcrypt password hashing. Full audit log on every action.
How do user roles and permissions work in IBIOS?
Roles set the defaults. Permission flags let you fine-tune access for individual team members.
Assign a role
Create a user and assign one of four roles: Admin, Manager, Sales, or Installer. Each role comes with a pre-set group of permission flags.
Adjust permissions
Override individual permission flags per user if needed. A Sales user can be given can_view_costs without changing all Sales users.
Team member logs in
IBIOS generates a JWT with a set expiry. The user sees only the sections and data their permissions allow. Cost and profit fields are hidden for users without the relevant flags.
Everything is logged
Every create, update, and delete action is logged in the audit trail with the user, timestamp, and IP address. Searchable by administrator.
Who benefits from role-based access?
Role-based access matters most when a business has a mix of front-of-house staff, back-office staff, and field-based workers.
Showroom teams
Sales staff can build and send quotes without seeing cost prices or margins. The owner or manager sees everything.
Installation teams
Fitters see job details, installation dates, and access notes. They cannot see financial data or approve quotes.
Admin and accounts staff
Admin users can manage payments without access to the user management section or the ability to delete records.
Permission flags reference
Permission flags control access to sensitive features. Each flag can be enabled or disabled per user by an administrator.
can_view_costsSee cost prices on products, quotes, and jobs.
can_view_profitsSee profit margins and cost vs selling price analysis.
can_manage_usersCreate, edit, and deactivate user accounts.
can_approve_quotesApprove quotes and move jobs to in_progress status.
can_manage_suppliersAdd and edit suppliers, brands, and products.
can_delete_recordsDelete customers, jobs, quotes, and other records.
can_view_auditView the full audit log.
Authentication
JWT tokens with a set expiry. Re-authentication required after expiry.
Password security
bcrypt hashing. Passwords are never stored in plain text. Password reset by administrator.
Audit log fields
Action type, entity type, entity ID, user ID, timestamp, and IP address on every logged event.
Built-in roles
Admin, Manager, Sales, Installer. Each carries a default permission set. Individual flags adjustable per user.
Questions about user roles and permissions
How are new users added to IBIOS?
An administrator with the can_manage_users permission creates each user account, assigns one of the built-in roles and adjusts individual permission flags if needed. Founding prices for waiting-list members are explained on the pricing page.
Can I customise permissions per user?
Yes. Each of the four built-in roles (Admin, Manager, Sales, Installer) carries a default set of permission flags. Individual flags can be adjusted per user by an administrator. For example, you can give a specific Sales user the can_view_costs permission without changing the permission set for all Sales users.
Does IBIOS log who changed what?
Yes. Every action in IBIOS — creating, updating, or deleting any record — is logged in the audit trail with the action type, the entity affected, the user who performed the action, the timestamp, and the IP address. The audit log is searchable and paginated. Access to the audit log requires the can_view_audit permission.
Can installers see customer financial information?
No. The Installer role does not carry the can_view_costs or can_view_profits permission flags by default. Installers see the job details they need — bathroom dimensions, survey and installation dates, access notes — without access to quote pricing, cost prices, or profit margins.
Is there a multi-factor authentication option?
IBIOS currently uses JWT-based authentication with token expiry and bcrypt password hashing. Multi-factor authentication (MFA) is on the product roadmap. If MFA is a compliance requirement for your business, please contact us — enterprise deployments can be discussed case by case.
Which IBIOS products do user roles apply to?
Per-role and per-person access rights apply across every IBIOS product line, from the IBIOS CRM to IBIOS Workforce, where staff and contractors are scheduled. It is built for general builders and showroom retailers. See also: discount approval.
IBIOS (Integrated Business Intelligence & Operations System) is made by IBIOS Limited (NI743167), Northern Ireland. Access is by waiting list; there is no free trial.
Right access for every team member. Full audit trail behind every action.
Early access by waiting list. Four built-in roles.