Manage roles and permissions

Bulk controls access with roles. A role is a named bundle of permissions , each permission unlocks one specific action, such as viewing production orders, editing customers, or deleting files. You grant a person access by assigning them one or more roles, rather than by turning on individual permissions per user. This is known as role-based access control (RBAC), and it keeps access consistent as your team grows.

Use the User roles page when you want to see who can do what, tailor a role to a job on your shop floor, or tighten access before an audit.

Where to find rolesCopy Anchor Link

Open Settings, then Organization, then User roles. The page lists roles in a table. Use Search roles... to filter by name, slug, or description, and choose Active or Locked. If you have permission, Create role appears in the top right.

Each row shows the role name and slug, System or Custom type, Active or Locked status, Users and Permissions counts, and a description preview. Right-click a row to open its actions: Permissions, Edit, Lock or Unlock, and Delete. System-role edit, lock, and delete actions are disabled.

Before you startCopy Anchor Link

The page and its actions are gated by permission, so what you can do depends on the roles assigned to you:

• View roles (roles.view) , required to open the page and inspect a role's permissions.
• Create roles (roles.create) , required to add a new custom role.
• Edit roles (roles.update) , required to rename a role and to change its permissions.
• Lock or unlock roles (roles.toggle_lock) , required to make a role unavailable for new assignments, or to make it available again.
• Delete roles (roles.delete) , required to remove a custom role.

Roles are given to people on the Users page, not here. A directly added person receives Operator automatically; showing extra roles in Add User requires both Manage user roles and View roles. Invitations use a separate role picker under What will they do?.

Changing an existing person's roles needs Manage user roles (users.manage_roles). The invitation picker is controlled by Create invitations (invitations.create): people who can manage user roles may offer any active, unlocked role, while other inviters see only the built-in Operator and Entity admin roles plus roles whose permissions they already hold. Super user remains restricted to people who can manage user roles. See Manage users.

System roles and custom rolesCopy Anchor Link

Bulk seeds every organization with a set of system roles , ready-made roles tuned for common manufacturing jobs. System roles are marked with System in the Type column and are read-only: you cannot rename them, change their permissions, lock them, or delete them. They give you a sensible starting point and a reference for how permissions map to a job.

The current system roles are:

• Super user , Full platform access; every permission.
• Entity admin , Administrative access across the organization, without role-management permissions.
• Manager , Full operational management across all modules, without role-management permissions.
• Operator , The standard app-user baseline.
• Tablet user , Shop-floor access for production tablets.
• Invoicing , Full production invoicing and credit-note access, plus the shop-floor access needed to run an invoicing workstation.
• Quality , Full quality permissions.
• Safety , Full safety permissions.
• Training , Full training permissions.
• People , Manage employees, job titles, working hours, and training operations.
• Master data , Manage core setup such as assets, parts, processes, routings, consumables, and production configuration.
• Dashboards , View dashboards, boards, and whiteboards.

When a system role is close to what you need but not exact, create a custom role instead of trying to change the system one. Custom roles are yours to name, describe, edit, lock, and delete.

Create a custom roleCopy Anchor Link

1. On the User roles page, select Create role.
2. Optionally pick an emoji to make the role easy to spot in the table.
3. Enter a Name (at least two characters , for example, Shift Supervisor). Names must be unique within your organization.
4. Optionally add a Description so colleagues understand what the role is for.
5. Select Create.

The new role starts with no permissions. Open its Permissions to grant access, as described next.

Set a role's permissionsCopy Anchor Link

1. Right-click the role's row and select Permissions. The Role configuration dialog opens.
2. Permissions are grouped by module , the area of Bulk they control, such as Users, Production orders, Quality holds, or Safety. Each row shows the permission's plain-language label, a short description, and its technical name.
3. Use the Search permissions... box to jump to a specific permission or module.
4. Tick individual permissions, or use a module's Select all control to grant the visible permissions in that module at once. Search filters the individual permission rows, including matches in descriptions. Each module header shows a count of how many of its permissions are currently selected.
5. Select Save to apply your changes, or Cancel to discard them.

The picture below uses the read-only Operator system role as a reference. Open a custom role to edit its permissions.

Because there is one permission for each distinct action across every module in Bulk, granting a whole module is usually faster than picking rows one by one. Grant only what the job needs , it is easier to add permissions later than to explain why someone could reach something they should not.

Edit, lock, or delete a roleCopy Anchor Link

For any custom role, right-click its row to open these actions:

• Edit , change the name, emoji, or description. (Changing permissions is done through Permissions, above.)
• Lock , a locked role can no longer be assigned to new users, but people who already have it keep their permissions. Locking is useful when you are retiring a role gradually. Unlock makes it assignable again.
• Delete , permanently removes the role and all of its permission assignments.

Deleting is only available for a custom role that has no users assigned. If people still hold the role, reassign them first (on the Users page); until then the Delete action is disabled and its label explains why. System roles can never be edited, locked, or deleted, so those actions stay disabled on system-role rows.

Example: a Shift Supervisor role at Wayne CorpCopy Anchor Link

Wayne Corp runs two shifts at Gotham Applied Sciences. The plant manager wants shift leads to do everything an operator can, plus place quality holds and record downtime reasons , but not touch master data, invoicing, or user access.

Bruce Wayne, the Wayne Corp administrator, handles it like this:

1. Opens Settings > Organization > User roles and selects Create role.
2. Names the role Shift Supervisor, adds the description Operator baseline plus quality holds and downtime reasons, and selects Create.
3. Opens the new role's Permissions, uses Search permissions... and the per-module Select all controls to grant the Production operate, Production jobs, Quality holds, and Downtime reasons modules, then leaves the master-data and invoicing modules unticked.
4. Selects Save.
5. Goes to Settings > Organization > Users and assigns the Shift Supervisor role to each shift lead.

When a shift lead later moves on, Bruce removes the role from their account on the Users page. If the Shift Supervisor role is ever discontinued, he reassigns everyone off it first, then deletes it.

Expected resultCopy Anchor Link

After you save, the role's row shows its updated permission count immediately. Anyone assigned that role gains or loses the corresponding access the next time their session loads. Role changes are recorded in the organization's activity log for audit purposes , see Activity logs.

Limitations and feature stateCopy Anchor Link

Roles and permissions are generally available. Keep these behaviors in mind:

• System roles are read-only. You cannot rename, re-permission, lock, or delete them. Attempting to edit one shows the message that system roles cannot be modified. Build a custom role when a system role is not an exact fit.
• A role name must be unique within your organization. Reusing a name shows a conflict error.
• You cannot delete a role that still has users. Reassign those people first.
• At least one administrator must remain. When you change a person's roles on the Users page, Bulk stops you from removing the last Super user or admin assignment, so your organization can never be locked out.
• Permissions apply organization-wide. A role's permissions are not scoped per site. Which sites (entities) a person can open is controlled separately by entity access, not by roles , see Manage entities.

TroubleshootingCopy Anchor Link

• The Create role, edit, lock, or delete controls are missing or disabled. You are missing the matching roles.* permission, or you are looking at a system-role row (system roles can never be edited, locked, or deleted). Ask a Super user to grant you the role-management permissions.
• "System roles are read-only." You opened a built-in role. Create a custom role instead of changing the system one.
• The Delete action is disabled with a "Cannot delete" note. The role is either a system role or still assigned to users. Reassign its users on the Users page, then delete it.
• "Role already exists" when creating or renaming. Another role in your organization already uses that name. Choose a different name.
• A teammate still cannot access something after you granted the permission. Ask them to reload the page or sign out and back in so their session picks up the change.

Dates and time zonesCopy Anchor Link

Roles control who may view or change a record, but they do not change which timezone owns its dates. Calendar-only values follow the record's plant, while access, approval, and activity-log timestamps preserve their exact event moment.

Related guidanceCopy Anchor Link

• Manage users , assign roles to people and reset access.
• Review access requests , approve who can reach each site.
• Manage entities , control site (entity) access separately from roles.
• Activity logs , review a record of role and permission changes.
• Administration overview , the full set of organization and access settings.