---
title: "Roles & Permissions"
description: "Seventeen built-in roles, from Viewer to Approver, and exactly which pages each can see, prepare, review or approve. Segregation of duties, enforced."
url: "https://bareledger.app/guides/roles-permissions"
category: "Team, roles & approvals"
updated: "2026-11-06"
publisher: "BareLedger (Syneria Technologies OPC)"
---

# Roles & Permissions

> The seventeen built-in roles and exactly which pages each one can see, prepare, review, or approve.

Every person in your organization holds one or more **roles**, ticked as a checklist on the People page, and each role decides which pages they can see and what they can do on them. This page lists the built-in roles, exactly what each one can access, and how to set up accounts for testing or day-to-day work.

## The built-in roles

| Role | What it's for |
|---|---|
| **Administrator** | Runs the organization: company profile, people and access, subscription, branches, bank accounts, compliance. Can work in every transaction module. **View-only** on accounting configuration (periods, chart of accounts, taxes, currency rates). Cannot change an employee's sign-in email. |
| **Accountant** | The finance seat: full access to every transaction module **and** the only role that manages accounting configuration — periods, chart of accounts, taxes, and currency rates. Also full on employees and onboarding (People), including changing an employee's sign-in email. |
| **HR Officer** | The HR *maker*: maintains employee records, sends onboarding invitations and submits onboardings for review, and can change an employee's sign-in email. Cannot review or approve anything. |
| **HR Manager** | The HR *checker*: everything the HR Officer does, plus reviewing and approving onboardings, timesheets and leave, and reviewing payroll runs. Final payroll approval stays with an Approver or the Accountant. |
| **Staff** | Day-to-day preparer: creates and submits journals, invoices, bills, expenses, and payments, and manages products. Cannot review or approve anything. |
| **Reviewer** | First checker: reviews (or rejects) submitted transactions and employee onboardings. Cannot create transactions and cannot give final approval. |
| **Approver** | Final checker: reviews, rejects, and approves transactions (approving also posts them) and employee onboardings. On any one record an Approver either reviews it or approves it — never both — so in practice approvals come from a different person than the reviewer. Cannot create transactions. Can view accounting configuration. |
| **Employee** | Self-service only: My Workspace — own profile (changes go through approval), attendance, payslips and leave. Sees no other page. Granted only by an approved onboarding, beside any roles the person already has; it can't be ticked on by hand. Terminating the employee record removes it. |
| **Viewer** | Read-only across the transaction modules, reports, and audit trail. Sees employees but never pay amounts. |
| **Project Sponsor** | Owns the business case: gives final approval to project openings, budget changes and closures, and sees every project's money. Does not work the boards. |
| **PMO Manager** | Portfolio oversight: reviews project requests across all projects and can work any board. Final approval stays with the Sponsor. |
| **Project Manager** | Runs the projects they are on: proposes openings, budget changes and closures, manages the board and the team, records job expenses as drafts. |
| **Project Coordinator** | Project support: keeps boards, teams and templates tidy on every project. No money, no approvals. |
| **Project Team Member** | Works the board cards of the projects they are on — nothing else. |
| **Sales Representative** | Works the leads they own or created: captures enquiries, logs follow-ups, submits won/lost. No accounting access. |
| **Sales Manager** | Sees, assigns and works every lead and reviews won/lost. Can read quotations and invoices. Final sign-off stays with the Director. |
| **Sales Director** | Gives final approval to won/lost and sees every lead, quotation and invoice. Does not draft or post. |

The five project roles are explained in [Project Roles](https://bareledger.app/guides/project-roles), and the three sales roles in [Sales Roles](https://bareledger.app/guides/sales-roles).

Roles are a checklist, not a single choice: tick any combination (for example Accountant and Approver) and the permissions add up. They are presets, not hard limits. Administrators can also tune access **per page, per person** with **Customize access** on the People page (see [People](https://bareledger.app/guides/team)).

## What each role can access, page by page

Access on each page is expressed as a simple level: **No access** (the page is hidden entirely), **Viewer** (read-only), **Preparer (Draft)** (create and submit drafts, and request reversals of posted records), **Reviewer** (review/reject), **Approver** (review, reject, and approve — though not both review and approve the same record), **Full access** (everything on the page), or — for configuration pages — **Manager** (change settings). These are the exact labels shown under **Customize access** on the People page.

| Page / area | Administrator | Accountant | Staff | Reviewer | Approver | Viewer |
|---|---|---|---|---|---|---|
| Organization profile | Manager | Viewer | Viewer | Viewer | Viewer | Viewer |
| People: access (sign-ins, roles) | Manager | No access | No access | No access | No access | No access |
| Subscription & Billing | Manager | No access | No access | No access | No access | No access |
| Branches | Manager | Viewer | Viewer | Viewer | Viewer | Viewer |
| Departments & cost centers | Manager | Manager | Viewer | Viewer | Viewer | Viewer |
| Projects (boards, budgets, sign-off) | Full | Full | Preparer + every project & money | Reviewer | Approver | Viewer + every project & money |
| CRM (leads, won/lost sign-off) | Full | Full | Preparer + every lead | Reviewer | Approver | Viewer |
| Accounting periods | Viewer | Manager | No access | No access | Viewer | No access |
| Chart of accounts | Viewer | Manager | Viewer | No access | Viewer | No access |
| Taxes | Viewer | Manager | No access | No access | Viewer | No access |
| Currency rates (FX) | Viewer | Manager | No access | No access | Viewer | No access |
| Journal entries | Full | Full | Preparer | Reviewer | Approver | Viewer |
| Sales (invoices, credit/debit notes) | Full | Full | Preparer | Reviewer | Approver | Viewer |
| Purchases (bills, vendor credits) | Full | Full | Preparer | Reviewer | Approver | Viewer |
| Expenses | Full | Full | Preparer | Reviewer | Approver | Viewer |
| Payments | Full | Full | Preparer | Reviewer | Approver | Viewer |
| Products & services | Manager | Manager | Manager | Viewer | Viewer | Viewer |
| Customers & suppliers | Everyone | Everyone | Everyone | Everyone | Everyone | Everyone |
| Bank & reconciliation | Manager | Manager | No access | No access | No access | Viewer |
| Reports | Viewer | Viewer | No access | Viewer | Viewer | Viewer |
| Compliance & tax filings | Manager | Manager | No access | No access | No access | Viewer |
| Audit trail | Viewer | Viewer | No access | Viewer | Viewer | Viewer |

The HR and Employee roles sit outside the transaction columns above:

| Page / area | HR Officer | HR Manager | Accountant | Reviewer | Approver | Employee | Viewer |
|---|---|---|---|---|---|---|---|
| People: employees (records, onboarding) | Preparer + invite | Full + invite | Full + invite | Reviewer | Approver | No access | Viewer (no pay amounts) |
| Change employee sign-in email | Yes | Yes | Yes | No | No | No | No |
| Leave (types, filing, deciding) | File & manage | Full incl. decide | Full incl. decide | No access | No access | Own requests only | Viewer |
| Employee profile changes (approve employees' own edits) | No | Review | Approve | Review | Approve | Request own | No |
| My Workspace (own profile, payslips, leave) | No | No | No | No | No | Yes | No |

A few things in this table surprise people, so they're worth calling out:

- **Customers & Suppliers is open to everyone.** The contact directory (in the **Directory** menu, alongside Products & Services) is shared master data used by sales, purchases, collections and compliance, so every member of the organization can view and maintain it. It has no access level to set under Customize access.
- **Administrators don't manage the books' configuration.** Periods, chart of accounts, taxes, and currency rates are managed by the **Accountant** role only — the Administrator sees them read-only. This is deliberate segregation of duties between running the company and keeping the books. The organization **owner** is held to the same line: the owner's built-in access covers everything *except* these accounting-configuration pages and reversal requests. An owner who keeps the books themselves ticks the Accountant role on their own row under **People → Manage roles**, which makes that responsibility visible in the Directory.
- **Staff can see the chart of accounts** (read-only) because preparers need to pick accounts while drafting, but they can't see periods, taxes, or FX settings at all.
- **Revealing a full bank account number** is never included in any access level — only the Administrator role (or an explicit per-person grant) can do it. Everyone else sees a masked number.
- **Changing an employee's sign-in email belongs to HR and the Accountant alone.** Not the Administrator, and not even the owner's built-in grant — the employee's login identity is an HR responsibility, the action always demands an authenticator code, and both the old and new addresses are notified.
- **Every sign-in uses a seat, employees included.** Each active sign-in counts as one user on your plan, even if it holds only the Employee role. Employee records and payroll runs are unlimited on every plan; only sign-ins count. An employee who is also a member uses one seat, not two.
- **The Employee role can't be ticked by hand.** It comes only from an approved onboarding, and it can't be removed while the person is still employed. Terminating the employee record removes it; if Employee was their only role, their sign-in is suspended too.

## The organization owner

The person who created the organization is its **owner** and implicitly holds every *oversight* permission, regardless of what roles they've been given — team, settings, billing, every transaction module, every report. Two things are deliberately **not** part of that built-in grant: managing accounting configuration (periods, chart of accounts, taxes, currency rates) and requesting reversals of posted records. Both are maker/bookkeeper actions; the owner gets them only by holding the Accountant (or Staff) role explicitly, which the owner can assign to themselves. This applies only to the owner: another member granted the Administrator role gets exactly the Administrator access above, nothing more. The owner is also **not** exempt from the three-person rule (you can't review or approve your own work, and whoever reviewed a record can't also approve it) — see [Approval Workflow](https://bareledger.app/guides/approval-workflow).

## Three different people for every transaction

Every financial transaction goes **Create → Review → Approve → Post**, and the maker, the reviewer and the approver must be **three different people**. Roles decide *what kind* of step you may take; this rule decides *which records* you may take it on. Holding several roles at once (say, sales approval and payment approval, or Accountant plus Approver) never lets one person do two of the steps on the same record, and the owner and administrators are held to it too. A team therefore needs **at least three active members** before anything can be approved and posted.

## Per-person overrides

On top of roles, an administrator can grant or remove individual permissions for a specific person with **Customize access** on the People page — either as a per-page access level (the same scale above) or as individual permission grants. Effective access = everything their roles grant, plus individual grants, minus individual denials. Note that whoever is granting access can only hand out permissions they themselves hold, and that saving someone's roles resets their custom access — re-apply it after a role change.

## Setting up test accounts

To exercise every part of the system you need **at least three people** (nothing can post until a creator, a different reviewer and a third person as approver have each done their step), and a realistic set is **five**:

1. **Owner / Administrator** — the account that registered the organization. Sets up the company, invites the team, configures settings and thresholds.
2. **Accountant** — configures the chart of accounts, periods, taxes, and FX; also useful as a second full-access transaction user.
3. **Staff** — prepares and submits transactions (the "maker").
4. **Reviewer** — reviews what Staff submitted (the first checker).
5. **Approver** — approves what the Reviewer passed on (the final checker; must be a different person from the reviewer).

Add a **Viewer** if you want to cover read-only behavior separately. (The Accountant or Administrator can stand in as reviewer or approver, as long as no one does two steps on the same record.)

> By default, organizations require a 6-digit authenticator (2FA) code at the review and approve steps. Any account that will review or approve must first enroll two-factor authentication in their profile (see [Security (End-User Guide)](https://bareledger.app/guides/security)), or those actions will be blocked with a message asking them to enable it. An administrator can turn these requirements off under Settings.