Users and Access

Three tabs

Workspace › Users and Access answers three separate questions.

• Users — who may sign in, and what each of them may see and do.
• Roles — what a job title means in this company.
• Security — whether people must prove it is them with a second step.

Company-wide and department administrators

Access administration comes in two sizes, because a company that runs two functions does not want one person deciding for both.

• Company-wide — the Owner, an Administrator, anyone holding Manage members. They decide who is in the company at all, who gets which half of it, and what somebody’s company role is.
• A department — a Finance Administrator for Accounting, a Transport Administrator for Transportation, and one for each connector that is added later. They decide what people may do in their own department, and can reach nothing else.

A department administrator opening this screen sees the same people and the same list. What changes is what they can touch: the rows for their own department, and nothing outside it. The company role is greyed, because the seat belongs to the company rather than to a department.

Every change records who made it, which department they were acting in, the role used and the date. A person’s row says which department took them on.

Who may change access, and the authenticator code

Under Security › Changing permissions and access, the list says who can change permissions and access in this company: the Owner, everybody who can for the whole company, and each department administrator with the departments they can change. Only the Owner can change the two choices on that panel, and saving either goes ahead without a code: the Owner is never asked for one.

• Ask for an authenticator code before changing permissions and access — on by default. Turned off, changing roles, people’s permissions, department roles, app access and access for somebody outside the company asks for no code. Sign-ins, second factors, the two-factor rules and handing the company over always ask — everybody but the Owner, who is never asked.
• Who may change permissions and access — everybody whose role allows it, or only the Owner and the people ticked. Somebody not ticked can still see access but is refused when they try to change it, everywhere in Accmerio, Retail and Transportation included. A tick never gives anybody more than their role does, and the Owner is always allowed.

No access, read only, read and write

Each row of a person or a role is one of three:

• No access — the section is not in their sidebar, the page does not open, and nothing behind it can be reached. Typing the address does not help.
• Read only — they can look, and nothing they press can change anything.
• Read & write — they can do the work of that section.

Show what this allows under any row spells out what that section’s three states actually allow, in case you need to be precise.

Make a role of your own

Accmerio’s built-in roles cover most companies. There are the company-wide ones — Owner, Administrator, Accountant, Approver, Standard, Invoice only, Read only, Auditor — and a set for each department: Finance Administrator and Finance Viewer in Accounting, and Transport Administrator, Operations Manager, Dispatcher, Fleet Manager and Driver in Transportation. A department role reaches only its own department, whatever else it is put beside. When none of them fits, make one.

A role shows how many people are on it. Editing a role changes what all of them may do, from their next click. A role somebody is still on cannot be archived — move them first, so nobody silently loses access.

Change one person

Open somebody on the Users tab. Their Role sets the starting point; anything you change below it applies to that person only and is marked Overridden.

Reset to role defaults puts everything back to what their role gives. The small arrow beside one row resets just that row.

Give an employee a sign-in

An employee record and a sign-in are two different things, and one person can have either without the other.

If they do not, what is created is a sign-in for your company — not an AccountHouse account. It opens your workspace and nothing else: no home budget, no personal side of the product. They are not listed as one of AccountHouse’s people, because they have not joined it.

• A username is unique across AccountHouse, not just your company, because it is how one sign-in is found. The field checks as you type and says Available or why not. Usernames are lower-case; capitals you type are ignored. They can also sign in with their email address.
• Somebody who already has an AccountHouse account keeps their own username. The field is not offered for them; they sign in with their email address and the password you give them, which opens your company only.
• A password you type must meet the same rule as one anybody chooses — at least 8 characters, with a lower-case and an upper-case letter, a number and a symbol. It is never shown back to you. A generated one is shown once and is not stored anywhere anybody can read back.
• A temporary password works once: at their first sign-in — on the web or in your company’s apps — they must replace it with their own before anything else opens. A permanent one is simply their password until they or an administrator change it; turn this on only if you will keep it somewhere safe.

With Email them an invitation there is nothing to set here: they choose their own password when they open the link, and accept the terms themselves.

Their username and password afterwards

Open somebody on the Users tab. Under Security, Sign-in shows their Username (for a sign-in your company created), their email, and whether their password is Temporary or Set.

Transfer ownership

A company has one owner: the only person who can close it or hand it on. Ownership is never given as a role — Owner is not offered when you change somebody's role — it is handed over by the owner.

They become the owner with nothing taken away; you keep the role you chose. Only the new owner can make you owner again. A suspended person cannot be given the company, nor somebody who works here through another company.

People here through your accounting agency

Somebody marked via a company's name was given access by your accounting agency, within the limit you set under Workspace › Accounting agency. They sign in as themselves and do not use one of your seats. Remove their access here like anybody else's; a company password cannot be given to them.