What is role-based access in an ERP?
Role-based access in an ERP means each user is given a role, such as storekeeper, supervisor or accountant, and the role decides which screens, records, actions and fields that user can see or change. Permissions are set once per role rather than person by person. Good systems control access down to individual fields and log every change with who made it.
By Arunkumar V, CTO · 03 November 2026 · 2 min read
- role-based access control ERP
- ERP user roles and permissions
- field-level permissions
- ERP access control small business
How roles, permissions and fields fit together
A role is a named bundle of permissions. A permission is a right to do one thing: view work orders, post stock movements, approve purchase orders, see the cost field on an item. A user holds one or more roles, and the system allows an action only if one of their roles permits it. Field-level permissions let one item record show the storekeeper the stock balance while hiding the cost. The example below is illustrative; every shop draws the lines differently.
| Action | Storekeeper | Supervisor | Accountant |
|---|---|---|---|
| View stock balances | Yes | Yes | Yes |
| Post stock movements | Yes | No | No |
| See item cost field | No | Yes | Yes |
| Close work orders | No | Yes | No |
| Post journals | No | No | Yes |
Typical roles in a small shop
A 10 to 50 person shop rarely needs more than six or seven roles. Owner or administrator with everything, including user management. Planner or supervisor with work orders, routings, BOMs and job costs. Storekeeper with stock movements, receipts and issues but no costs or prices. Buyer with purchase orders, vendors and bills. Operator with job card scanning and time entry only. Accountant with ledgers, invoices, bills and reports. Quality with inspections, NCRs and holds.
Keep the roles few and name them after jobs, not people. When someone leaves or changes job, you change their role, not fifty individual permissions.
Roles and the audit log
Roles say who may do something; the audit log says who did it. Together they answer the two questions that come up after a mistake: could this person have done this, and did they. An audit log of every change, with the record before and after, the user and the time, is what makes roles enforceable rather than hopeful. The same applies to API keys and integrations: each key should carry a role so an integration cannot do more than the person who created it. Review roles when someone joins, leaves or changes job, and audit who holds the administrator role twice a year.
How to set up roles in an ERP
- Step 1
List the jobs in the shop, not the people, and write what each job needs to see and change.
- Step 2
Create one role per job with the smallest set of permissions that lets the work get done.
- Step 3
Set field-level rules for sensitive fields such as cost, price, wages and work-centre rates.
- Step 4
Assign each user to one or two roles and give administrator rights to the fewest people possible.
- Step 5
Test each role by signing in as a test user, then review roles whenever someone joins, leaves or changes job.
Where ZMOS fits
ZMOS has roles and permissions down to individual fields, an audit log of every change, API keys and webhooks under the same controls, and Zudo AI answers only within the user's role. Sign-in uses an e-mail code every time with an optional authenticator app. It suits sheet-metal, machining and fabrication shops of 10 to 50 people. If you need single sign-on with a corporate directory or approval chains across several legal entities, those are enterprise requirements to raise in a demo before committing. See roles, audit log and API keys in ZMOS.
People also ask
Short answers, each one complete on its own.
Related answers
- Can AI run a manufacturing ERP safely?
- What is an immutable stock ledger?
- What should be on an ERP implementation checklist for a small manufacturer?
- What should I look for in an ERP demo?
- Cloud or on-premise ERP for a small manufacturer?
- How do I calculate job cost in a small manufacturing shop?
- How do I track work in progress (WIP) on the shop floor?
- How do I set reorder points for raw materials?
- All 54 answers
Inside ZMOS
What is the difference between a role and a permission?
A permission is the right to do one specific thing, such as post a stock movement or see a cost field. A role is a named set of permissions given to everyone doing the same job. Users are assigned roles, and the roles carry the permissions.
Should operators have ERP logins?
Yes, with a role limited to scanning job cards, entering time and recording quantities. Shared logins make the audit log useless, because every entry shows the same name. A personal login with a minimal role makes every time entry attributable.
Can one person have more than one role?
Yes. In a small shop the buyer is often also the storekeeper. Giving the person both roles is cleaner than creating a combined role, because when the jobs are split later you remove one role instead of rebuilding permissions.
What is field-level access?
A permission that applies to a single field on a record rather than the whole screen. It lets a storekeeper open an item and see the stock balance while the cost field is hidden, so one record serves the store and the office without a second copy of the data.
See it on your own stock and jobs
ZMOS is free for six months for startups and registered partners, no card. Or ask an engineer anything on WhatsApp; we reply within 6 hours in working hours.