ImaraISPReference
Permissions and roles
The permission catalogue in plain words, and which built-in role has which permissions
Every staff member has a role on a tenant. A role is a bundle of permissions, and a permission is one thing you are allowed to do. Membership on a reseller or a parent tenant grants the same role over every tenant below it.
The app hides what your role lacks
Buttons, menu entries and whole pages you are not allowed to use are not shown, rather than greyed out. If a colleague sees a "Mark paid" button and you do not, the difference is your role, not a bug. Ask an Owner to change it under Settings, Team.
Built-in roles
| Role | In one line | Typical person |
|---|---|---|
| Owner | Do everything, including billing, roles and workspace settings. | The ISP owner or general manager |
| Ops | Run day-to-day operations across customers, payments and routers. | The operations lead |
| Cashier | Take and match payments and record cash. | Front desk, shop staff |
| Support | Look up customers, answer "I paid but I'm not online" and reconnect them. | Helpdesk |
| FieldTech | Onboard and manage routers, and reconnect customers on site. | Installers and technicians |
| Viewer | See customers, payments and routers without changing anything. | Accountant, auditor, investor |
Owner holds every permission. Viewer holds every read permission, and nothing else.
Ops is "everything except the things that reshape money, trust or the tenant tree". The exact exclusions are listed under What Ops cannot do.
The permission catalogue
The tables below group the catalogue by area. The last four columns show which of the narrower built-in roles hold each permission. Owner holds all of them; Viewer holds exactly the rows marked "Viewer has this".
Customers and services
| Permission | What it lets you do | Ops | Cashier | Support | FieldTech |
|---|---|---|---|---|---|
| Customers: read | Open the Customers list and a customer's profile. Viewer has this. | yes | yes | yes | yes |
| Customers: write | Add and edit customers. | yes | |||
| Customers: export | Download the customer list. | yes | |||
| Customers: adjust balance | Correct a customer's wallet balance with a typed reason, and grant legacy credit held for review. Every adjustment is in the audit log. | yes | |||
| Customers: notes | Add notes to a customer. | yes | yes | yes | |
| Services: read | See a customer's service, plan and expiry. Viewer has this. | yes | yes | yes | yes |
| Services: write | Create or edit a service. | yes | |||
| Services: reconnect | Reconnect a subscriber who is paid but offline. | yes | yes | yes | |
| Services: change plan | Move a subscriber to a different plan. | yes | |||
| Services: suspend | Suspend a service by hand. | yes | |||
| Services: reset password | Reset a subscriber's PPPoE or hotspot password. | yes | yes | ||
| Devices: forget | Forget a subscriber's remembered device so they must sign in again. | yes | yes |
Plans and vouchers
| Permission | What it lets you do | Ops | Cashier | Support | FieldTech |
|---|---|---|---|---|---|
| Plans: read | See the plan list. Viewer has this. | yes | |||
| Plans: write | Create, edit and retire plans. | yes | |||
| Vouchers: read | See voucher batches. Viewer has this. | yes | yes | yes | |
| Vouchers: write | Generate and sell vouchers. | yes | yes | ||
| Vouchers: export | Download a voucher batch for printing. | yes |
Payments
| Permission | What it lets you do | Ops | Cashier | Support | FieldTech |
|---|---|---|---|---|---|
| Payments: read | See the Payments list and a customer's payment history. Viewer has this. | yes | yes | yes | |
| Payments: initiate | Send a payment prompt from Pay now. | yes | yes | ||
| Payments: mark paid | Record cash or bank money with Mark paid. | yes | yes | ||
| Payments: match | Match an unmatched payment to a customer. | yes | yes | ||
| Payments: query | Ask the provider "did this payment go through?" from the app. | yes | yes | yes | |
| Payments: refund | Record a refund or reversal. | ||||
| Payment providers: manage | Configure your payment providers under Settings. |
Routers
| Permission | What it lets you do | Ops | Cashier | Support | FieldTech |
|---|---|---|---|---|---|
| Routers: read | See the Routers list, status and checks. Viewer has this. | yes | yes | yes | |
| Routers: add | Run the Add router wizard. | yes | yes | ||
| Routers: manage | Edit, reboot, and change settings on a router. | yes | yes | ||
| Routers: raw commands | Run raw RouterOS commands. | yes | |||
| Routers: firmware | Upgrade router firmware. | yes | |||
| Routers: view script | View a router's onboarding script again. This is logged. | yes | |||
| Provisioning: read | See config profiles and the VLAN plan. Viewer has this. | yes | |||
| Provisioning: manage | Edit config profiles, the VLAN plan, and apply rollouts. | yes | |||
| Assets: read | See uploaded files such as logos. Viewer has this. | yes | |||
| Assets: manage | Upload and remove files. | yes |
Portal, SMS and reports
| Permission | What it lets you do | Ops | Cashier | Support | FieldTech |
|---|---|---|---|---|---|
| Portals: read | See the hotspot portal configuration. Viewer has this. | yes | |||
| Portals: edit | Edit the portal draft (theme, copy, plans). | yes | |||
| Portals: publish | Publish the portal draft to subscribers. | yes | |||
| SMS: read | See the SMS outbox, templates and routing. Viewer has this. | yes | |||
| SMS: manage | Manage SMS providers, routing and templates; send an ad-hoc SMS. | yes | |||
| Reports: read | Open Reports. Viewer has this. | yes | |||
| Reports: financial | See revenue and financial reports. | yes |
Team, tenants and settings
| Permission | What it lets you do | Ops | Cashier | Support | FieldTech |
|---|---|---|---|---|---|
| Users: read | See the Team page. Viewer has this. | yes | |||
| Users: invite | Invite a staff member. | yes | |||
| Users: manage roles | Change a staff member's role or remove them. | ||||
| Settings: manage | Change the Settings screens: tenant settings, notifications and providers. | yes | |||
| Tenants: read | See your tenant and any tenants below it. Viewer has this. | yes | |||
| Tenants: create child | Create a branch or a child ISP. | ||||
| Tenants: manage | Rename, suspend or configure child tenants. | ||||
| Tenants: switch | Switch into a child tenant and act there. | yes | |||
| Tenant settings: read | See inherited settings and where each value comes from. Viewer has this. | yes | |||
| Tenant settings: write | Override an inherited setting for your own tenant. | ||||
| Tenant settings: lock | Lock a setting so tenants below you cannot override it. | ||||
| Subscription: read | See Your subscription and its meters. Viewer has this. | yes | |||
| Subscription: manage | Change your plan and billing details. |
What Ops cannot do
Ops holds the whole catalogue except these, which need Owner:
- Payments: refund, and Payment providers: manage
- Users: manage roles
- Tenants: create child, and Tenants: manage
- Tenant settings: write, and Tenant settings: lock
- Subscription: manage
The pattern: Ops runs the ISP, but cannot move money out, change who has power, reshape the tenant tree, or change what every tenant below inherits.
How permissions are checked
- Your effective permissions are the union of every role you hold on the tenant you are acting in and its parents.
- When you switch into a child tenant, you keep the role your membership grants over that subtree. The acting banner reminds you where you are, and every action there is logged.
- Permission checks happen on the server for every request. Hiding a control in the app is a courtesy; the server would refuse the action anyway.
- Choose the built-in role closest to the person's job. A cashier who also fixes routers is better served by Ops than by two accounts.