# NexWave Role Catalogue

This page is the lookup reference for the roles that ship with NexWave. Use it when you need to decide which roles to give a new user, or when you are auditing who has access to what.

For the conceptual model and how roles fit alongside Role Profiles and User Permissions, start with [Roles, Permissions & User Access](/doc/91ba21d0-ed81-4f08-898f-846f5c1a43d4).

## How to read this page

* The first section lists every role you are likely to use, with a plain-English description of what it grants and the typical job functions it suits.
* The second section maps common job functions to a recommended bundle of roles. Most admins will spend more time in the second section than the first.
* The third section covers a few special cases (the `Desk Access` flag, NexWave-specific roles, dynamically-created approver roles).

## Shipped Roles

The table covers the roles a NexWave administrator routinely works with. NexWave ships dozens of additional roles for niche use cases (for example specific localisation roles, or roles tied to add-on apps); leave those alone unless the relevant module is in use.

| Role | What it grants | Typical job functions | Key documents and modules |
|------|----------------|-----------------------|---------------------------|
| **System Manager** | Full control of NexWave: settings, users, integrations, customisation. The most powerful role in the system. Hand out sparingly. | IT admin, NexWave implementation lead | All. Especially System Settings, User, Role, Custom Field |
| **Accounts Manager** | Approves and posts to the general ledger; configures accounting setup. | Financial controller, senior accountant, CFO | Chart of Accounts, Journal Entry, Period Closing Voucher, Tax Templates, Cost Center |
| **Accounts User** | Day-to-day bookkeeping: invoices, payments, expense entry. | Bookkeeper, accounts assistant | Sales Invoice, Purchase Invoice, Payment Entry, Bank Transaction |
| **Auditor** | Read-only access across financial records. | External auditor, board member | All accounting reports and ledgers (view only) |
| **Sales Manager** | Approves quotations and sales orders; manages pricing and customers. | Sales team lead, branch manager | Quotation, Sales Order, Customer, Pricing Rule |
| **Sales User** | Creates quotations, sales orders, customers and leads. | Salesperson, account manager | Quotation, Sales Order, Customer, Lead |
| **Stock Manager** | Sets up warehouses and stock policy; approves stock adjustments. | Warehouse manager, inventory controller | Warehouse, Stock Reconciliation, Stock Entry, Item |
| **Stock User** | Performs day-to-day stock movements: receipts, deliveries, transfers. | Storeperson, warehouse operator | Delivery Note, Purchase Receipt, Stock Entry, Bin |
| **Item Manager** | Maintains the item master and pricing. | Product manager, item master owner | Item, Item Price, Item Group, UOM |
| **Purchase Manager** | Approves purchase orders and supplier setup. | Procurement manager   | Purchase Order, Supplier, Request for Quotation |
| **Purchase User** | Creates material requests and purchase orders. | Buyer, purchasing officer | Material Request, Purchase Order, Supplier Quotation |
| **HR Manager** | Configures payroll structures, leave policies, holiday calendars. | HR lead, payroll manager | Salary Structure, Payroll Entry, Leave Policy, Employee |
| **HR User** | Manages employee records, leave applications, attendance. | HR officer            | Employee, Leave Application, Attendance, Expense Claim |
| **Manufacturing Manager** | Approves BOMs, production plans and work orders. | Production manager, planner | BOM, Production Plan, Work Order, Routing |
| **Manufacturing User** | Operates against work orders and job cards. | Production operator, machine operator | Work Order, Job Card, Stock Entry (Manufacture) |
| **Quality Manager** | Defines and reviews quality inspections. | QA / QC lead          | Quality Inspection, Quality Procedure, Quality Goal |
| **Maintenance Manager** | Plans asset and plant maintenance. | Facilities lead, plant maintenance manager | Asset Maintenance, Asset Repair |
| **Maintenance User** | Executes maintenance tasks against assets. | Maintenance technician | Asset Maintenance Log, Asset Repair |
| **Projects User** | Records timesheets and progresses tasks. | Project member, billable consultant | Project, Task, Timesheet  |
| **Employee** | Self-service portal: leave, expenses, timesheets, payslips. | Every internal staff member | Employee Self Service portal |
| **Customer** | Customer portal: view orders, invoices, raise tickets. | Customer (external)   | Sales Order, Sales Invoice (own records), Issue |
| **Supplier** | Supplier portal: view purchase orders, submit invoices. | Supplier (external)   | Purchase Order, Request for Quotation |
| **NexWave AI User** | Access to the NexWave AI Assistant page. | Any user the customer wants to enable AI for | NexWave AI Conversation, NexWave Assistant page |

## Job Function to Role Bundle

These are recommended starting points. Pick the closest match, then trim or add roles based on what the user actually needs.

| Job function | Recommended roles | Notes |
|--------------|-------------------|-------|
| **System Administrator** | `System Manager`  | One or two people only. Enable Two-Factor Authentication. |
| **Bookkeeper / Accounts Assistant** | `Accounts User`, `Employee` | Add `Purchase User` if they raise purchase orders. |
| **Senior Accountant / CFO** | `Accounts Manager`, `Accounts User`, `Auditor`, `Employee` | `Auditor` gives cross-module read access useful for reviews. |
| **External Auditor (read-only)** | `Auditor`, `Employee` (optional) | Time-box the user; disable the account when the audit ends. |
| **Office Manager** | `Accounts User`, `Purchase User`, `HR User`, `Sales User`, `Employee` | Broad access without Manager-tier approval rights. |
| **Salesperson** | `Sales User`, `Employee` | Add `Item Manager` only if they maintain pricing. Restrict by Territory via User Permission if needed. |
| **Sales Manager** | `Sales Manager`, `Sales User`, `Employee` | Restrict by Territory via User Permission for branch managers. |
| **Warehouse Operator** | `Stock User`, `Employee` | Add `Manufacturing User` if they handle production stock. |
| **Warehouse Manager** | `Stock Manager`, `Stock User`, `Item Manager`, `Purchase User`, `Employee` | Often handles supplier receipts as well as outbound. |
| **Purchasing Officer** | `Purchase User`, `Stock User`, `Employee` | `Stock User` is needed to record Purchase Receipts. |
| **Procurement Manager** | `Purchase Manager`, `Purchase User`, `Employee` |       |
| **HR Officer** | `HR User`, `Employee` | Use `HR Manager` only for the payroll lead. |
| **Production Operator** | `Manufacturing User`, `Stock User`, `Employee` |       |
| **Production Supervisor** | `Manufacturing Manager`, `Manufacturing User`, `Stock User`, `Quality Manager`, `Employee` |       |
| **Customer (portal only)** | `Customer`        | Disable Desk Access on the User record. |
| **Supplier (portal only)** | `Supplier`        | Disable Desk Access on the User record. |
| **AI Assistant pilot user** | (existing role bundle), `NexWave AI User` | Add on top of any of the bundles above. |

 ![User record with multiple roles](https://docs.nexwaveapp.com/api/files.get?sig=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrZXkiOiJ1cGxvYWRzL2YxMTg5ZTEzLTdlMTQtNDA1ZC04MDI1LWMxZmI0Y2Y2MTg0ZC80Y2MyNDhjNi1kMWQ0LTQxNDUtYmZhYy1jMGI2ZWU4NWQ1ZmMvMDUtdXNlci13aXRoLXJvbGVzLnBuZyIsInR5cGUiOiJhdHRhY2htZW50IiwiaWF0IjoxNzkyNjIwOTAwLCJleHAiOjE3OTI3MDczMDB9.c6HcRCbSartSNPaMtdtXm49-lCGBTSFXYpNyWDh8kyc)

## Special Cases

### Desk Access flag

`Desk Access` is not a role: it is a tickbox on the User record.

* **Desk Access on:** the user can log into the full NexWave back-office (the desk).
* **Desk Access off:** the user is restricted to the customer / supplier / employee portal. Use this for external contacts who only need to see their own records.

If you give a user the `Customer` or `Supplier` role, set Desk Access to off so they cannot accidentally land on a desk page.

### Two-tier roles (Manager and User)

Most NexWave modules ship with a `Manager` and a `User` role. The convention is:

* `User` = day-to-day creators of documents (a Sales User creates Quotations).
* `Manager` = approvers and configuration owners (a Sales Manager edits Pricing Rules and approves Quotations on workflows).

Always assign the `User` role first, then add the `Manager` role only if approval rights are genuinely needed. Both roles can be held by the same person.

### NexWave-specific roles

Some roles are added by the NexWave layer rather than the underlying framework:

* **NexWave AI User** controls access to the NexWave AI Assistant. Add it in addition to a user's regular role bundle once they are signed off to use AI.
* **Purchase Approver tiers** may appear if the customer has the dynamic approval workflow enabled. These roles are created automatically when an approval tier is configured. Do not delete them; they are managed by the workflow.

If you see roles in the Role list that are not covered above and not part of the framework defaults, check with the implementation lead before assigning them. They may be feature-specific or customer-specific.

### What about Manufacturing, Quality and Maintenance roles for non-manufacturing customers?

If the customer does not use those modules, ignore those roles. They cannot be removed from the system, but unassigned roles do nothing.

## Cleaning up custom roles

If a customer was migrated from another system, you may inherit a long list of one-off roles. Recommended clean-up:


1. Open the Role list and identify roles with one or zero users.
2. For each, decide whether the access pattern is genuinely unique. If not, retire the role and reassign the user to a shipped role.
3. Disable rather than delete: setting `Disabled = Yes` keeps the audit trail clean while taking the role out of circulation.

## Related Documentation

* [Roles, Permissions & User Access](/doc/91ba21d0-ed81-4f08-898f-846f5c1a43d4): conceptual overview, playbooks and audit guidance.
* [User Permissions and Record-Level Access](/doc/fb86047e-b868-4ff5-8951-349d966e3808): scoping a role to specific companies, branches, warehouses or territories.
* [Creating a User](/doc/31737f86-ca60-410d-a92f-18f5d4cf5688): step-by-step on adding a new user.
* [Role Permissions Manager](/doc/a04ce120-aaa1-444a-825e-543dc636d97b): advanced doctype-level permission tuning.