Users & Roles (RBAC)
Manage team members in IEMSuite with role-based access control - invite users, assign roles, and understand the permission matrix for each role.
IEMSuite uses Role-Based Access Control (RBAC) to ensure team members have exactly the permissions they need - no more, no less. Every action in the system is gated by a specific permission check.
Role-Based Access Control
Each user in your organization is assigned one or more roles. Roles are collections of permissions. Permissions follow an Entity:Action format (e.g., Order:read, StockLot:write, User:manageRoles).
A user's effective permissions are the union of all permissions from all assigned roles.
How Roles Work
There are no fixed, pre-defined roles. The person who creates the organization is its admin with full access; every other role is one you define under Settings → Roles & Permissions. A role is simply a named bundle of permissions - build roles that match your real job titles, for example:
- Warehouse Operator - inventory read/write, inbound logging, shipments; no costs or billing.
- QC Inspector - QC inspections and NCR creation; no settings access.
- Operations Manager - orders, inventory, production, and reports; no user management.
- Viewer - read-only permissions across the modules you choose.
Permissions are grouped by module (Dashboard, Orders, Clients, Products, Inventory, Recipes, Production, QC, Shipments, Cost Analysis, Settings…), each with its own actions, so you can grant exactly what a job needs and nothing more.
Inviting Team Members
Go to Settings → Team Members and click "Invite Member"
Enter the team member's email address and name.
Select a role
Choose the role that defines what they can see and do.
Send the invite
The user receives an invitation email with a temporary password.
User signs in
They log in with the temporary password and should change it right away under Settings → Security.
Custom Roles
Create as many roles as you need on any plan. Navigate to Settings → Roles & Permissions, click Create Role, give it a name and description, and select individual permissions from the permission list grouped by module.
Revoking Access
To remove a team member, go to Settings → Team Members → [user] → Remove from Organization. All active sessions are immediately invalidated. The user's historical actions and records are retained for audit purposes.