Users and roles
A role is the whole of somebody's access. Vorniqe checks permissions in the service layer and again in the database, and the interface only ever hides things — hiding a button has never granted anybody anything.
How it works
- 01
Invite the people who sell
Each person gets one role. Start with the roles as they come — changing them later is easy, and changing them on day one is guesswork.
- 02
Understand what a role gates
A role decides which screens exist for that person and which actions they can take. Somebody without stock permissions can still reserve a car, because reserving is a sales act.
- 03
Keep admin small
Organisation admin can change how the dealership is set up. That is not the same job as selling cars, and it should not be the same set of people.
- 04
Remove access when somebody leaves
Their history stays — the enquiries they worked, the outcomes they recorded. What goes is the ability to sign in.
Worth knowing
Permission is enforced on the server for every request. The interface hiding a button is a convenience, never a security boundary.
Removing a person does not remove their work. A salesperson leaving should not delete a year of recorded evidence.