Guide to Business Permissions in Cybix: Roles, Positions, and Scopes

For Managers

This guide explains how the visible business permissions system works in Cybix: Roles, Role Access, Access Levels, Scopes, Positions, and Position Overrides. The goal is to enable a clear and efficient configuration for any organization without creating duplicate roles for every job position.

💡 Main Rule of the System:

Role Access defines the base role • Position defines the job title, department, associated role, and default scope • Position Overrides define job-specific exceptions • Scopes determine record visibility limits • Allowed Actions define which buttons or actions can be executed.

1. Access Evaluation Layers

Effective access for a user in Cybix is determined by combining 4 fundamental layers:

  1. Spatie Permissions (Technical Layer): Base technical identity in Laravel. The Super Administrator role includes a direct technical bypass.
  2. Module Access / Entitlements: Defines whether the module is enabled in the Workspace. If a module is not active or subscribed, access is blocked regardless of user permissions.
  3. Business Permissions: Visible business configuration layer (Roles, Access Levels, Scopes, and Overrides).
  4. Workforce / Organization: Defines the position, department, and organizational hierarchy of the user.

2. Business Roles

Cybix uses an optimized set of active roles. Job-level variations within the same team are handled through Positions, rather than creating extra roles.

Role Recommended Use Base General Scope
Super Administrator Internal technical role with full bypass (developers or root administration). Admin / Company
Company Owner Company owner with full control over modules. Admin / Company
Manager Operational management with supervision and approval capabilities. Supervisor / Company
Assistant Basic administrative support and assistance tasks. Standard / Assigned
Sales Commercial team (sales agents and sales managers). Standard / Assigned
Administrative Administrative operations, basic billing, scheduling, and calls. Standard / Department
Operations Operational staff and assigned tasks. Standard / Assigned
Human Resources Personnel management, recruitment, and attendance. Standard / Department
Fleet Fleet management, GPS tracking, and vehicle operations. Standard / Department
Accountant Finance, advanced Billing, payroll, and financial reports. Admin / Company
Customer Limited external access exclusively to own data. View Only / Own

3. Base Departments and Default Positions

The base department structure consists of 4 core areas: Management, Operations, Sales, and Finance. There is no need to create artificial departments to solve permissions.

Default Positions model real-world roles by automatically assigning the associated role:

Position (Default Title) Associated Role Department Default Scope
CEO / Owner Company Owner Management Company
General Manager Manager Management Company
Office Administrator Administrative Operations Department
Administrative Assistant Assistant Operations Assigned
Sales Manager Sales Sales Department
Sales Agent Sales Sales Assigned
Operations Staff Operations Operations Assigned
HR & Payroll Coordinator Human Resources Operations Department
Fleet Coordinator Fleet Operations Department
Finance Manager Accountant Finance Company
Customer / Client Contact Customer Management / No Dept Own

4. Access Scopes and Access Levels

Access Scopes

Scopes restrict which specific records a user can view or edit within a module:

  • Own (own): Only records created by the user.
  • Assigned (assigned): Records explicitly assigned to the user.
  • Department (department): Records belonging to members of the user’s department.
  • Branch (branch): Records belonging to the user’s branch.
  • Company (company): Full access to all company records.

Access Levels

Determine the preset group of allowed actions:

  • No Access: Disables all actions for the module.
  • View Only: Enables view-only access (View).
  • Standard: Enables view, create, and edit actions (View, Create, Edit).
  • Supervisor: Adds management actions (Assign, Approve, Review, Reports, Export, Complete).
  • Admin: Enables all available actions within the module.

5. Position Overrides

Position Overrides allow fine-tuning exceptions for specific job titles without creating new roles.

Practical Example: Both a Sales Agent and a Sales Manager share the Sales role. The Sales Agent defaults to Assigned scope without export or approval permissions. The Sales Manager uses a Position Override to grant Department scope and enable actions such as Assign, Approve, or Reports.

6. User Access Audit

From the /admin/users screen, clicking the Access button provides real-time visibility into:

  • Active positions and assigned roles.
  • Effective permitted modules and actions.
  • Role Access or Position Override rules determining the final evaluation result.
0
97

Related Knowledgebase