> ## Documentation Index
> Fetch the complete documentation index at: https://docs.upwell.com/llms.txt
> Use this file to discover all available pages before exploring further.

# User Roles & Permissions

> Understanding user roles and access controls in the Upwell platform

## User Role Overview

Upwell uses a role-based access control system with four main user roles. Each role
provides different levels of access to platform features and data based on organizational
responsibilities.

## User Roles

### Member

<Card title="Member" icon="user">
  **Role Code**: `ORGMEMBER`

  **Access Level**: Standard user access

  **Typical Responsibilities**:

  * Process daily transactions

  * View assigned data and reports

  * Execute standard workflows

  * Access core platform features

    **Permissions**:

  * Read access to assigned data

  * Process invoices and payments within scope

  * Generate standard reports

  * Use integrated tools and features

    **Restrictions**:

  * Cannot modify system settings

  * Limited administrative functions

  * Cannot manage other users

  * Cannot access sensitive configuration areas
</Card>

### Admin

<Card title="Admin" icon="user-shield">
  **Role Code**: `ORGADMIN`

  **Access Level**: Administrative access

  **Typical Responsibilities**:

  * Manage organization settings

  * Configure workflows and rules

  * Manage user accounts and permissions

  * Oversee platform operations

    **Permissions**:

  * Full access to organization data

  * User management capabilities

  * Workflow and rule configuration

  * Integration setup and management

  * Advanced reporting and analytics

  * API key management

    **Additional Access**:

  * Workflow Settings section

  * Account management features

  * Integration configuration

  * Advanced system settings
</Card>

### Owner

<Card title="Owner" icon="crown">
  **Role Code**: `ORGOWNER`

  **Access Level**: Full organizational control

  **Typical Responsibilities**:

  * Ultimate authority over organization

  * Billing and subscription management

  * Strategic configuration decisions

  * Organization-wide policy setting

    **Permissions**:

  * All Admin permissions plus:

  * Billing and payment management

  * Organization deletion/modification

  * Ultimate user management authority

  * Strategic platform configuration

  * Contract and subscription management

    **Unique Capabilities**:

  * Transfer ownership

  * Delete organization

  * Manage billing settings

  * Set organization-wide policies
</Card>

### SYSADMIN

<Card title="SYSADMIN" icon="server">
  **Role Code**: `SYSADMIN`

  **Access Level**: System-wide administration

  **Typical Responsibilities**:

  * Platform-wide system management

  * AI and processing system oversight

  * Cross-tenant administration

  * System monitoring and maintenance

    **Permissions**:

  * Access to all organizations

  * AI system management

  * Processing event monitoring

  * System evaluation tools

  * Advanced diagnostic capabilities

    **Exclusive Features**:

  * AI Prompts management

  * AI Processing Events monitoring

  * System evaluations (Evals)

  * Factor management

  * CSV processing tools

  * Tenant SCAC codes management

  * GL codes administration

  * EDI review tools

    **Access Note**: This role is reserved for Upwell system administrators
</Card>

## Permission Inheritance

### Role Hierarchy

```text theme={null}
SYSADMIN (System Level)
  ↓
ORGOWNER (Organization Level)
  ↓
ORGADMIN (Administrative Level)
  ↓
ORGMEMBER (Standard User Level)
```

### Access Patterns

* **Higher roles inherit lower role permissions**
* **Additional permissions are added at each level**
* **Restrictions are applied based on organizational boundaries**
* **Feature flags can modify available functionality**

## User Management

### Adding Users

<Steps>
  <Step title="Access User Management">
    Navigate to Account → Users (Admin/Owner access required)
  </Step>

  <Step title="Invite New User">
    Click "Add User" and enter email address
  </Step>

  <Step title="Assign Role">
    Select appropriate role:

    * Member (standard users)
    * Admin (department managers)
    * Owner (organization leaders)
  </Step>

  <Step title="Send Invitation">
    User receives email invitation to join
  </Step>

  <Step title="User Activation">
    User completes account setup process
  </Step>
</Steps>

### Role Assignment Guidelines

<AccordionGroup>
  <Accordion icon="user" title="When to Assign Member Role">
    **Ideal for**:

    * Data entry personnel
    * Customer service representatives
    * Processing specialists
    * Standard operational staff

    **Use cases**:

    * Invoice processing
    * Customer inquiries
    * Data entry and verification
    * Standard report generation
  </Accordion>

  <Accordion icon="user-shield" title="When to Assign Admin Role">
    **Ideal for**:

    * Department managers
    * Operations supervisors
    * IT coordinators
    * Process improvement specialists

    **Use cases**:

    * Team management
    * Workflow configuration
    * Integration setup
    * Advanced reporting
    * User training and support
  </Accordion>

  <Accordion icon="crown" title="When to Assign Owner Role">
    **Ideal for**:

    * C-level executives
    * Business owners
    * Primary decision makers
    * Budget controllers

    **Use cases**:

    * Strategic planning
    * Billing management
    * Organization-wide policy
    * Contract negotiations
  </Accordion>
</AccordionGroup>

## Security Features

### Access Controls

* **Role-based permissions** ensure users only access appropriate features
* **Data scope limitations** restrict access to relevant information
* **Feature flags** control functionality availability
* **Audit logging** tracks all user actions

### Best Practices

1. **Principle of Least Privilege**: Assign minimum required permissions
2. **Regular Reviews**: Periodically review user roles and access
3. **Proper Onboarding**: Ensure new users understand their role boundaries
4. **Documentation**: Maintain records of role assignments and changes

## Feature Flag Integration

User roles work in conjunction with feature flags to control access:

* **SideNavDashboard**: Dashboard access control
* **SideNavShipments**: Shipments section visibility
* **SideNavInvoices**: Receivables section access
* **SideNavPayables**: Carrier Docs section control
* **And many others**: Each navigation item has associated feature flags

## Getting Help

### Role-Related Support

* **Access Issues**: Contact your organization admin
* **Permission Questions**: Review this guide or contact support
* **Role Changes**: Request changes through your organization owner
* **Technical Support**: [Contact Upwell Support](mailto:support@upwell.com)

### Common Questions

<AccordionGroup>
  <Accordion icon="question" title="How do I request additional permissions?">
    Contact your organization admin or owner to discuss your access needs.
    They can modify your role or grant additional permissions as appropriate.
  </Accordion>

  <Accordion icon="question" title="Why can't I see certain menu items?">
    Navigation visibility is controlled by both your user role and feature flags.
    Contact your admin if you believe you should have access to specific features.
  </Accordion>

  <Accordion icon="question" title="What happens if I need temporary admin access?">
    Admins can temporarily modify user roles for specific projects or tasks.
    Ensure roles are reset appropriately when temporary access is no longer needed.
  </Accordion>
</AccordionGroup>