Learning Center

What is RBAC?

RBAC stands for Role-Based Access Control. It's a system that determines what each user can see and do within Marketspread based on their assigned role.

Why It Matters

RBAC helps your organization by:

• Security - Users only access what they need, reducing risk of accidental changes
• Efficiency - Staff see relevant features without clutter from unused tools
• Compliance - Track who has access to sensitive data like finances
• Delegation - Safely give team members specific responsibilities

How It Works

The RBAC system has three key concepts:

You assign a role to a user, and they receive all the permissions that role contains.

Understanding Roles

Marketspread provides four default roles designed for common organizational needs. You can also create custom roles for specific situations.

Administrator

Full access to everything. Administrators can manage all aspects of the organization including settings, user management, finances, and system configuration.

Best for:

• Organization owners and primary decision-makers
• IT staff responsible for system setup
• Users who need unrestricted access

Manager

Day-to-day operations access. Managers can handle most operational tasks like working with vendors, managing events, and processing invoices. They cannot change system settings or manage forms.

Best for:

• Market managers handling vendor relationships
• Team leads coordinating daily operations
• Staff who need broad operational access

What Managers can't do: Edit organization settings, manage custom forms, activate events, or edit layouts.

Accountant

Financial view-only access. Accountants can view all financial data including invoices, credits, payouts, and disputes. They cannot modify data, ensuring your financial records remain secure.

Best for:

• External bookkeepers and accountants
• Financial auditors
• Compliance officers reviewing transactions

Reporter

Reports-only access. Reporters can view and generate reports but cannot access other system features. This is the most limited default role.

Best for:

• Board members who need periodic reports
• Stakeholders who only need analytics
• Consultants reviewing performance data

Role Comparison

Understanding Permissions

Permissions are the building blocks of roles. Each permission grants the ability to perform a specific action within Marketspread.

Permission Format

Permissions follow a consistent format: group.action

For example:

• invoices.view - Can view invoices
• vendors.edit - Can edit vendor information
• vendor-applications.review - Can review vendor applications

Permission Hierarchy

Some permissions imply others. If you can edit something, you can usually also view it. The hierarchy typically follows:

This means giving someone invoices.edit automatically lets them view invoices too - you don't need to add both permissions.

Permission Groups

Permissions are organized into functional groups. Here's what each group controls:

Financial Permissions

Vendor Management Permissions

Events & Scheduling Permissions

Forms & Content Permissions

Reporting Permissions

System & Administration Permissions

Entity-Specific Permissions

Scoped Permissions

Scoped permissions let you limit access to specific items rather than granting full access to a category. This is powerful when you want someone to work with only certain vendors, events, or forms.

What Scoping Means

Instead of granting access to all items, you can limit access to specific ones:

Permission Groups That Support Scoping

The following permission groups can be scoped to specific items:

• vendors - Scope to specific vendors
• vendor-events - Scope to specific events/seasons
• vendor-applications - Scope to specific applications
• events - Scope to specific events/seasons
• event-days - Scope to specific events/seasons
• scheduler - Scope to specific events/seasons
• sales-reporting - Scope to specific events/seasons
• forms - Scope to specific forms
• data-reports - Scope to specific saved reports
• html-reports - Scope to specific saved reports
• applications - Scope to specific application forms
• layouts - Scope to specific layouts
• dashboard - Scope to specific dashboard views

When to Use Scoped Permissions

• Volunteer coordinators - Access only to specific event days they manage
• Vendor liaisons - Access only to vendors they're responsible for
• Seasonal staff - Limited to specific seasons or events
• External partners - Access to only their related data
• Department heads - Access to forms and reports for their area only

How to Apply Scopes

When editing a user's role permissions, look for the scope option next to permissions that support it. You can then select specific items instead of granting full access. If no scope is selected, the user gets access to all items in that category.

Tip: Start with scoped access and expand as needed. It's easier to grant additional access than to remember to restrict it later.

Common Scenarios

Here are solutions for common access control situations:

"I want to give someone full access"

Solution: Assign the Administrator role.

"I need a read-only finance user"

Solution: Assign the Accountant role.

"I want someone to only manage applications"

Solution: Create a custom role with only application permissions.

"I want a manager who can't access finances"

Solution: Create a custom role based on Manager, minus financial permissions.

"I want a volunteer to manage only the Saturday market"

Solution: Create a custom role with scoped permissions.

"I want someone to only run reports"

Solution: Assign the Reporter role.

How to Manage Roles

Adding a Team Member

Step 1: Access User Management

• Log in as an Administrator
• Go to Settings (gear icon in the sidebar)
• Select 'Team Members' or 'User Management'

Step 2: Add the User

• Click 'Add Team Member' or 'Invite User'
• Enter their email address
• They'll receive an invitation to create an account

Step 3: Assign a Role

• Choose a default role (Administrator, Manager, Accountant, Reporter)
• Or select 'Custom' to pick individual permissions
• If using scoped permissions, select the specific items they can access

Step 4: Save and Notify

• Click 'Save' or 'Send Invitation'
• The user's access is active immediately upon accepting the invitation

Modifying Existing Access

• Go to Settings → Team Members
• Find the user you want to modify
• Click on their name or the edit button
• Adjust their role or permissions
• Save changes - they take effect immediately

Removing Access

• Go to Settings → Team Members
• Find the user to remove
• Click 'Remove' or the trash icon
• Confirm the removal

Important: When a team member leaves your organization, remove their access immediately. They will no longer be able to log in or view any data.

Best Practices

Principle of Least Privilege

Give users only the permissions they need to do their job. This reduces risk and makes it easier to audit who has access to what.

• Start with the most restrictive role that allows them to work
• Add permissions as needed rather than removing them later
• Use scoped permissions when someone only needs access to specific items

Regular Access Reviews

Periodically review who has access to your organization:

• Quarterly review all team members and their roles
• Remove access for people who no longer need it
• Downgrade permissions for users who have more than they need
• Document why custom roles were created

Role Documentation

Keep track of custom roles and why they exist:

• Name custom roles descriptively (e.g., 'Saturday Volunteer' not 'Custom Role 1')
• Note who uses each custom role
• Review custom roles periodically to see if they're still needed

Security Tips

• Limit Administrators - Only organization owners should have full admin access
• Use Accountant for auditors - Read-only financial access prevents changes
• Separate duties - The person creating invoices shouldn't also approve payments
• Offboard promptly - Remove access the same day someone leaves
• Review after incidents - If something goes wrong, check if permissions contributed

Quick Reference

Default Roles Summary

Permission Actions

Permission Groups by Category

Financial:
invoices, credits, payouts, disputes, orders

Vendor Management:
vendors, vendor-applications, vendor-events, vendor-notes, vendor-forms

Events & Scheduling:
events, event-days, event-day-notes, event-day-forms, scheduler, sales-reporting

Content & Forms:
forms, surveys, posts, products, store

Reporting:
data-reports, html-reports, dashboard

System:
settings, rbac, messenger, metrics, notifications, calendar, customers