What is RBAC?

RBAC stands for Role-Based Access Control. It's a system that determines what each user can see and do within Marketspread based on their assigned role.

Why it matters

RBAC helps your organization by:

• Security - Users only access what they need, reducing risk of accidental changes
• Efficiency - Staff see relevant features without clutter from unused tools
• Compliance - Track who has access to sensitive data like finances
• Delegation - Safely give team members specific responsibilities

How it works

The RBAC system has three key concepts:

You assign a role to a user, and they receive all the permissions that role contains.

Understanding roles

Marketspread provides four default roles designed for common organizational needs. You can also create custom roles for specific situations.

You can't change or delete the four default roles below, but a custom role you create is yours to edit or remove.

Administrator

Full access to everything. Administrators can manage all aspects of the organization including settings, user management, finances, and system configuration.

Best for:

• Organization owners and primary decision-makers
• IT staff responsible for system setup
• Users who need unrestricted access

Manager

Day-to-day operations access. Managers can handle most operational tasks like working with vendors, managing events, and processing invoices. They cannot change system settings or manage forms.

Best for:

• Market managers handling vendor relationships
• Team leads coordinating daily operations
• Staff who need broad operational access

What Managers can't do: Edit organization settings, manage custom forms, activate events, or edit layouts.

Accountant

Financial view-only access. Accountants can view all financial data including invoices, credits, payouts, and disputes. They cannot modify data, ensuring your financial records remain secure.

Best for:

• External bookkeepers and accountants
• Financial auditors
• Compliance officers reviewing transactions

Reporter

Reports-only access. Reporters can view and generate reports but cannot access other system features. This is the most limited default role.

Best for:

• Board members who need periodic reports
• Stakeholders who only need analytics
• Consultants reviewing performance data

Role comparison

Understanding permissions

Permissions are the building blocks of roles. Each permission grants the ability to perform a specific action within Marketspread.

How permissions are organized

Each area of Marketspread — like Invoices or Vendor Applications — has its own set of permissions. Viewing invoices, editing vendor information and reviewing vendor applications are each separate permissions within their area.

Permission hierarchy

Some permissions imply others. If you can edit something, you can usually also view it. The hierarchy typically follows:

This means giving someone the ability to edit invoices automatically lets them view invoices too - you don't need to add both permissions.

Financial permissions

Vendor management permissions

Events & scheduling permissions

Forms & content permissions

Reporting permissions

System & administration permissions

Entity-specific permissions

Common scenarios

Here are solutions for common access control situations:

"I want to give someone full access"

Solution: Assign the Administrator role.

"I need a read-only finance user"

Solution: Assign the Accountant role.

"I want someone to only manage applications"

Solution: Create a custom role with only application permissions.

"I want a manager who can't access finances"

Solution: Create a custom role based on Manager, minus financial permissions.

"I want someone to only run reports"

Solution: Assign the Reporter role.

How to manage roles

Adding a team member

1. Open Settings, then click Users.

   

2. Click Add user.

3. Enter their Email Address. If they don't already have a Marketspread account, one is created for them.

4. Optionally fill in their name, phone numbers and Title.

5. For each market, venue, vendor, association or your organization that you manage, choose a role from the dropdown next to it. Leave it as No role assigned to give them none there.

   

6. Click Add.

   

Creating a custom role

1. Open Settings, then click Roles & Permissions.

   

2. Click New role.

3. Enter a Role Name.

4. To start from another role's permissions, choose it under Copy permissions from. Otherwise it starts with none.

   

5. Click Create Role.

6. Select your new role from the list on the left, then check the permissions it should have.

   

7. Click Save Changes.

Modifying existing access

1. Open Settings, then click Users.

2. Click the pencil icon next to the person you want to change.

   

3. Change their role for any market, venue, vendor, association or your organization. Set it back to No role assigned to take it away.

   

4. Click Save.

Removing access

1. Open Settings, then click Users.

2. Click the trash icon next to the person you want to remove.

   

3. Click Delete to confirm.

   

Best practices

Principle of least privilege

Give users only the permissions they need to do their job. This reduces risk and makes it easier to audit who has access to what.

• Start with the most restrictive role that allows them to work
• Add permissions as needed rather than removing them later

Regular access reviews

Periodically review who has access to your organization:

• Quarterly review all team members and their roles
• Remove access for people who no longer need it
• Downgrade permissions for users who have more than they need
• Document why custom roles were created

Role documentation

Keep track of custom roles and why they exist:

• Name custom roles descriptively (e.g., 'Saturday Volunteer' not 'Custom Role 1')
• Note who uses each custom role
• Review custom roles periodically to see if they're still needed

Security tips

• Limit Administrators - Only organization owners should have full admin access
• Use Accountant for auditors - Read-only financial access prevents changes
• Separate duties - The person creating invoices shouldn't also approve payments
• Offboard promptly - Remove access the same day someone leaves
• Review after incidents - If something goes wrong, check if permissions contributed

Quick reference

Default roles summary

Permission actions

Permission groups by category

Financial:
Invoices, Credits, Payouts, Disputes, Orders

Vendor Management:
Vendors, Vendor Applications, Vendor Events, Vendor Notes, Vendor Forms

Events & Scheduling:
Events, Event Days, Event Day Notes, Event Day Forms, Scheduler, Sales Reporting

Content & Forms:
Forms, Surveys, Posts, Products, Store

Reporting:
Data Reports, HTML Reports, Dashboard

System:
Settings, RBAC, Messenger, Metrics, Notifications, Calendar, Customers, AI Assistant