# Users and roles

## Inviting users

Administrators add people under **Administration → Users**. A new user gets a one-time temporary password and must set their own at first sign-in. Administrators can also reset a user's password or two-factor from the same screen.

## Roles

Every organisation starts with four roles:

| Role | Typically for |
|---|---|
| **Administrator** | Owners. Everything, including users and roles. |
| **Manager** | Day-to-day invoicing and masters. |
| **Accountant** | Your CA: invoices, CA register, payments. |
| **Viewer** | Read-only access. |

Create your own under **Administration → Roles**, ticking exactly the actions each role may perform, module by module.

## How permissions are enforced

- Permissions are checked **on the server** for every page and action. A hidden button is a courtesy, not the security.
- Changes apply on the person's **next click**, not their next sign-in.
- Disabling a user ends their access immediately.

> **Warning:** Anyone who can edit users or roles can grant themselves anything. Treat those permissions as admin.