Users & Roles
User management, role-based access control, and permission sets
Overview
OptiCRM has a comprehensive access control system with 11 built-in roles, permission sets, field-level security, and record sharing rules.
Creating Users
Navigate to Admin > All Users and click Create User:
- Enter name, email, role, and temporary password
- Click Create — user is created and receives a welcome email with credentials
- User logs in and should change their password
Built-In Roles
| Role | Description | Typical Permissions |
|---|---|---|
| Super Admin | Platform operator | Everything |
| Institution Admin | School administrator | Full institution access |
| Principal | School principal | Read all, manage academic |
| HOD | Head of department | Department-scoped access |
| Teacher | Subject teacher | Attendance, marks, assignments |
| Admissions Counsellor | Admissions team | Enquiries, admissions |
| Finance Officer | Accounts team | Fee structure, invoices, payments |
| Librarian | Library staff | Catalogue, circulation |
| Parent | Parent/guardian | Portal read + pay fees |
| Student | Student | Portal read-only |
| Staff | General staff | Self-service only |
Permission Sets
Permission sets are bundles of additional permissions that can be assigned to users beyond their role's base permissions.
Settings > Permission Sets:
- Create a permission set (e.g., "Report Manager")
- Add permission grants (which objects, which actions)
- Assign to specific users
- Optional expiry date
Advanced Access Control
| Feature | Location | Description |
|---|---|---|
| Object Permissions | Settings > Object Permissions | Per-object CRUD permissions per role |
| Field-Level Security | Settings > Field Security | Control which fields are visible per profile |
| Record Sharing | Admin > Sharing | Criteria-based record sharing rules |
| Data Scoping | Settings > Data Access Rules | Row-level visibility rules |
| Role Hierarchy | Admin > Role Hierarchy | Hierarchical role inheritance |
| Org-Wide Defaults | Admin settings | Default access level per object |
Password Reset
Users who forget their password can:
- Click "Forgot your password?" on the login page
- Enter their email address
- Receive a reset link (valid for 1 hour)
- Set a new password
Admins can also reset passwords via the CLI script: npx tsx scripts/reset-password.ts