The Application roles page shows what each member can do inside each app of one organization, and lets you add or remove app roles without opening the full member editor. An app role works only inside that app, and only in the organization where the app was granted.
Where to find it
- Select the organization in the sidebar switcher.
- Click Current organization → Application Roles.
URL: /portal/orgs/{organization}/application-roles.
Only the organization's Owners and Organization Managers see this page. Others get a 403 "access denied" page.
How access works
A person's access to an app in an organization needs all of these:
- Membership — they are an active member of the organization (organization role Owner, Organization Manager, Member or Viewer).
- App access — the app is granted to them in that organization (ticked in the invite or member editor). Each grant uses a seat.
- App role — one role inside that app (for example Accountant (Member)).
- Plan — the organization's plan for that app includes the feature.
- Scope (some roles) — the warehouses, departments or employees they may work with, set inside the app.
Owners skip steps 2 and 3. They have full access to every app in the organization's plan. The page says so at the top, for example: "Mariam Al Hashimi is an owner and has full access to every app here, so no app roles are needed."
What the page shows
| Area | What it shows |
|---|---|
| Owner banner | Names of the owners, with the full-access note. |
| Search | "Search members". Shown when there are more than three non-owner members. |
| Member card | Photo, name (opens mini profile), email, organization role pill, Inactive badge if they are not an active member. |
| App blocks | One block per app in the organization: the app name and Has access or No access. |
| Role chips | The member's current role(s) in that app, each with a Remove control. No role yet — pick one below if the app is granted without a role. |
| Add a role… picker + Assign | Adds another role in that app. Only roles that can be given in standard invitations, and that the member doesn't already have, are offered. |
| Give access to this app → | Shown for apps the member has no access to. Opens the member editor to grant the app. |
| Pending invitations | Emails invited but not yet accepted. "Roles apply once they accept". |
| Role guide (right) | Can/Cannot explanation of every role. It follows whichever role picker you point at. |
If the page was opened from an app's setup screen, a Return to setup button appears top-right.
Assign an app role
- Find the member's card and the app block (it must show Has access).
- Open Add a role… and pick a role. The role guide on the right shows what it allows.
- Click Assign (shows Saving…).
- You see "Application role assigned." (or "Application role was already assigned." if it was already there).
Remove an app role
- Click Remove on the role chip.
- Confirm in the dialog "Remove app role?" — "name — role (app)."
- You see "Application role removed."
Removing a role does not remove the app grant (the seat). To remove the app completely, use Edit on the Team page and untick the app.
Assign a role to yourself
Some app setup screens send an owner here to take a role in an app. The page then shows a panel Assign application role to yourself: "This role applies only to this application in the selected organization." Click Assign role: Role to confirm. Only some roles can be self-assigned by owners: Accountant (Member), Finance Manager, Projects Manager, POS Administrator, Store Manager. Sales and Purchasing cannot.
SolaCount roles
| Role | Summary | Can | Cannot | Scope |
|---|---|---|---|---|
| Accountant (Member) | Day-to-day bookkeeping: sales, purchases, banking and VAT. | Create, post and send invoices, receipts and credit notes; create, post and pay bills, expenses and debit notes; create, post and reverse journals; import bank statements and reconcile; prepare and file VAT returns; view and export reports; manage customers, vendors, quotes and orders; maintain inventory items and adjustments. | Change settings, users, taxes or organization setup; delete accounts, change account types or reopen periods; approve fixed assets or owner transfers; manage bank rules or budgets; approve timesheets or mileage. | Organization-wide. |
| Finance Manager | Everything an accountant does, plus approvals, budgets and period locks. | Everything an Accountant can do; approve fixed assets, run depreciation and disposals; manage budgets, recurring templates and bank rules; approve timesheets, mileage and rental settlements; lock accounting periods and view the audit log; manage dimensions, price lists and pricing rules. | Manage users, organization settings or API keys; edit tax rates or codes; delete or retype accounts; unlock or reopen periods; approve or cancel sales and purchase orders. | Organization-wide. |
| Sales | Prepare customer and sales documents within your authorized organization. | Manage customers and sales drafts; view selling prices and sales balances; view available quantities and delivery status. | Post, collect, refund, reverse or override approvals without separate permissions; view purchasing costs, profit margins or company financial statements; confirm stock delivery or administer settings, banking or team access. | SolaCount only. Existing approval and record-scope rules still apply. |
| Purchasing | Prepare supplier and purchasing documents within your authorized organization. | Manage suppliers and purchase drafts; view supplier prices, purchasing history and supplier balances; view available quantities and receiving status. | Post, pay, refund, reverse or override approvals without separate permissions; view customer transactions or company financial statements; confirm physical receipt or administer settings, banking or team access. | SolaCount only. Existing approval and record-scope rules still apply. |
| Finance Viewer | Read-only view of the books and reports. | View sales, purchases, payments, journals, banking, reconciliations, VAT returns, customers, vendors, accounts, tax rates, fixed assets, rentals and inventory; view and export financial reports. | Create, edit, post or delete any transaction; view project financials; change settings or master data. | Organization-wide, read-only. |
Sales and Purchasing (added 10 October 2026) are the two commercial roles for people who prepare customer or supplier documents but are not accountants. They are described in detail, with examples, in Sales and Purchasing roles. They are offered in invitations and on this page like the other SolaCount roles, but an owner cannot assign them to themselves (owners already have full access).
A Fixed Asset Approver role exists for special workflows but is not offered in standard invitations.
SolaStock roles
| Role | Summary | Can | Cannot | Scope |
|---|---|---|---|---|
| SolaStock Administrator | Full control of SolaStock, without owning the organization. | Everything in SolaStock, in every warehouse; change SolaStock settings and integrations; assign members' warehouses in Team access. | Manage the organization, billing or its members; open other apps unless granted separately. | All of SolaStock in this organization. |
| Inventory Manager | Runs inventory operations in assigned warehouses. | View dashboard, items, stock and fulfilment; receive and transfer stock; pick, pack, ship and reserve; manage zones and bins; create and edit purchase orders; view the stock ledger and inventory reports. | Approve or cancel purchase orders; post adjustments or opening stock; edit the item catalogue or create warehouses; change settings or export reports. | Assigned warehouses only. With no warehouse assigned they see none. |
| Warehouse Manager | Runs the floor of their warehouses. | View dashboard, items, stock and fulfilment; receive and transfer; pick, pack, ship and reserve; manage zones and bins. | Create or approve purchase orders; view the ledger or reports; post adjustments or edit the catalogue; change settings. | Assigned warehouses only. |
| Warehouse Operator | Hands-on warehouse work. | View dashboard, items, stock and fulfilment; receive against approved purchase orders; transfer between assigned warehouses; pick, pack, ship and reserve. | Manage zones, bins or warehouses; create or approve purchase orders; view the ledger or reports; post adjustments. | Assigned warehouses only. |
| Inventory Viewer | Read-only view of stock in their warehouses. | View the inventory dashboard, items, warehouses, stock balances, sales orders and fulfilment. | Receive, transfer, pick, pack or ship; view the ledger or reports; change any record. | Read-only, assigned warehouses only. |
Setting the scope: warehouses are chosen inside SolaStock at Admin → Team access (/team-access), which SolaStock Administrators (and owners) can open.
SolaProjects roles
| Role | Summary | Can | Cannot | Scope |
|---|---|---|---|---|
| Projects Administrator | Creates and manages every project in the organization. | See and open every project; create, edit and delete projects; archive and restore; manage members, tasks and project financials; approve and manage everyone's time entries. | Create or edit portfolios; administer the organization or other apps. | All projects in the organization, except explicit restrictions. |
| Projects Manager | Leads the projects they are assigned to. | Edit projects where they are project manager; add and remove members there; create, assign and delete tasks there; view financials and approve the team's time. | Create projects without a separate creation grant; see projects they are not a member of; delete, archive or restore projects. | Only projects they belong to. |
| Projects Member | Works on tasks and logs time. | View their projects; view tasks and update tasks assigned to them; log, edit and submit their own time. | Edit projects or manage members; create or delete tasks; view financials or approve time. | Only projects they belong to. |
SolaHR roles
| Role | Summary | Can | Cannot | Scope |
|---|---|---|---|---|
| SolaHR Administrator | Full control of SolaHR, without owning the organization. | Everything in SolaHR: employees, attendance, leave and payroll; change HR settings and view the audit log; assign members' departments and employees in Team access. | Manage the organization, billing or its members; open other apps unless granted separately. | All of SolaHR in this organization. |
| HR Manager | Runs HR operations for their departments and manages HR access there. | View employees and edit name, job title and work email; record today's attendance; approve or reject leave; view attendance and leave reports; manage HR access for teammates in their scope. | Access payroll or payslips without a separate grant; create or delete employees; change HR settings or view the audit log. | Assigned departments or employees. Payroll needs a separate owner grant. |
| Department Manager | Manages attendance and leave for their departments. | View employees and edit name, job title and work email; record today's attendance; approve or reject leave; view attendance and leave reports. | Manage others' HR access; access payroll, payslips or employee files; create or delete employees. | Assigned departments or employees. |
| Attendance Recorder | Records today's attendance. | See assigned employees on the operations screen; view and record today's attendance. | Open employee files or edit details; view or approve leave; view HR reports or payroll. | Assigned employees, today's date only. |
| HR Viewer | Read-only view of HR operations in their scope. | View employees in scope, attendance records, leave requests, attendance and leave reports. | Record attendance or approve leave; edit employee details; access payroll. | Read-only, assigned departments or employees. |
Department Manager was previously called Unit Manager.
Setting the scope: departments and employees are chosen inside SolaHR at System → Team Access (/team-access), which SolaHR Administrators (and owners) can open. A member appears there only after opening SolaHR once. Until something is assigned, a scoped member sees no employees.
SolaPOS and SolaFone roles
| App | Role | Summary |
|---|---|---|
| SolaPOS | POS Administrator | Everything a Store Manager can do, plus POS users, permissions and settings. Organization-wide. |
| SolaPOS | Store Manager | Catalogue, inventory, sales, refunds, registers and reports. Cannot manage POS users or settings. Assigned branches. |
| SolaPOS | Cashier | View catalogue, make and view sales, use a register. Cannot refund, change catalogue or view reports. Assigned branches. |
| SolaFone | Store Manager | Sales, discounts and refunds, repairs, stock, items, customers, purchases, registers and shifts, reports. Cannot manage users, branches or settings, or delete items or stock movements. Assigned branches. |
| SolaFone | Cashier | Sales, discounts, reprints, customers, own register and shift, cash in/out. Cannot refund, void, change stock or prices, or view reports. Own shift, assigned branches. |
Rules and limits
- You can only give roles below your own ceiling. App authorization is enforced by each app's server, not only by this page.
- A role appears in the pickers only when the app itself reports that it is ready for that role in this organization (the portal asks SolaCount, SolaStock, SolaHR or SolaProjects). If a role you expect is missing, the app has not reported it ready for this organization yet; check for a setup notice on Billing → Subscriptions, or send the details through Reports → New report.
- A person can hold more than one role in the same app. Use Add a role… here to add a second SolaCount role such as Sales on top of Accountant (Member); assigning a role they already have changes nothing ("Application role was already assigned.").
- App roles never grant organization administration. Even a SolaStock Administrator or SolaHR Administrator cannot manage billing, members or other apps.
- Inactive members cannot be given new roles until reactivated.
- Tenant-level role overrides inside an app can change one organization's exact result. The role guide describes the standard defaults.
- All add and remove actions use the shared confirmation and outcome notices. If the result is uncertain you see Status not confirmed. Reload the page to check before trying again.
Worked example
At Al Noor Trading LLC, Khalid runs the Jebel Ali warehouse and Huda runs HR for the Sales department.
- Mariam (owner) opens Application Roles.
- On Khalid's card, the SolaStock block shows Has access with no role. She picks Warehouse Manager in Add a role… and clicks Assign.
- On Huda's card, SolaHR shows No access. She clicks Give access to this app →, ticks SolaHR, chooses Department Manager and saves.
- In SolaStock → Team access, she assigns Jebel Ali to Khalid. In SolaHR → Team access, she assigns the Sales department to Huda.
Result: Khalid can receive, transfer and ship only in Jebel Ali. Huda can approve leave and record attendance only for Sales employees, with no payroll.