Zudo WorksUsers, roles and permissions
Routes: /users [users.manage], Settings → Roles /settings/roles
Permission catalogue
| Group | Permission | Grants |
|---|---|---|
| Admin | settings.manage | Settings, branding, API keys, webhooks, audit log, billing, UI configuration, feedback list |
| Admin | users.manage | Users and roles |
| Masters | masters.read / masters.write | Items, units, warehouses, tags |
| Stock | stock.read / stock.post | Movements, balances, history / post movements, receive POs |
| BOM | bom.read / bom.write | Bills of materials |
| Jobs | jobs.read / jobs.write / jobs.issue | Work orders, work centres, routing / lifecycle / material issue & return |
| Sales | sales.read / sales.write | Customers, sales orders |
| Purchasing | purchasing.read / purchasing.write | Vendors, purchase orders, draft PO from procurement |
| Planning | planning.read | Procurement requirements |
| Low-code | forms.read / forms.write / forms.design | Read records / write records / design forms |
| Low-code | workflows.manage | Rules, functions, run log |
| Low-code | dashboards.read / dashboards.manage | View dashboards, reports, analytics / build them |
| AI | ai.use | Zudo AI assistant (owner and supervisor by default); applying a proposal also needs the permission of the change |
System roles (default matrix)
| Permission | Owner | Supervisor | Storekeeper |
|---|---|---|---|
| settings.manage | ● | ||
| users.manage | ● | ||
| masters.read | ● | ● | ● |
| masters.write | ● | ● | |
| stock.read | ● | ● | ● |
| stock.post | ● | ● | |
| bom.read | ● | ● | ● |
| bom.write | ● | ● | |
| jobs.read | ● | ● | ● |
| jobs.write | ● | ● | |
| jobs.issue | ● | ● | |
| sales.read / write | ● | ● | |
| purchasing.read | ● | ● | ● |
| purchasing.write | ● | ● | |
| planning.read | ● | ● | ● |
| forms.read / write | ● | ● | ● |
| forms.design | ● | ||
| workflows.manage | ● | ||
| dashboards.read | ● | ● | ● |
| dashboards.manage | ● | ● |
Rules: the Owner role is immutable; the other system roles keep their names but their permissions can be tuned; custom roles are fully editable and deletable while unused. A manager can grant only roles whose permissions they hold; nobody below owner edits their own role or status; the last active owner cannot be demoted or deactivated. Role changes apply on the next request and end the affected user's sessions, as do status and password changes.
Users carry a display name, e-mail (unique per workspace), role, status and avatar (uploaded photo or initials). Deleting a user with history anonymises them (kept for the audit trail, e-mail freed, signed out).
Last updated