The five roles
Every organisation has the same five roles. You cannot add a sixth, but you can change what four of them grant.
| Role | Intended for |
|---|---|
| Owner | Whoever runs the organisation. Full access, and the only role that can manage billing |
| Admin | Day-to-day administration. Full access to the app, manages members and settings, and can read billing but not manage it |
| Member | Most office staff. Reads most things; does not administer teams, integrations or API keys |
| Warehouse | Operational staff. Owns inventory outright, and reads catalogue, orders, customers and suppliers to drive picking and receiving |
| Read only | Auditors, accountants, anyone who needs to look without touching |
Owner is the backstop
Owner's permissions are fixed and ignore any changes made to the others.
That is on purpose. Since the other four are editable, an organisation could otherwise edit away its own ability to administer itself. Owner is what makes that unrecoverable state impossible.
Every organisation needs at least one, and it is the only role that can manage billing.
Warehouse is the domain-specific one
The others are what you would expect from any system. Warehouse is shaped around the job: full control of inventory — sites, locations, stock movements, allocations, transfers — plus read access to everything needed to pick and receive against.
It is a role built for the floor rather than a middle tier between member and admin.
Read only really means read only
Across every surface, including ones an admin might not expect. Suitable for an accountant or a stakeholder who needs to look without any risk of change.
These names do not appear in the code
Yessort never checks whether someone is a "member" or a "warehouse" user. Every check resolves through the permission matrix.
So the descriptions above are what each role grants by default in a new organisation. If yours has edited them, they may grant something different — and that is a supported thing to do rather than a misconfiguration. See editing what a role can do.
A role says nothing about where
Someone's role decides what they can do. Which sites they can do it on is a separate setting — see site scope.
For what each role grants out of the box, see what each role can do.