The permission matrix
Every access decision in Yessort resolves through this matrix. A role is a set of entries in it, and what a role grants is editable per organisation.
| Resource | Actions | Covers |
|---|---|---|
| catalog | create, read, update, delete | Products, variants, options, categories, brands. Price edits gate on update |
| inventory | create, read, update, delete | Sites, locations, lots, stock movements, allocations, transfers |
| order | create, read, update, delete | Customer orders, revisions and allocations. Also gates returns |
| customer | create, read, update, delete | Buyers, customer accounts and groups |
| supplier | create, read, update, delete, approve | Suppliers, price lists, purchase orders, receipts, supplier invoices. approve means approving purchase orders |
| goods_receipt | accept | Accepting receiving discrepancies — short closes and over-receipts |
| integration | create, read, update, delete | Channel, accounting and carrier connections. These hold credentials |
| billing | read, manage | |
| settings | read, update | Organisation settings, routing rules, feature toggles, the audit log |
| apiKey | read, write, delete | Tokens for programmatic access |
| role | read, update | The roles editor itself |
| organization, member, invitation, team | administration actions | Managing the organisation and who is in it |
Three entries that behave differently
goods_receipt has only accept. There is no read permission for it, and looking for one is a common dead end. Purchasing pages are read through supplier: read — the accept action exists solely to gate who may resolve a receiving discrepancy.
billing: manage is owner-only. It appears in the matrix, but granting it to another role does not work. An admin can read billing and cannot manage it, and no permission change alters that.
role: update is guarded. It can be granted and removed like any other entry, but not used to remove your own ability to use it.
No read action on the last row
organization, member, invitation and team carry administration actions without a read action. Being able to see who is in an organisation is not separately gated; managing them is.
Update usually needs read
Granting update on a resource without read produces a role that can change something it cannot look at. Yessort does not prevent it, and it is almost never what anyone means.
What is not in here
Where someone can act. That is site scope, a separate axis — no entry in this matrix restricts a person to a site.
Which organisations someone can see. That follows from their memberships. See who sees what.
Team membership. Teams do not appear here because they affect no access decision.