Roles
Define what each team member can view and manage.
Roles group reusable permissions. Every member and invitation has a role that determines access within the active account. Open Settings → Roles to view roles, permissions, assigned members, and pending invitations.
Role types
System roles
| Role | General purpose |
|---|---|
| Administrator | Full account administration. |
| Employee | Basic access for personal tasks. |
| Accountant | Access to financial information and operations. |
System roles are read-only: you can inspect their permissions but cannot edit or delete them.
Custom roles
- Open Settings → Roles and select the creation action.
- Enter a name of up to 28 characters.
- Add an optional description of up to 100 characters.
- Select permissions, review, and create the role.
A custom role keeps standard system access. Selecting every available permission does not turn it into a system administrator role.
Permissions
Permissions are grouped by area:
| Group | Examples |
|---|---|
| Financial activity | Financial accounts, transactions, payment refunds, and cards. |
| Payments | Payment Links, bills, outgoing payments, approvals, and recipients. |
| Revenue | Invoices, subscriptions, customers, products, leads, and coupons. |
| Reimbursements | Submit, view, approve, or manage requests. |
| Operations | Team, accounting, account settings, and developer tools. |
Selected permissions accumulate. Reimbursements use an access level from no access to full management. A permission name does not establish that its associated product is available to your account.
Manage team members grants daily team administration but does not permit demoting or removing the last administrator.
Assign and change roles
Choose a role when inviting a person, or change a member's role in Settings → Team. Review access gained or lost, required tasks, critical processes, and approval assignments before saving. Use specific permissions where full administrator access is unnecessary.
Pharos prevents removing administrative access from the last account administrator.
Edit a custom role
Update its name, description, or permissions. Changes affect every member using the role, so check assignments first. System roles cannot be changed.
Delete a role
A custom role can be deleted only when no members or pending invitations use it. Reassign members and replace or revoke invitations first. After deletion, the role is no longer an active option and its name can be reused.
Troubleshooting
- A role cannot be edited: check whether it is a read-only system role.
- A custom role cannot be deleted: reassign its members and resolve linked invitations.
- A member cannot perform an action: check the active account, assigned role, and required permission. A department grants no additional access.
- All permissions are selected, but the role is not administrator: custom permissions do not change the system access level. Assign the corresponding system role while retaining another administrator.