Permissions & Roles
The complete access-control reference for the Assets (Safekeep) module — where permissions are granted, every permission key the module publishes with exactly what it gates, the actions that are gated by identity instead of a key, and five ready-made role presets you can copy into your own Role editor.
How access control works
Safekeep uses ERPat's standard role-based access control. Two independent switches must line up before a user can reach a feature:
The tenant-wide switch module_assets, set in
Settings → Manage Modules (the module is listed under the Safekeep category).
While it is off, the entire Safekeep sidebar group is hidden for everyone — including
administrators — and the module's permission categories do not appear in the Role editor.
Granted in Settings → Roles, per role. The module publishes its
permission keys into the Role editor automatically — but only while
module_assets is enabled. They appear grouped under ten categories, all prefixed
"Safekeep:".
module_assets is on. The keys below matter only for
non-admin roles. One action (Clone) is also reserved for admins outright — see
identity-gated actions.
asset is the master key to the whole Safekeep menu. The sidebar group
"Safekeep" has nine entries — Overview, Assets, Custody, Service, Audits, Finance,
Reports, Setup and Data Quality — and five of them (Overview, Assets, Service, Reports,
Setup) are gated on the single base permit asset (label
"Assets: Entries") alone. The other four each want their own permit as well:
asset_custody, asset_audit, asset_finance_view and
asset_data_quality. A role without asset sees no Safekeep menu at
all, cannot open the register (the page redirects), and gets none of the Assets dashboard
widgets. Grant asset first — every other key in this module is meaningless
without it.
SOP — granting access in the right order
module_assets can be enabled
(see Getting Started).
-
Enable the module
In Settings → Manage Modules, enable Assets (category Safekeep). This sets
module_assetsand makes the ten "Safekeep:" permission categories appear in the Role editor. -
Open the role
Go to Settings → Roles and open the role you want to change. Scroll to the ten categories beginning Safekeep: — Assets, Custody, Service, Audits, Finance, Categories, Locations, Groups, Data Quality and Setup.
-
Grant the base permit first
Tick
asset("Assets: Entries"). This alone surfaces the whole Safekeep sidebar group and read access to the registry, catalogs and reports. -
Add action permits where needed
Tick the specific keys for what the role should do: create/update/delete assets, checkout, audit, maintenance, import, export, comments, labels. For the Location tab on the Assets index, the Safekeep → Setup → Categories page and its Groups tab, grant their own category's base key (
location/asset_category/asset_groups) — the tab or page is hidden without it. -
Save and verify
Save the role, then sign in as (or ask) an affected user: the Safekeep group should appear in the sidebar and the granted buttons should show on
ams/assets.
Permission reference
Everything the module publishes into the Role editor, grouped exactly the way the editor groups it. In each table, the key is the stored permission string, the label is what the Role editor shows, and Gates is what holding it unlocks.
Module-level parents and their children
The module publishes 57 permission keys across ten groups. Eight of them are
module-level parents — asset, asset_category,
location, asset_groups, asset_custody,
asset_finance_view, asset_data_quality and
asset_settings. Where a parent has _create / _update /
_delete siblings, the Role editor groups those beneath it automatically: the
parent is the view/access grant and the children add write actions.
The four newer parents deliberately have no CRUD children. Custody, finance, data quality and settings are not "records you create and delete" — they are workflows whose steps are separate, named verbs (approve, release, post, apply), and each of those is its own permit in the tables below. There are no dropdown-style "specific" sub-permissions anywhere in this module.
Safekeep: Assets (13 permits)
| Permission key | Label in Role editor | Gates |
|---|---|---|
asset |
Assets: Entries | Base access permit for the entire module (module-level parent). Surfaces the
Safekeep sidebar group and its menu items (Categories additionally needs
asset_category); grants read access to the
asset registry, the asset detail page,
Models, Status Labels,
Depreciations,
Custom Fields & Fieldsets, the
Maintenance screen and the
Asset Reports page (whose Finance group additionally needs
asset_finance_view); also required for the
four Assets dashboard widgets. It also opens the
Overview and the Setup hub,
each of which then shows only the parts the viewer separately holds. The key is
asset (singular) — preserved from the legacy permission block so grants made
before modularization keep working; it deliberately does not match the module slug. |
asset_create | Create Asset | The "Add entry" toolbar button and creating assets via the add modal. |
asset_update | Update Asset | The "Edit" row action and Edit on the detail page — including the only UI where photo, cost, order number and custom-field values can be changed. (Condition is also updatable through the Check-in and Audit modals, gated by their own keys.) |
asset_delete | Delete Asset | The "Delete" row action (soft delete). |
asset_manage_labels | Asset Entries: Manage Labels | The "Manage labels" toolbar button, the Labels field in the asset form, label chips in the list, and the Label filter dropdown. |
asset_comment | Assets: Entry Comments | The comment composer on the asset detail page ("Write a comment...", "Post Comment", file attach). |
delete_asset_comment | Assets: Delete Entry Comments | The Delete action on comments. Comments can be deleted but never edited; static entries (the pinned description and change log) cannot be deleted at all. |
asset_checkout | Assets: Checkout / Endorse | Both "Check out asset" and "Check in asset" on the detail page — the whole endorse lifecycle except the assignee-side actions (see identity-gated actions below). |
asset_audit | Assets: Audit | Seeing audit information, the "Audit asset" action on an asset's own page, and reaching Safekeep → Audits. What can be done inside a campaign is decided by the four audit permissions below. |
asset_maintenance | Assets: Maintenance | Add / Edit / Delete on the Maintenance screen. Opening the screen itself needs only asset; the write actions need this dedicated key. |
asset_import | Assets: Import | The "Import Assets" toolbar button and the whole CSV/XLSX import flow (including the template download). |
asset_export | Assets: Export | Both the "Export Assets" XLSX export and the "Print asset labels" QR/barcode PDF flow. |
asset_view_financial | Assets: View cost & book value | The financial snapshot on an asset's detail page, including each book's cost basis, accumulated depreciation, impairment and current book value. This remains separate from asset, because knowing where equipment is and knowing what it is worth are different rights. Opening the full Accounting workspace and finance reports still requires asset_finance_view. |
asset permit is broader than read-only. The catalog screens
Models, Status Labels, Depreciations, Custom Fields and
Fieldsets gate their add / edit / delete actions on the same asset key —
they have no dedicated create/update/delete permits. Anyone you grant asset can
therefore also modify those catalogs. Only Assets (entries), Categories, Locations, Groups and
Maintenance have finer-grained write permits.
Safekeep: Custody (10 permits)
The custody register and the paperwork behind it (Safekeep → Custody,
ams/custody). Deliberately its own group rather than a set of sub-permissions of
asset: reading the equipment list and signing equipment over to somebody are
different jobs, often held by different people.
| Permission key | Label in Role editor | Gates |
|---|---|---|
asset_custody | Assets: Custody | Base access (module-level parent): the Custody sidebar entry, all three tabs, and the endorsement document pages. |
asset_endorsement_create | Create / Submit Endorsement | The new-endorsement wizard, editing a draft, submitting it for approval, and cancelling. |
asset_endorsement_approve | Approve Endorsement | Approving a document waiting for it, or sending it back to the preparer with a reason. |
asset_endorsement_release | Release Endorsement | The moment the equipment actually changes hands. Separate from approve on purpose — segregation of duties means the person who signs off the paperwork need not be the person who hands the kit over. |
asset_accept_on_behalf | Accept on Behalf | Confirming receipt for somebody who cannot. Gated separately because it is the entry an auditor asks about; ordinary acceptance needs no permission at all — the holder may always confirm their own receipt. |
asset_transfer | Transfer Custody | Moving an asset from its current holder to another. |
asset_receive | Receive / Inspect | Taking an asset back and recording the condition it returned in. |
asset_request_return | Request Return | Asking a holder for an asset back. The holder themselves does not need this — they may always hand equipment back. |
asset_caretaker_manage | Manage Caretakers | Appointing, ending and handing over the caretaker answerable for equipment held by a place, team, project or outside party. Reading the roster only needs asset_custody. |
asset_view_all_establishments | View All Establishments | Seeing every establishment's equipment when establishment scoping is switched on. Without it (and with scoping on) you see the places you are assigned to and the ones you are caretaker of. |
asset_checkout permit still works. It continues to gate the
quick check-out / check-in modals on the asset detail page, so nobody loses access on upgrade.
The custody permits above cover the newer multi-item, multi-recipient paperwork.
Safekeep: Service (5 permits)
Faults, Helpdesk tickets, work orders and warranty claims (Safekeep → Service,
ams/service). Reporting a fault is deliberately the LOWEST bar in the module — a
fault nobody could report is a fault nobody fixes — and everything that decides what happens
next is gated separately. The existing asset_maintenance permit is unchanged.
| Permission key | Label in Role editor | Gates |
|---|---|---|
asset_issue_report | Report Issues | The report form, from the Service page, the asset's own page and the employee app. Needs no more than base access to the register. |
asset_issue_manage | Manage Issues | Triage, resolve, close and reopen. Also allows verifying on somebody else's behalf — ordinary verification needs no permission at all, because the reporter and the current holder may always answer for their own equipment. |
asset_ticket_create | Create Helpdesk Tickets | Raising a ticket by hand. Its own permit because it writes into ANOTHER team's queue. |
asset_maintenance_approve | Approve Work Orders | Clearing the spend on a repair. Separate from doing the work on purpose — the same person doing both is exactly what segregation of duties is for. |
asset_warranty_manage | Manage Warranty Claims | Recording a claim number and its result against a work order. |
Safekeep: Audits (4 permits)
Physical counts (Safekeep → Audits, ams/audits). Four permits rather than
one, because an audit only means something when the same person does not do all four jobs:
planning what is counted, counting it, deciding what a finding means, and signing that the result
may stand. Collapsing them produces a document that says "audited" and evidences nothing. See
Audit Campaigns.
| Permission key | Label in Role editor | Gates |
|---|---|---|
asset_audit_campaign_manage | Manage Campaigns | Creating and editing a campaign, freezing its scope, assigning auditors, submitting for review, reopening, closing and cancelling. |
asset_audit_execute | Perform Audits | The scan page and recording results. Deliberately the lowest bar of the four — an auditor walking a floor needs this and nothing else. |
asset_audit_resolve | Resolve Discrepancies | Deciding what a finding means, including accepting an exception — which lets a campaign certify with a discrepancy still standing. |
asset_audit_certify | Certify Audits | Signing the result. The last gate, and the one a control review asks about. |
asset_ticket_create would silently drop
the ticket for most employees — exactly the ones least able to chase it.
Safekeep: Finance (9 permits)
Depreciation books, period runs, impairments and disposals (Safekeep → Finance,
ams/accounting). Nine permits rather than one, for the same reason the audit block has
four: the workflow's whole value is that different people hold different steps. One person who can
prepare, approve, post and reverse a period has produced numbers nobody independently looked at,
and a disposal somebody approves for themselves evidences nothing. See
Finance & Depreciation and
Disposal & Sanitization.
| Permission key | Label in Role editor | Gates |
|---|---|---|
asset_finance_view |
Assets: Finance | Base access permit for the finance surface (module-level parent). Opens the Safekeep → Finance menu item and page — all four tabs (Depreciation, Estimates & Adjustments, Disposals, Valuation), every run and its lines, the book register, the disposal list and any disposal's own page. Read-only on its own: it grants no action. Required by every key below, including the disposal ones — a disposal requester who lacks it cannot reach the screen the request lives on. |
asset_depreciation_run | Finance: Prepare & calculate depreciation | Preparing a period run, calculating it (the batched console on the run page), marking it reviewed, and cancelling one before it is posted. The lowest bar of the depreciation four. |
asset_depreciation_approve | Finance: Approve depreciation | Approving a reviewed run — the authority signature, and deliberately a separate key from the one that produced the numbers. |
asset_depreciation_post | Finance: Post / reverse / lock depreciation | Committing a run to the books, reversing a posted one, and locking a period closed. The strongest finance permit: posting writes balances and is undone only by a reversal that stays on the record forever. |
asset_finance_manage | Finance: Manage books & estimates | Editing a book's inputs before its first posting, opening books in bulk, requesting and approving estimate changes and capital additions, approving adjustments, and marking an estimate reviewed. Also carries the second, finance signature on a high-value disposal. |
asset_impairment_manage | Finance: Record impairment | Requesting a write-down. Separate from managing estimates because an impairment is a judgement about value that an organization often routes to a different person. |
asset_disposal_request | Disposal: Request & assess | Raising a disposal request, recording the technical assessment, and cancelling a request. |
asset_disposal_approve | Disposal: Approve / reject / exception | Authorising or refusing a disposal — and granting a sanitization exception, which is the one way past the data-wipe gate without evidence. Grant it accordingly. |
asset_disposal_complete | Disposal: Sanitize & complete | Recording the wipe (method, tool, who performed and verified it, certificate) and completing the disposal — the step that closes the book, strikes the gain or loss and archives the asset. |
Safekeep: Categories (4 permits)
Categories are a sidebar item of their own (Safekeep → Setup → Categories,
ams/categories), directly below Assets; the page also hosts the Groups and
Status Labels tabs. The sidebar entry and page appear only for holders of the base key.
| Permission key | Label in Role editor | Gates |
|---|---|---|
asset_category | Assets: Categories | Base access (module-level parent): the Safekeep → Setup → Categories page and the category list. |
asset_category_create | Create Category | Adding categories. |
asset_category_update | Update Category | Editing categories (title, description, parent, fieldset binding). |
asset_category_delete | Delete Category | Deleting categories. |
Safekeep: Locations (4 permits)
Locations are likewise an in-page tab (ams/assets → "Location" tab); see
Locations.
| Permission key | Label in Role editor | Gates |
|---|---|---|
location | Assets: Locations | Base access (module-level parent): the "Location" tab and the location list. |
location_create | Create Location | Adding locations. |
location_update | Update Location | Editing locations. |
location_delete | Delete Location | Deleting locations. |
location — no
asset_ prefix — and its children follow suit (location_create,
location_update, location_delete). When auditing a role's stored
permissions, don't overlook it because it doesn't sort next to the other Safekeep keys.
Safekeep: Groups (5 permits)
Groups are an in-page tab of the Categories page (ams/categories →
"Groups" tab); see Asset Groups.
| Permission key | Label in Role editor | Gates |
|---|---|---|
asset_groups | Assets: Groups | Base access (module-level parent): the "Groups" tab and the group list. |
asset_groups_create | Create Group | Adding groups. |
asset_groups_update | Update Group | Editing groups. |
asset_groups_delete | Delete Group | Deleting groups. |
asset_groups_manage_labels | Asset Groups: Manage Labels | Managing labels on asset groups (the Groups tab's own label tooling — separate from asset_manage_labels on entries). |
Safekeep: Data Quality (2 permits)
The workbench that scores the register and repairs it in bulk; see Data Quality Workbench.
| Permission key | Label in Role editor | Gates |
|---|---|---|
asset_data_quality |
Assets: Data Quality | Base access (module-level parent): the Safekeep → Data Quality menu item and the whole workbench — all three tabs, every remediation queue, the score summary and the spreadsheet export. Read-only on its own, deliberately: somebody expected to help clean the register should be able to see what is wrong without also being able to rewrite it. It also makes the data-quality tile on the Overview clickable. |
asset_data_quality_apply |
Data Quality: Apply bulk fixes | Running a bulk action over a selection — generating tags, setting a model, status,
category or location, fixing an ownership type, re-issuing duplicate identifiers,
setting an audit cadence, re-scoring, and merging or archiving catalogue entries.
Not sufficient by itself for two of them: creating custody records additionally
needs asset_endorsement_create, and attaching a depreciation profile
additionally needs asset_finance_manage — because a bulk tool that could
do what its operator may not do one row at a time would be a way around every other
permit on this page. |
Safekeep: Setup (1 permit)
The module's own configuration; see Setup Hub & Settings.
| Permission key | Label in Role editor | Gates |
|---|---|---|
asset_settings |
Assets: Settings | The module's Settings page — reached either as the last tab of the
Safekeep → Setup hub or from the platform's own Settings →
Components list — and all nine of its groups: general, custody, ticketing,
maintenance, audits, finance, disposal, notifications and API. Its own permit rather
than asset, because raising a threshold here silently changes what every
future handover, audit and disposal requires of everybody. That is an
administrator's decision, not a register user's. |
asset permit and then shows only the tabs whose own permission the viewer holds
— Categories needs asset_category, Locations needs location,
Settings needs asset_settings. It can never offer a door that will not open.
Actions gated by identity, not by a permission key
Three actions have no permission checkbox in the Role editor. They are decided by who the logged-in user is:
| Action | Where | Who may do it |
|---|---|---|
| "Confirm receipt" (acknowledge) | Asset detail page → Actions | The current assignee (the user the asset is endorsed to) or an admin. Anyone else is refused. See Checkout & Check-in. |
| "Request return" | Asset detail page → Actions | The current assignee or an admin — same identity rule as Confirm receipt. |
| "Clone" | Asset registry → row actions | Admins only. No permission key grants Clone to a non-admin role — the menu item simply never appears. Clone supports a "Duplicate" count to create several copies at once; see Adding & Editing Assets. |
ams/assets controller requires the base asset permit. So an employee
who receives equipment needs asset (and nothing else) to acknowledge it. The same
base permit is what makes the "Assets assigned to me" dashboard widget render
(see Automation & Reminders).
Shared masters: Vendors and Brands
Suppliers/Vendors and Manufacturers/Brands are not owned by this module — they are shared
core masters (vendors and brands tables) reachable at
ams/vendors and ams/brands. Their permits, vendor and
brand, live in the core Role editor blocks, not in any "Safekeep:" category.
A user who should manage suppliers or manufacturers referenced by assets needs those core permits
in addition to the Safekeep keys above.
Suggested role presets
These five presets are conventions, not shipped roles — ERPat does not create them for you. They map cleanly onto how most organizations split asset work; copy the checkbox pattern from the table below into your own roles in Settings → Roles. The Workflows & SOPs page uses the same role names.
Owns the registry and every catalog. Gets every Safekeep permit
(all 54 keys across the eight categories) plus the core vendor and
brand permits. If this person is a true ERPat admin, no keys are needed at all —
admins bypass permission checks.
Deploys, services and recovers hardware: edits assets, runs checkout/check-in, records audits and maintenance, comments on work done. No create/delete, no import/export, no catalog tabs.
Verifies physical existence and condition: reads everything, records audits, exports evidence to XLSX. Cannot change assets or the lifecycle.
Owns valuation: reads the registry and sees cost and book value on it
(asset_view_financial), and runs the
Finance page — books, monthly runs, impairments
and estimate reviews. Give approve and post to different people where
headcount allows; add asset_disposal_approve only where finance also authorises
retirements.
Receives equipment. Needs only the base asset permit — that
renders the "Assets assigned to me" widget and lets them open their asset's page to
"Confirm receipt" and "Request return" (both identity-gated to the assignee).
No other Safekeep keys.
asset can browse the entire asset registry and reports —
and, per the caveat above, could technically edit the Models / Status Labels / Depreciations /
Custom Fields catalogs, which gate their write actions on asset alone. If that is
unacceptable for your organization, keep rank-and-file staff without any Safekeep permits: they
lose the widget and the self-service Confirm receipt / Request return buttons, and an
asset_checkout holder records handovers on their behalf instead.
Preset → permit checkbox map
✓ = tick the key for that role; · = leave it off. The core vendor / brand
permits are listed last for completeness even though they appear in the core sections of the Role
editor, not under "Safekeep:".
| Permission key | IT Asset Administrator | IT Technician | Auditor | Accounting | Employee |
|---|---|---|---|---|---|
asset — Assets: Entries (base) | ✓ | ✓ | ✓ | ✓ | ✓ |
asset_create | ✓ | · | · | · | · |
asset_update | ✓ | ✓ | · | · | · |
asset_delete | ✓ | · | · | · | · |
asset_manage_labels | ✓ | · | · | · | · |
asset_comment | ✓ | ✓ | · | · | · |
delete_asset_comment | ✓ | · | · | · | · |
asset_checkout | ✓ | ✓ | · | · | · |
asset_audit | ✓ | ✓ | ✓ | · | · |
asset_maintenance | ✓ | ✓ | · | · | · |
asset_import | ✓ | · | · | · | · |
asset_export | ✓ | · | ✓ | ✓ | · |
asset_view_financial | ✓ | · | ✓ | ✓ | · |
asset_finance_view (base) | ✓ | · | ✓ | ✓ | · |
asset_finance_manage | ✓ | · | · | ✓ | · |
asset_depreciation_run | ✓ | · | · | ✓ | · |
asset_depreciation_approve | ✓ | · | · | ✓ | · |
asset_depreciation_post | ✓ | · | · | ✓ | · |
asset_impairment_manage | ✓ | · | · | ✓ | · |
asset_disposal_request | ✓ | ✓ | · | · | · |
asset_disposal_approve | ✓ | · | · | · | · |
asset_disposal_complete | ✓ | ✓ | · | · | · |
asset_category (base) | ✓ | · | · | · | · |
asset_category_create | ✓ | · | · | · | · |
asset_category_update | ✓ | · | · | · | · |
asset_category_delete | ✓ | · | · | · | · |
location (base) | ✓ | · | · | · | · |
location_create | ✓ | · | · | · | · |
location_update | ✓ | · | · | · | · |
location_delete | ✓ | · | · | · | · |
asset_groups (base) | ✓ | · | · | · | · |
asset_groups_create | ✓ | · | · | · | · |
asset_groups_update | ✓ | · | · | · | · |
asset_groups_delete | ✓ | · | · | · | · |
asset_groups_manage_labels | ✓ | · | · | · | · |
vendor (core, shared) | ✓ | · | · | · | · |
brand (core, shared) | ✓ | · | · | · | · |
asset ✓ already covers them (read and, for the catalogs, write). Give
asset_comment to any role that should leave notes on assets — the Technician gets it
here because service work is usually documented in comments. Adjust freely: these are starting
points, not rules.
The Finance column is one column, not one person. It shows every finance key a finance
function needs; in a team of more than one, split them — whoever prepares a run should not
be the person who approves or posts it, and the system will refuse if they try. The Technician
gets asset_disposal_request and asset_disposal_complete because IT
usually raises the retirement and does the wipe, while the authorisation stays elsewhere.