Production
Reference
Public
Permissions & Roles
Administration Permissions & Roles Everything about who can see and use each part of Production & Manufacturing — the two module toggles that make the feature visible, how…
Guide version: r1
Module version: 1.0.0 Updated: 2026-07-22 Estimated time: 11 min 2 views
Administration
Permissions & Roles
Everything about who can see and use each part of Production & Manufacturing — the
two module toggles that make the feature visible, how permissions are surfaced in the Role editor and
enforced in the code, the complete permission-key reference, and a suggested role-to-permission map.
????
Who this is for. This page is for an
administrator granting access. If you have not
enabled the module yet, do that first in
Getting Started — this
page assumes the tables exist and the module can be turned on.
How access control works
Production uses ERPat's standard role-based access control (RBAC). Access is decided by two
independent things, and both must line up before a user can reach a feature:
????
Module toggles
Tenant-wide on/off switches that make an entire area exist.
module_production is the master; module_manufacturing is a sub-feature
beneath it. When a toggle is off, the whole area is hidden — even for administrators.
????
Permissions
Per-role keys stored against each user, granted in the Role editor.
A permission decides whether a specific sidebar item and its actions appear within an
area that is already switched on.
Surfaced in the Role editor, enforced in the controllers
The permission keys shown below are auto-discovered from the installed module and appear in
the Role editor → Permissions matrix, grouped by category. When a user requests a page or an
action, the same keys are checked in the module's controllers. Two check styles run side by side:
| Layer | How it checks | Notes |
|---|
| Legacy web gate |
with_permission() / current_has_permit() |
The dominant style across the module's web controllers. |
| Modern guard |
$this->can() / $this->guard->hasModuleAccess() |
Newer code path; used by guards and the End-User API. |
????
Both layers read the same stored permissions — the serialized
users.permissions list. There is no separate permission store for legacy vs. modern
code, so granting a key in the Role editor takes effect everywhere at once.
ℹ️
Administrators bypass permission checks. An admin role sees every Production and Manufacturing
item as long as the relevant module toggle is on. You only need the keys below for non-admin roles.
The two module toggles
Nothing in this module appears until its area is switched on. The switches live in
Settings → Manage Modules (master) and the tenant settings (sub-feature).
| Toggle | Role | What it unlocks | When off |
|---|
module_production
master |
Master switch for the whole package. |
The Production sidebar group (Overview, Manufacturing Orders, Bill of Materials, Work
Centers, Production Reports) and the /production/* APIs. |
Base Production group hidden; base web pages and /production/* endpoints return
404 module_unavailable. |
module_manufacturing
sub-feature |
Sub-feature toggle for the advanced area, gated beneath the master. |
The separate Manufacturing sidebar group (Dashboard, Work Centers, BOM, Work Orders,
Quality Control, Requisitions, Costing, Labor, Compliance, ECOs, Settings) and the
/manufacturing/* APIs. |
The Manufacturing group is hidden and all /manufacturing/* endpoints return
404 module_unavailable. |
⚠️
module_manufacturing is a separate flag — enabling the master
module_production does not auto-enable it. You must turn on
module_manufacturing as well, or the entire Manufacturing sidebar group and every
/manufacturing/* API stay hidden and return 404.
ℹ️
The disabled state deliberately returns 404 “This feature is not available.” rather
than 403 — a 404 hides the feature's very existence, so callers cannot tell "not allowed" from
"doesn't exist".
SOP — granting access in the right order
Toggle first, then permissions. Because permissions are only meaningful inside a switched-on area,
granting a key while the toggle is off does nothing visible.
-
Enable the area
In Settings → Manage Modules, enable Production (sets
module_production = 1). For the advanced tools, also enable
Manufacturing (module_manufacturing = 1).
-
Open the Role editor
Go to Roles and open the role you want to change. The Production and (if enabled)
Manufacturing permission categories appear in the permissions matrix.
-
Grant the base permission first
For each area, tick the base (module-level) permission before its children — e.g.
production for Manufacturing Orders, production_bom for Bill of
Materials. The base key is what surfaces the sidebar item.
-
Add Create / Update / Delete only where needed
Tick the discrete _create / _update / _delete rows only
for roles that should modify data. A role with just the base key gets read-only access to that
area.
-
Save and verify
Save the role. A menu item appears only for permissions the role holds; the group header appears
when the user can see at least one child item.
⛔
A granted
API scope is not enough on its own. Even with
production:read or
manufacturing:read, an endpoint returns
404 module_unavailable when the
matching module toggle is off. The scope grant
and the tenant toggle must both be set. See
the API reference for scope details.
Permission reference
Every permission key the module publishes, grouped the way the Role editor groups them. In each
table: key is the stored permission string, Label is the human name shown in the
matrix, and Grants is what holding it unlocks. Base keys surface a sidebar item and read
access; the three child keys add write actions.
Base Production — Manufacturing Orders
| Permission key | Label | Grants |
|---|
production | Manufacturing Orders | Base module access. Unlocks the Overview and Manufacturing Orders sidebar items and the /production/orders API. Category Production: Manufacturing Orders; action Manage Manufacturing Orders. |
production_create | Create Manufacturing Order | Create a new Manufacturing Order. |
production_update | Update Manufacturing Order | Edit an existing Manufacturing Order. |
production_delete | Delete Manufacturing Order | Delete a Manufacturing Order. |
Base Production — Bill of Materials
| Permission key | Label | Grants |
|---|
production_bom | Bill of Materials | Base access. Unlocks the Bill of Materials sidebar item and the /production/boms API. |
production_bom_create | Create Bill of Materials | Create a new base BOM. |
production_bom_update | Update Bill of Materials | Edit an existing base BOM. |
production_bom_delete | Delete Bill of Materials | Delete a base BOM. |
Base Production — Work Centers
| Permission key | Label | Grants |
|---|
production_work_center | Work Centers | Base access. Unlocks the Work Centers sidebar item and the /production/work-centers API. |
production_work_center_create | Create Work Center | Create a new base work center. |
production_work_center_update | Update Work Center | Edit an existing base work center. |
production_work_center_delete | Delete Work Center | Delete a base work center. |
Base Production — Reports
| Permission key | Label | Grants |
|---|
production_report | Production Reports | Action Access. Unlocks the Production Reports sidebar item and the /production/reports/* API. Read-only — there are no create/update/delete children. |
Manufacturing — Overview (Dashboard)
| Permission key | Label | Grants |
|---|
manufacturing | Manufacturing Dashboard | Advanced-area base access. Action Access Manufacturing. Unlocks the Manufacturing group's Dashboard and /production/overview when in the advanced context. |
Manufacturing — Work Centers
| Permission key | Label | Grants |
|---|
manufacturing_work_center | Work Centers (Mfg) | Unlocks the advanced Work Centers item and the /manufacturing/work-centers API. |
manufacturing_work_center_create | Create Work Center (Mfg) | Create an advanced work center. |
manufacturing_work_center_update | Update Work Center (Mfg) | Edit an advanced work center. |
manufacturing_work_center_delete | Delete Work Center (Mfg) | Delete an advanced work center. |
Manufacturing — Bill of Materials
| Permission key | Label | Grants |
|---|
manufacturing_bom | Bill of Materials (Mfg) | Unlocks the advanced (versioned, multi-level) BOM item and the /manufacturing/boms API. |
manufacturing_bom_create | Create BOM (Mfg) | Create an advanced BOM version. |
manufacturing_bom_update | Update BOM (Mfg) | Edit an advanced BOM version. |
manufacturing_bom_delete | Delete BOM (Mfg) | Delete an advanced BOM version. |
Manufacturing — Work Orders
| Permission key | Label | Grants |
|---|
manufacturing_work_order | Work Orders | Unlocks the Work Orders item and the /manufacturing/work-orders API. |
manufacturing_work_order_create | Create Work Order | Create a work order. |
manufacturing_work_order_update | Update Work Order | Edit a work order. |
manufacturing_work_order_delete | Delete Work Order | Delete a work order. |
Manufacturing — Quality Control
| Permission key | Label | Grants |
|---|
manufacturing_quality | Quality Control | Unlocks the Quality Control item and the /manufacturing/qc-plans, /inspections, /ncrs and /capas APIs. |
manufacturing_quality_create | Create QC Records | Create QC plans, inspections, NCRs and CAPAs. |
manufacturing_quality_update | Update QC Records | Edit QC records. |
manufacturing_quality_delete | Delete QC Records | Delete QC records. |
Manufacturing — Material Requisitions
| Permission key | Label | Grants |
|---|
manufacturing_requisition | Material Requisitions | Unlocks the Material Requisitions item and the /manufacturing/requisitions and /manufacturing/issues APIs. |
manufacturing_requisition_create | Create Requisition | Create a requisition. |
manufacturing_requisition_update | Update Requisition | Edit a requisition. |
manufacturing_requisition_delete | Delete Requisition | Delete a requisition. |
Manufacturing — Costing
| Permission key | Label | Grants |
|---|
manufacturing_costing | Production Costing | Action Access Production Costing. Unlocks the Production Costing item and the /manufacturing/costing/standard and /actual APIs. No create/update/delete children. |
Manufacturing — Labor Tracking
| Permission key | Label | Grants |
|---|
manufacturing_labor | Labor Tracking | Unlocks the Labor Tracking item and the /manufacturing/labor and /manufacturing/downtime APIs. |
manufacturing_labor_create | Create Labor Entry | Create a labor / downtime entry. |
manufacturing_labor_update | Update Labor Entry | Edit a labor / downtime entry. |
manufacturing_labor_delete | Delete Labor Entry | Delete a labor / downtime entry. |
Manufacturing — Compliance
| Permission key | Label | Grants |
|---|
manufacturing_compliance | Compliance Documents | Unlocks the Compliance Docs item and the /manufacturing/compliance and /compliance/expiring APIs. |
manufacturing_compliance_create | Create Compliance Document | Create a compliance document. |
manufacturing_compliance_update | Update Compliance Document | Edit a compliance document. |
manufacturing_compliance_delete | Delete Compliance Document | Delete a compliance document. |
Manufacturing — Engineering Changes
| Permission key | Label | Grants |
|---|
manufacturing_eco | Engineering Change Orders | Unlocks the ECO item and the /manufacturing/ecos API. |
manufacturing_eco_create | Create ECO | Create an engineering change order. |
manufacturing_eco_update | Update ECO | Edit an engineering change order. |
manufacturing_eco_delete | Delete ECO | Delete an engineering change order. |
Manufacturing — Settings
| Permission key | Label | Grants |
|---|
manufacturing_settings | Manufacturing Settings | Unlocks the Settings item, the /manufacturing/settings API, and — used as the reference gate — the /manufacturing/uoms (units of measure) API. |
ℹ️
Units of measure share the Settings gate. The /manufacturing/uoms endpoint is
treated as shared reference data, so it is gated by manufacturing_settings rather than
a dedicated UoM permission. There is no separate "manage units" key.
Base vs. Create / Update / Delete
Read the legend below before assigning keys. The base key is read-only; the three child keys are the
only write grants.
base keyView / read. Surfaces the sidebar item and read access to its list & detail pages (and the matching read-only API). No editing.
_createCreate. Adds new records in that area.
_updateUpdate. Edits existing records in that area.
_deleteDelete. Removes records in that area.
????
A view-only role gets just the base key. A full editor gets the base key plus all three
_create/_update/_delete children. Reports
(production_report), Overview (manufacturing), Costing
(manufacturing_costing) and Settings (manufacturing_settings) have no
child keys — they are single, access-only permissions.
Suggested role mapping
These roles are conventions, not hard-coded — ERPat ships no fixed "Planner" or "QC Inspector"
role. Grant the permission groups below to whatever roles your organisation actually uses. A ✓ marks
the base permission for that group; give the matching _create/_update/_delete
children to roles that should modify data (typically the ones marked ✓ for their own area).
Planner
Operator
QC Inspector
Cost Accountant
Engineer
Compliance Officer
Administrator
| Permission group |
Planner |
Operator |
QC Inspector |
Cost Accountant |
Engineer |
Compliance Officer |
Administrator |
production — Manufacturing Orders |
✓ | ✓ | · | · | · | · | ✓ |
production_bom — Bill of Materials |
✓ | · | · | · | ✓ | · | ✓ |
production_work_center — Work Centers |
✓ | · | · | · | · | · | ✓ |
production_report — Production Reports |
✓ | · | · | ✓ | · | · | ✓ |
manufacturing — Mfg Overview / Dashboard |
✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
manufacturing_work_center — Work Centers (Mfg) |
✓ | · | · | · | · | · | ✓ |
manufacturing_bom — Bill of Materials (Mfg) |
✓ | · | · | · | ✓ | · | ✓ |
manufacturing_work_order — Work Orders |
✓ | ✓ | · | · | · | · | ✓ |
manufacturing_quality — Quality Control |
· | · | ✓ | · | · | · | ✓ |
manufacturing_requisition — Material Requisitions |
✓ | ✓ | · | · | · | · | ✓ |
manufacturing_costing — Production Costing |
· | · | · | ✓ | · | · | ✓ |
manufacturing_labor — Labor Tracking |
· | ✓ | · | ✓ | · | · | ✓ |
manufacturing_compliance — Compliance Docs |
· | · | · | · | · | ✓ | ✓ |
manufacturing_eco — Engineering Changes |
· | · | · | · | ✓ | · | ✓ |
manufacturing_settings — Settings & UoM |
· | · | · | · | · | · | ✓ |
ℹ️
How to read the table. ✓ = grant this group's base permission to that role; · = leave it off.
The Administrator column is shown for completeness — admins bypass permission checks entirely,
so you never need to tick keys for a true admin role. Reports, Overview, Costing and Settings have no
write children, so a ✓ there is always view/access-only.
What each role typically does
PlannerOwns setup and scheduling: creates BOMs, work centers, Manufacturing / Work Orders and requisitions; reads reports.
OperatorRuns the floor: starts/completes orders, records labor & downtime, issues materials against requisitions.
QC InspectorQuality only: runs inspections, records measurements, raises NCRs and CAPAs.
Cost AccountantCosting & reporting: maintains standard costs, reviews actual cost and variance, reads reports and labor.
EngineerDesign control: maintains BOM versions and raises Engineering Change Orders.
Compliance OfficerTracks permits and certificates and their expiry windows.
AdministratorFull access to everything the enabled toggles expose; also manages the toggles and the roles themselves.
Enforcement & error messages
Once toggles and permissions are set, the module enforces them consistently across the web UI and
both API surfaces. The read-only APIs surface a small set of standard responses when access is
missing:
| Situation | Response | Message |
|---|
| Module toggle is off | 404 module_unavailable | “This feature is not available.” — a 404 to hide the feature's existence. |
| End-User API caller lacks the web permit | 403 forbidden | Missing permit is refused (administrators bypass this check). |
| Client API token lacks the scope | Authorization failure | Via authorizeScope('production:read') / authorizeScope('manufacturing:read'). |
| Any non-GET verb on a read-only endpoint | 405 invalid_request | “Method not allowed.” with allowed=[GET]. |
⚠️
The End-User API is not self-scoped. Both API surfaces return the same org-wide JSON;
only the authorization differs (OAuth scope for the Client API vs. the staff member's web permit for
the End-User API). A user who holds the permit sees organisation-wide data, not just their own
records.
Next steps
