Luminous has one general permission for each invoice action, plus narrower versions that limit which invoices a user can see. You manage all of them in the Role Builder (Manage → Staff → ⋮ → Manage Roles).

The general (unrestricted) permissions

  • Read Invoices lets a user see all invoices.
  • Update Invoices is the permission that allows editing invoices.

Admin, Super Admin and Factory Admin users already hold these.

A user with Read Invoices sees every invoice. The narrower scoped read permissions below only take effect for users who do not have Read Invoices.

The scoped permissions

Read company invoices only

This one is for a customer contact (a B2B portal user). It limits them to invoices that belong to their own company.

Read luminous user's assigned company invoices only

This one is for staff such as sales reps or brokers. It limits them to invoices for companies they are assigned to. A user is assigned to a company through the company's team. Two things follow from this:

  • If the user isn't assigned to any companies, their invoice list is empty.
  • The assigned-companies scope applies to staff who don't also hold Read Invoices.

Invoices assigned to user

Read/Update Invoices Assigned to User limit a user to invoices for companies they’re assigned to. The default Sales role includes both, plus Update Invoices. To stop reps editing invoices outside their companies, remove Update Invoices from their role.

Which permission lets someone edit invoices?

Use Update Invoices. The Role Builder also lists scoped update permissions:

  • Update company invoices only
  • Update luminous user's assigned company invoices only
  • Update Invoices Assigned to User

The Roles page also lists scoped update and delete versions (Update/Delete company invoices only, Update/Delete luminous user’s assigned company invoices only). Test these with a user on that role before relying on them to restrict editing.

Tips

  • Giving a rep Read Invoices removes the assigned-companies restriction for them. Leave it off if you want them limited to their assigned companies.
  • If you use the API, tokens act as the token owner's user. The owner needs Read Invoices, Update Invoices and so on, once permission enforcement is turned on for your account. See the related article on API tokens and permission enforcement.