NAVICORE ONE company operating system · Part 05 · Security & trust
Roles & permissions
Decide exactly who can see and do what, down to a department, team or single project.
What this page describes is the intended scope from the product specification. The status label shows how far along this area is.
Illustrative layout, not a live screenshot.
What it is
Instead of a few fixed roles, NAVICORE ONE builds access as a chain: a user has a role, the role grants permissions, each permission has a scope, and the scope applies to a resource. Eleven default roles, from Owner to Guest, give you a starting point.
The problem
Fixed roles force a company to give people too much access, or too little.
What NAVICORE ONE does
NAVICORE ONE lets a role carry specific permission types (create, read, update, delete, approve, manage, export, configure) over a chosen scope.
The result
Access matches how your company is actually organized.
Who uses it, and when
- Owners and super admins
- When deciding who can approve, export, configure or delete
- HR, finance and project managers
- When their area needs its own level of access
- Every employee
- Every time they open a record: they see what their role and scope allow
How it works, step by step
The permission chain
Sequence stated in the product specification.- 1
User
The person
- 2
Role
What they are, for example HR Manager
- 3
Permissions
What that role may do
- 4
Scope
Where: organization, department, team, project, own or assigned records
- 5
Resource
The record the permission applies to
Key functions
Eleven default roles
Owner, Super Admin, Admin, HR Manager, Finance Manager, Accountant, Project Manager, Manager, Team Lead, Employee and Guest.
Eight permission types
Create, read, update, delete, approve, manage, export and configure.
Six permission scopes
Organization, department, team, project, own records and assigned records.
Role-then-scope design
A permission is never just 'yes'; it applies to a defined scope.
Owner authority
Organization deletion, ownership transfer, system configuration, license management, demo management and destructive operations.
Super Admin limits
Almost everything operationally, but cannot delete the organization, remove the Owner, transfer ownership or destroy the company setup.
Full scope from the product specification (36 items)
Default Roles
- Owner
- Super Admin
- Admin
- HR Manager
- Finance Manager
- Accountant
- Project Manager
- Manager
- Team Lead
- Employee
- Guest
Permission Types
- Create
- Read
- Update
- Delete
- Approve
- Manage
- Export
- Configure
Permission Scopes
- Organization
- Department
- Team
- Project
- Own records
- Assigned records
Owner: full authority, including
- Organization deletion
- Ownership transfer
- System configuration
- License management
- Demo management
- Destructive operations
Super Admin: almost everything operationally, but cannot
- Delete organization
- Remove Owner
- Transfer ownership
- Destroy complete company setup
- Perform platform-level destructive operations
How it connects to other parts
- Part 04Live
Sign-in & identity
Let the right people into your company's workspace, and keep everyone else out.
- Part 21In build
Approval engine
Run every kind of approval through one engine, with a clear record of who decided what.
- Part 23In build
Audit trail
Keep a permanent record of who did what, when and what changed, for every important action.
- Part 06Live
People directory
Keep one complete, searchable record for every person in your company.
- Part 37In build
Security center
Watch sign-ins, devices, permission changes and alerts for the whole company in one place.
See it in action
Ask for a demo, or tell us how you would like to partner.