Permissions, in plain English

What permissions are, how they combine, and where to find every flag.

A permission is a single capability, for example, "can create tasks" or "can manage roles". Every page and every button in Nexus ERP is gated by one or more permissions.

When you sign in, the app figures out what you can do by adding up the permissions from every role you hold. If any of your roles grants a permission, you have it.

The five default roles

Every new organisation ships with five locked roles you can't edit or delete:

Role	What it's for
Owner	Full control. Everything. Only owners can promote other owners.
Admin	Full operational access. Cannot delete the org or manage billing.
Manager	Can manage clients, projects, leads, and team members' work.
Member	Day-to-day workspace user: own tasks, files, teams, meetings, chat and the Nova assistant. Nothing in clients, projects, invoices, payments, quotes, leads or inventory.
Developer	The developer tools and API keys, plus tasks, files, teams, the Users page and the Nova assistant.

For most teams these five are enough. If you need finer control, see How roles work for creating custom roles.

All permission flags

The full list of capabilities, grouped by feature area. Tick the matching boxes when you author a custom role.

Tasks

Flag	Label	Description
TASKS	Tasks	Open My Tasks to see and submit the tasks assigned to you, with their chat and files.
CREATE_TASKS	Create Tasks	Create and assign tasks to other users, edit own tasks.
VIEW_ALL_TASKS	View All Tasks	See every task and recurring task schedule in the workspace, with their submissions and chat. Posting in the chat of a task you are not on also needs View All Chats.
MANAGE_TASKS	Manage Tasks	Edit, delete and review any task in the workspace, which includes seeing every task and recurring task schedule.

Files

Flag	Label	Description
FILES	Files	Show the Files page, which lists the attachments and submitted files of the tasks you can see. Searching inside files follows each file's own permissions instead.
VIEW_ALL_FILES	View All Files	On the Files page and in file search, see and open every task attachment and submitted file with the text inside it, including on tasks you cannot open. Chat, client, expense and hiring files keep their own permissions.

Teams

Flag	Label	Description
TEAMS	Teams	Open the Teams page and see the teams you belong to. Team leads can assign tasks to their team.
TEAMS_VIEW_ALL	View All Teams	View all teams in the org.

Chat

Flag	Label	Description
CHAT_DELETE	Delete Chats	Delete any message in a team, project or task chat you can open. In direct messages people can only delete their own.
CHAT_VIEW_ALL	View All Chats	View and post in every team, project and task chat, regardless of membership. Direct messages stay private.

Users

Flag	Label	Description
USERS	Users	Open the Users page and see yourself and the people who share a team with you, with their contact details.
USERS_VIEW_ALL	View All Users	See every member of the workspace with their contact details, linked Google account and WhatsApp number.

CRM - Clients

Flag	Label	Description
CLIENTS	Clients	Open the Clients page and the clients you created or reach through your projects or your invoices, with their contacts, files and the text inside those files.
CLIENTS_VIEW_ALL	View All Clients	See every client with its contacts, files and the text inside those files. A client's invoices, leads, projects and tasks still follow your permissions for those.
CLIENTS_MANAGE	Manage Clients	See, edit and delete every client, and manage its contacts, files and client tasks.
CLIENTS_CREATE	Create Clients	Create new clients. Seeing the client list also needs Clients or View All Clients.

CRM - Projects

Flag	Label	Description
PROJECTS	Projects	Open the Projects page with the projects you created or are a member of, and the workflow runs you started or that hold a task you can see. Money figures in project KPIs need View All Invoices, Manage Invoices or the finance overview.
PROJECTS_VIEW_ALL	View All Projects	See every project and every workflow run in the workspace. With the Clients permission it also opens every client that has a project.
PROJECTS_MANAGE	Manage Projects	See and edit every project, manage its members and run workflows. With the Clients permission it also opens every client that has a project.
PROJECTS_CREATE	Create Projects	Create new projects. Seeing the project list also needs Projects or View All Projects.
MANAGE_WORKFLOWS	Manage Workflows	Create, edit, duplicate, archive and delete workflow templates. Running a workflow, or changing a template that an active recurring workflow uses, also needs Manage Projects.

CRM - Invoices

Flag	Label	Description
INVOICES	Invoices	Open the Invoices page and the invoices you created.
INVOICES_VIEW_ALL	View All Invoices	See every invoice in the workspace and the Invoices summary tab.
INVOICES_MANAGE	Manage Invoices	See, edit, send and delete every invoice in the workspace, including the Invoices summary tab.
INVOICES_CREATE	Create Invoices	Create new invoices and open the ones you created. Seeing other people's invoices needs View All Invoices or Manage Invoices.

CRM - Payments

Flag	Label	Description
PAYMENTS	Payments	Open the Payments page and see the payments you recorded and the payments on invoices you can open.
PAYMENTS_VIEW_ALL	View All Payments	See every payment in the workspace and the Payments summary tab.
PAYMENTS_MANAGE	Manage Payments	Record, edit, delete and email payments, and see every payment and the Payments summary tab.
PAYMENTS_CREATE	Create Payments	Open the Payments page and the payments you recorded. Recording a payment needs Manage Payments.

CRM - Quotes

Flag	Label	Description
QUOTES	Quotes	Open the Quotes page and the quotes and recurring quote schedules you created.
QUOTES_VIEW_ALL	View All Quotes	See every quote and recurring quote schedule in the workspace.
QUOTES_MANAGE	Manage Quotes	See, edit and change the status of every quote and recurring quote schedule.
QUOTES_CREATE	Create Quotes	Create new quotes and recurring quote schedules, and open the ones you created. Seeing other people's needs View All Quotes or Manage Quotes.

Passwords

Flag	Label	Description
VIEW_PROJECT_PASSWORDS	View project passwords	See the organisation passwords of the projects you can open. Never anyone's personal passwords. Needs a Projects permission to open the projects.
MANAGE_PROJECT_PASSWORDS	Manage project passwords	Add, edit, delete and share organisation passwords of the projects you can open, and move your own personal passwords there. Includes viewing them. Needs a Projects permission to open the projects.
VIEW_CLIENT_PASSWORDS	View client passwords	See the organisation passwords of the clients you can open, including those of their projects. Needs a Clients permission to open the clients.
MANAGE_CLIENT_PASSWORDS	Manage client passwords	Add, edit, delete and share organisation passwords of the clients you can open, and move your own personal passwords there. Includes viewing them. Needs a Clients permission to open the clients.
VIEW_ALL_CLIENT_PASSWORDS	View all client passwords	See every organisation password linked to a client, including those of its projects.
MANAGE_ALL_CLIENT_PASSWORDS	Manage all client passwords	Add, edit, delete and share any organisation password linked to a client, and move your own personal passwords there. Includes viewing them.
VIEW_ALL_ORG_PASSWORDS	View all organisation passwords	See every organisation password, including ones not linked to a client or project. Never anyone's personal passwords.
MANAGE_ALL_ORG_PASSWORDS	Manage all organisation passwords	Add, edit, delete and share any organisation password, including ones not linked to a client or project, and move your own personal passwords there. Includes viewing them.

CRM - Expenses

Flag	Label	Description
EXPENSES_VIEW_ALL	View Expenses	Access Expenses tab and view all expenses.
EXPENSES_CREATE	Create Expenses	Add new expense records.
EXPENSES_MANAGE	Manage Expenses	Edit and delete any expense.

CRM - Leads

Flag	Label	Description
LEADS	Leads	Open the Leads tab with your own leads and the calling queue. Leads you take from the queue show earlier calls' outcomes, dates and callers, but not other people's notes or recordings.
LEADS_VIEW_ALL	View All Leads	View every lead in the workspace. Taking leads from the calling queue needs Leads or Manage Leads.
LEADS_CREATE	Create Leads	Create new leads and manage own created leads.
LEADS_MANAGE	Manage Leads	Manage and delete any accessible lead.

Contacts

Flag	Label	Description
CONTACTS_VIEW_ALL	View All Contacts	See every contact regardless of whether they are a lead, an applicant, a client contact, or a WhatsApp correspondent.
CONTACTS_VIEW_LEADS	View Lead Contacts	See contacts who are sales leads, and their lead pipeline, calls and notes. Other facets of the same person stay hidden.
CONTACTS_VIEW_HR	View Applicant Contacts	See contacts who have applied for a job, and their applications and HR notes. Other facets of the same person stay hidden.
CONTACTS_VIEW_CLIENTS	View Client Contacts	See contacts linked to a client, and their client roles and notes. Other facets of the same person stay hidden.
CONTACTS_MANAGE	Manage Contacts	Edit contacts and tags, edit and delete anyone's notes, merge duplicates and delete contacts. Changing a contact's name, phones or emails, or deleting it, needs sight of every facet it has.

Finance

Flag	Label	Description
FINANCE_OVERVIEW	Finance Overview	Open the Finance overview and the company-wide Summary tabs on Invoices and Payments.
ACCOUNTS_VIEW	View Accounts	See the company bank accounts with their balances, bank details and statements, also on payment, invoice and quote pages.
ACCOUNTS_MODIFY	Modify Accounts	Create, edit and delete bank accounts, and see their balances and statements.

Dashboard

Flag	Label	Description
MANAGE_MEMBERS	Manage Members	Add, remove and update members ranked below you who hold no permission you lack, and see every member with their contact details. Adding a member can charge the workspace's card or credit line for a seat.
MANAGE_ROLES	Manage Roles	Create, edit and delete roles below your own, and give or take them from members ranked below you. You can only give, take away or change permissions you hold yourself.
MANAGE_TEAMS	Manage Teams	Create, edit and delete teams and change who is on them. Adding yourself to a team, or making yourself its lead, also needs View All Teams and View All Chats.
VIEW_AUDIT_LOG	View Audit Log	See the audit log entries for the areas your other permissions cover, plus everything you did yourself. Billing entries need Manage Billing, and direct message entries show only to Owners.
DEVELOPER	Developer Access	Open the developer tools, create API keys and change only the keys you created. An API key can read and change everything in the workspace, so give this only to people you trust with full access.
MANAGE_ORG	Manage Organisation	Edit the workspace details, branding, email senders, Nova AI provider keys and WhatsApp numbers, whose secrets can be replaced but are never shown again. Changing the document header or the invoice, quote and payment email senders also needs Manage Invoices, Manage Quotes or Manage Payments.
VIEW_DASHBOARD	View Dashboard	Access the admin dashboard.

Marketing

Flag	Label	Description
VIEW_SHORT_URLS	View Short URLs	Access Marketing tab, view all short URLs and analytics.
CREATE_SHORT_URLS	Create Short URLs	Create new short URL redirects.
MANAGE_SHORT_URLS	Manage Short URLs	Edit existing short URL details and OG metadata.
DELETE_SHORT_URLS	Delete Short URLs	Delete short URLs and all associated visit data.

Meetings

Flag	Label	Description
MEETINGS	Meetings	Access Meetings tab and view Google Calendar meetings.
MEETINGS_CREATE	Schedule Meetings	Create Google Meet meetings and invite org members.

CRM - Client Portal

Flag	Label	Description
CLIENTS_PORTAL_MANAGE	Manage Client Portal	Create and disable client portal logins, whose sign-in details are emailed to the client contact, and choose each client's portal tabs. Turning on the Invoices tab also needs View All or Manage for both invoices and payments, and the Passwords tab a permission to manage that client's passwords.

Billing

Flag	Label	Description
MANAGE_BILLING	Manage Billing	View the workspace subscription, invoices, payment method, and change tiers, seats, or storage add-ons. Only billing managers see the plan, seats and renewal details.

Inventory

Flag	Label	Description
INVENTORY	Inventory	Open the Inventory and Locations pages and see every item, its custom fields, stock levels and the movement history.
INVENTORY_MANAGE_ITEMS	Manage Items	Create, update, and archive inventory items and their custom-field values.
INVENTORY_MANAGE_LOCATIONS	Manage Locations	Create, update, and archive inventory locations.
INVENTORY_MANAGE_FIELDS	Manage Fields	Create, edit, reorder, and delete custom fields on inventory items.
INVENTORY_RECORD_MOVEMENT	Record Movements	Record stock in, out, adjustment and transfer movements, and export the movement history.

Hiring

Flag	Label	Description
MANAGE_JOB_POSTS	Manage Job Posts	Create, edit, open and close job posts, build their application forms, and set up interview booking, which sends invites from your own Google Calendar.
VIEW_JOB_APPLICATIONS	View Applications	View submitted job applications, their answers, and uploaded files.
MANAGE_JOB_APPLICATIONS	Manage Applications	Change application status, assign reviewers, edit notes and delete applications, and fill in the public application form for an applicant without the email code.

Partner

Flag	Label	Description
VIEW_PARTNER	View Partner Dashboard	See the partner Overview: managed-org usage, billing run-rate, and the credit-line ledger. Read-only.
MANAGE_PARTNER	Manage Partner Organisations	Create and edit the organisations this partner manages, change their tier, add or remove their members, and set up the partner's default WhatsApp number. Includes View Partner Dashboard.

Platform

Flag	Label	Description
PLATFORM_ADMIN	Platform Admin	Cross-org superadmin: list and delete organisations, override tiers, toggle feature flags, manage partner credit lines, broadcast email, and configure the bots.

WhatsApp Chat

Flag	Label	Description
WHATSAPP_CHAT_VIEW	View WhatsApp Chats	See the WhatsApp section on the Chat page and read conversations with external contacts (including HR step-link threads).
WHATSAPP_CHAT_SEND	Send WhatsApp Chats	Reply to WhatsApp messages, start chats and close or reopen threads. Outside the 24-hour window the default template is used; picking any other template needs Send WhatsApp chat templates.
LISTEN_CALL_RECORDINGS	Listen to call recordings	Play recordings of WhatsApp calls and read their transcripts.
WHATSAPP_CHAT_TEMPLATES_MANAGE	Manage WhatsApp chat templates	Create, edit, archive and delete the templates members send in WhatsApp chats, and customise the default message and call request.
WHATSAPP_CHAT_TEMPLATES_USE	Send WhatsApp chat templates	Pick the workspace's own templates (beyond the default message and call request) to message a contact who last wrote more than 24 hours ago, to start a new chat, and to ask permission to call outside that window.

Nova

Flag	Label	Description
USE_NOVA	Use Nova	Chat with Nova, the AI assistant on the Chat page, to find, summarise, create, update and delete tasks. Nova only does what this role can already do with tasks, and every change waits for the member's approval.

Some permissions are deliberately narrow. For example, Payments shows only the payments you recorded and the payments on invoices you can open, while View All Payments shows every payment. Pages you can't open show an "Access Denied" page rather than an empty screen, and their sidebar entries are hidden. Developer Access is the most powerful of all: it lets someone create API keys, and a key can do anything in the workspace.

The Users page lists you and the people who share a team with you, with their contact details. View All Users or Manage Members shows every member of the workspace, with their contact details, linked Google account and WhatsApp number. Without any of these you see only yourself. Elsewhere in the app, a colleague's email address shows only to people with View All Users or Manage Members.

One important rule

You cannot grant a permission you don't have yourself. If a checkbox is greyed out when you're authoring a role, that's why, your effective permissions don't include it. Ask an Owner or Admin to do it for you.