System Users & Roles

Staff & Administration

What it does

This module controls who can log in to Memvera and exactly what they're allowed to see and do. Access is granted only through roles — never ad-hoc per person — and each role is built from fine-grained permissions tied to specific screens, buttons, reports, and data. It also scopes users to the clubs, brands, and gender data they're authorised for, which matters for Saudi privacy rules, and enforces security controls like login lockouts and single-session sign-in.

Key concepts

• Role — a named bundle of permissions. Assigning a role is the only way to grant access; you can clone an existing role to create a similar one quickly.
• Atomic permission — a single, clearly described capability (Read / Write / Execute / Delete) mapped to a specific screen, button, report, or endpoint.
• Scope — the clubs, brands (e.g. Optimo / B_FIT), and gender designations a user may view or manage. Cross-gender visibility is walled off unless explicitly authorised.
• Additive permissions — when a user has multiple roles their permissions add up, while conflict-of-interest rules prevent mutually exclusive rights being combined.
• User–employee link — each login is tied to an employee profile, giving a full "who can do what" trail for audits.
• Security controls — account lockout after repeated failed logins, automatic session timeout, and single-session enforcement (no shared simultaneous logins).

Main tasks

Create or clone a role

1. Open Roles and choose New role — or Clone an existing role to start from its permission set.
2. Give it a clear name (e.g. "Reception – Optimo Riyadh").
3. Set the atomic permissions for each screen and action: Read, Write, Execute, or Delete.
4. Save. The role is now ready to assign to users.

Add a system user and set their scope

1. Open Users and choose Invite / New user, then enter their details and link them to an employee profile.
2. Assign one or more roles — permissions combine, and conflicting roles are blocked.
3. Set the user's scope: the clubs, brands, and gender data they may access.
4. Save / send the invite. The user signs in with their own credentials.

Review access and security

1. Open the traceability view to see every user, their roles, linked employee, and club scope in one place — your audit report.
2. Confirm the security policy is set: password rules, lockout after failed logins, session timeout, and single-session enforcement.
3. Adjust a user's roles or scope at any time; backend checks apply the change in real time, even to deep links.

Tips

INFO

Memvera validates permissions on every request, not just at login. Sharing a direct URL with someone who lacks the permission won't work — they get an access-denied message.

TIP

Use role cloning when you need a near-identical role with one or two differences — it saves reassigning dozens of permissions by hand and reduces mistakes.

Related modules

Employees · Approval Processes · General Functions · Performance & Security