The platform controls what users can see and do through two complementary access control mechanisms: User Roles, which govern functional access to applications and modules, and Data Security Roles, which govern record-level access within objects.

​

A role is a named set of permissions. It represents a type of user rather than a specific individual — multiple users can be assigned to the same role, and a user can belong to more than one role.

Roles control access at two levels:

Module permissions determine which modules a user can access within an application. If a user does not have permission to access a module, that module does not appear in the side menu and its screens are inaccessible.

Application access is derived automatically from module permissions. When a role is granted access to a module, the platform automatically grants that role access to the application the module belongs to. Application permissions do not need to be configured separately.

Applications and modules only appear in the user interface when at least one screen is associated with them.

Roles also control access to web-service resources, which is relevant for OData API access. Only objects included in a permitted resource are accessible via the API for that role.

​

Data Security Roles restrict which records a user can see within a specific object. This operates independently of User Roles: a user might have module-level access to view an object but be restricted to a subset of its records by a Data Security Role.

Data security applies both through the user interface and through the OData API. It must be explicitly enabled on each object — if Apply Data Security is not enabled on an object, any configured rules have no effect.

Restrictions defined on one object automatically propagate to objects that directly reference the secured object. Indirect references — where one object references another that references the secured object — do not inherit restrictions automatically.

Multiple Data Security Roles can apply to the same object. A user assigned to more than one role will have access to the union of records permitted by all their assigned roles.

​

The SUPER_USER Data Security Role grants access to all records on all objects where data security is enabled. Users assigned to SUPER_USER are not subject to any data security restrictions.

When processes run in the background, they execute with SUPER_USER permissions. This ensures processes can read and write all records regardless of data security configuration.