# Default permission matrix

Permissions are stored as module/action records and are editable from Roles. The seeder provides starting assignments; it does not hard-code role checks into business services. `Super Admin` and `Company Admin / Owner` receive the full matrix.

| Role | Default module scope |
|---|---|
| Accountant | Sales/purchase view, returns, inventory view, accounts, journal, cash, bank, receipts, payments, expenses, VAT, reports, audit |
| Cashier | Dashboard, products, customers, sales, receipts |
| Sales User | Dashboard, products, customers, sales, sales returns, receipts |
| Purchase User | Dashboard, products, suppliers, purchases, purchase returns |
| Storekeeper | Products, categories, units, inventory, warehouses, adjustments, transfers |
| Van Salesman | Products, customers, sales/returns, inventory view, receipts, van operations |
| Van Supervisor | Van operations/approval, warehouse transfer, sales/returns, inventory, reports |
| Auditor | Read, print, export, cost/profit/report, and allowed-branch views only |

Each module has actions such as `view`, `create`, `edit`, `delete`, `approve`, `cancel`, `print`, `export`, `view_cost`, `view_profit`, `change_price`, `give_discount`, `change_vat`, `backdate_transaction`, `reprint_invoice`, and `access_settings`. Customer credit override is a distinct `sales.credit_override` permission.

Before production, review every non-administrator role against job duties, remove unused actions, and restrict users to their permitted branches. Use separate named accounts; never share the administrator account.