Team and permissions
Hilal Software uses feature-based access control. Each feature (Inventory, Advertising, Finance, Settings, etc.) has roles that you assign per member. This is the deeper guide; for the quick onboarding flow see Invite your team.
In this guide:
- Team member overview
- Invite and manage members
- Override feature-level roles
- How enforcement works
Team member overview
Settings → Team Members shows:
- Total Members — active members in your organization.
- Pending Invites — sent invitations awaiting acceptance.
- Seats Used — count of active + pending members against your plan’s member limit.
Exceeding your seat limit blocks new invitations until you upgrade your plan.
Step 1: Invite and manage members
- Invite — click the Invite button at top-right. Enter one or more email addresses. See Invite your team for the full flow.
- View details — click a member row to see their status, role, and feature-level permissions.
- Remove — click a member row → Remove from organization. The member loses access immediately; their data contributions stay.
Step 2: Override feature-level roles
Click any member row → Manage feature roles button.
The Feature Role Permissions dialog assigns roles per feature. Roles differ by feature:
- Inventory — Owner, Admin, Analyst, Viewer.
- Advertising — Owner, Admin, Analyst, Viewer.
- Finance — Owner, Admin, Analyst, Viewer.
- Customer Hub — similar role hierarchy.
- Settings — restricted to higher-privileged members.
Click a feature row to assign or change the role for that member. Role changes take effect on the member’s next page load.
Step 3: Server-side enforcement
Every API call checks the member’s assigned feature roles before allowing the action. Access is denied server-side for any operation outside the member’s permissions.
How permissions work
- Server-side (authoritative) — every API call checks the caller’s assigned feature roles.
- Client-side (UI gating) — buttons, menus, and pages hide based on fetched permissions. Hidden ≠ inaccessible — the server enforces access.
Troubleshooting
- Role change didn’t take effect. Have the user reload the page or wait 60 seconds for caches to refresh.
- A removed member can still access via old token. Session tokens are invalidated on removal; the server blocks access regardless.
- Transfer ownership. Ownership transfer is not currently available. Please contact support.