Permission Groups¶

Permission Groups are reusable capability bundles that roles use to define allowed actions. Permissions are additive: if a user holds multiple roles in the same portfolio, they receive the union of all attached group permissions.

Groups follow the naming pattern Credence - {Scope} - {Tier}. Tiers are View, Manage, and Admin. Not every role needs every tier. Your admin and Credence team will choose which groups to attach at onboarding.

Admin → System → Permission Groups provides read-only research into groups, their permissions, and linked roles. Group descriptions and permission membership are edited in Django administration. For a list of every permission and what it allows, see the Permission Catalog.

Group details and visibility¶

Permission groups are defined by Credence and shared across customers. They can be attached to customer roles without changing the roles' customer ownership.

Users with Permission Group · View permission can research these shared groups. Linked-role summaries include only roles the viewer can access, including roles held through active delegations.

Only superusers can create, edit, or delete Credence permission groups in Django administration. Other staff with the required viewing permissions have read-only access.

Each group has a stable public ID and optional description. Current groups display Credence as their customer; customer selection is not available in these screens. These details do not change how permissions from role assignments are combined.

Assignment history¶

User, portfolio, and role audit timelines retain portfolio role grants and removals. A role's timeline also retains permission-group assignments and removals. Changing an assigned role records the change on both the previous and replacement role timelines.

This applies to newly recorded changes. Older events without a stored timeline association are omitted from related timelines. All history remains subject to the audit retention period.

Permission tiers¶

Default vs configuration objects¶

Most objects follow a simple pattern: View grants read access; Manage grants create and edit; Admin grants delete (plus any domain-specific high-risk customs).

Configuration objects are structural records with high blast radius—chart of accounts, bank accounts, cost breakdown structures, and similar reference data. For these, create and edit belong at Admin within the domain. Users with only Manage can still view and use those records (select accounts, post bundles, assign cost codes) but cannot restructure them.

Credence - Standard - Manage is a union of domain Manage groups. Configuration objects elevated to Admin are not included in Standard Manage unless you deliberately attach Admin-tier domain groups or add those permissions manually.

Cross-cutting group families¶

Standard¶

• View covers operational domains (banking, bookkeeping, payables, receivables, portfolio, tenants, vendors, projects, and related areas) plus accounting reports. It excludes user administration and workflow definition configuration.
• Manage adds Add and edit on those domains and document handling.
• Admin adds delete and other destructive actions across the same operational domains. It still excludes User and Workflow admin surfaces.

User¶

• Covers customer users, roles, permission groups, and related configuration.
• Manage supports routine maintenance without delete on users and roles.
• Admin includes full administration, including destructive actions.

Workflow¶

• Covers workflow definition setup (not day-to-day approval steps on individual records—those use object edit permissions).
• Manage configures workflows without delete.
• Admin includes delete of workflow definitions.
• Special grants object-scoped Edit Approved permissions (for example editing an approved lease or payable). Attach this group when a role needs to change already-approved workflow objects; it is not included in domain Manage tiers.

System and Audit¶

• System - Admin bundles User Admin and Workflow Admin for customer administrator setup.
• Audit - View is a read-only superset of Standard View, User View, and Workflow View, plus Audit Log and Emails under Admin → System.

Domain groups¶

Each business area below has View, Manage, and Admin groups in the catalog. Your team may attach only the tiers that match each job function.

Insurance and contact permissions ship with Tenants, Vendors, and Portfolio groups—not as separate assignable group families.

Change orders do not require separate permission grants. Vendor Contract · View controls visibility, while Vendor Contract · Edit controls creating, editing, deleting, submitting, and directly approving a change order for that contract.

Development vs Projects: CapEx project permissions (Credence - Projects - *) and Development permissions (Credence - Development - *, including cost breakdown structures) are separate group families even though both live in the project app. Attach only the groups that match each role's sidebar scope.

Review tools¶

• Permission Matrix (Reports Dashboard → Admin) — grid of roles versus Credence permissions.
• Permission Catalog — App, Object, and Action for each permission, with what it allows.
• Admin → System → Permission Groups — which permissions are in each group.

Notes¶

• Permission Groups define capability, not record visibility.
• Record visibility is determined by portfolio role assignments and property scope.
• Combining roles combines capabilities; review assignments as a complete set.