Troubleshooting Roles & Permissions

Why a role doesn't behave as expected: Security settings that override roles, permissions that must be combined, how multiple roles combine, and common fixes.

Written by Annukka Matilainen

Updated at October 22nd, 2026

+ More

Table of Contents

Before you start: three things decide what a user can do Security settings that override roles How Fixably combines more than one role Permissions that need to be combined Common problems and fixes Still stuck?

This article covers the most common reasons a role does not behave the way you expect: settings elsewhere in Fixably that override a role, permissions that only work when combined with others, and how Fixably resolves a user who has more than one role. If you are new to roles, start with Using Roles & Permissions in Fixably. For what each individual permission does, see Roles & Permissions Definitions.

Before you start: three things decide what a user can do

The user's Access level (on the user card). Roles only apply to users set to User (Employee access). Users set to Admin (Full access) skip every role permission and can do everything, whatever roles they hold.
The Security settings under System Settings → Security → General. Several of these settings apply to all employees and are checked in addition to roles. When a setting says no, granting the matching permission on a role does not override it. These settings are listed in the table below.
The user's roles, set under System Settings → Security → Roles & Permissions and assigned on the user card.

Tip: test with an employee account. Because admins skip role permissions, an admin who changes a role and then checks their own screen sees no difference. Test your changes with a user whose Access level is User (Employee access), or ask a colleague who holds the role.

Security settings that override roles

These settings sit under System Settings → Security → General. They were created before Roles & Permissions existed, and most of them still apply to every user with User (Employee access) even when roles are switched on. If a role does not seem to work, check this table first.

Security setting	What it controls	How it interacts with roles	To get the result you want
Employees are allowed to edit product prices	The price fields on the product card (sale, purchase and exchange prices, and GSX pricing options).	No role permission controls this. If the setting is off, employees cannot change product prices even when their role has Edit product. They can still edit the product's other fields. This setting is not about prices on orders. The role permission Edit order line prices controls order lines, not product cards, so ticking it does not let anyone change catalogue prices.	To let some employees maintain product prices, turn this setting on, then give Edit product only to the roles that should change products. Employees without Edit product still cannot change the product.
Allow employees to edit prices on order	Changing prices on order lines (including the price shown when adding a product to an order).	Both this setting and the role permission must allow it. If the setting is off, Edit order line prices on a role has no effect and the price fields stay read-only for every employee.	Turn the setting on, then remove Edit order line prices from the roles that should not change order prices. Every role has this permission by default, so leaving it in place means all employees can edit order prices.
Allow employees to edit products	Creating and editing products.	When Roles & Permissions is on, this setting is ignored. The role permissions Create product and Edit product decide instead. Neither of these is on the default User role, so employees can view products but not change them until you grant them.	Grant Create product and/or Edit product on the roles that maintain your catalogue. For price fields, see the first row.
Employees are allowed to delete orders	Deleting orders that are not drafts, using Remove from queue on an order (which sets it back to draft), and macros that delete the draft order when the user exits the macro.	Both this setting and the role permission must allow it: Delete order for deleting, Set order as draft for Remove from queue. If the setting is off, no employee can do these things, whatever their role says. Employees with Delete order can still delete orders that are already drafts.	To let only some employees delete orders: turn the setting on, then remove Delete order and Set order as draft from every role that should not have them. Both are on the default User role.
Employees are allowed to edit customer email addresses	Whether employees can change the email address on a customer card.	No role permission controls this. Edit customer lets an employee edit the customer card, but the email field stays read-only unless this setting is on.	Turn the setting on if employees with Edit customer should also be able to correct email addresses.
Employees are allowed to edit handler on order list	Only the quick-edit of the handler directly in the order list.	It does not control changing the handler from inside an order. That is controlled by the role permission Edit handler, which is on the default User role.	To stop employees reassigning orders, remove Edit handler (and Batch edit order handler) from their role. Turning this setting off on its own only removes the shortcut from the list.
Employees are allowed to manage stocks	Whether the Stock item appears in employees' left-hand menu.	When Roles & Permissions is on, this setting works as an on/off switch for the menu item. If it is on, the View stocks permission decides who sees the Stock menu item and can open it. If it is off, no employee sees the menu item, even when their role has View stocks.	Keep this setting on, and control who can use stock with the Stocks permissions on each role.
Void paid invoices	Whether an invoice that already has payments can be voided.	This applies to everyone, admins included. A role with Void single invoice can only void unpaid invoices while this setting is off.	Turn the setting on, then give Void single invoice only to your finance role.
Restrict users to taking assignment at their own service location	Which orders an employee can take assignment of.	It applies on top of the Take assignment of an order permission. An employee with the permission can still only take orders from their own service location.	Expected behaviour. Admins are not affected.

How Fixably combines more than one role

A user can hold several roles. Fixably combines them as follows:

Permissions add up. If any one of the user's roles grants a permission, the user has it. You cannot use a second role to take a permission away. To restrict someone, remove the permission from every role they hold.
Hide product prices, Hide customer information, Locked to default location and store, and Can see Central Warehouse stocks only apply if every role agrees. If a user has one role with Hide product prices ticked and another role without it, prices are shown. The same applies to the other three. This is the most common reason a restriction seems to be ignored.
Use simplified home screen works the other way round. If any of the user's roles has it ticked, the user gets the simplified home screen and menu. This setting also applies to admins, so an admin who holds a role with it ticked gets the simplified screen too.
The Global settings (Hide product prices, Hide customer information, Locked to default location and store) never apply to admins. An admin always sees prices, customers and every location.

Hide product prices vs. View purchase price. Hide product prices (a Global setting on the role) hides customer-facing sale prices, and with them invoices, receipts and cost estimates. The View purchase price permission controls the purchase (cost) price separately. To hide both, tick Hide product prices and remove View purchase price.

Permissions that need to be combined

Some permissions do nothing on their own. Grant them together as shown below.

To let a role…	Grant	Why
Create, edit or delete almost anything	The matching View … permission as well	A user cannot edit what they cannot open. For example, Edit alarms needs View alarms, and Edit vendor needs View vendors.
Appear in the order Handler list	Can be assigned as Order Handler	When Roles & Permissions is on, only users whose role has this permission appear in the handler picker. This includes admins. It is not on the default User role, so a newly enabled account may find its handler list empty or missing people. Give it to a role held by everyone who should own orders.
Appear in the user statistics report	Visible in User Report	Works like the handler list: only users whose role has it are listed, admins included. It is not on the default User role.
See the Reports menu	At least one of: View reports, View stats for users, View stats for user's location	The menu only appears with one of these three. View advanced reports, View status duration statistics and View stats for all locations do not show the menu on their own.
See the Invoicing menu	At least one Manage … invoice permission (for example Manage single invoices)	The other invoice permissions (mark paid, print, send, void) act on invoices you have opened from that menu. Taking payment and creating an invoice from inside an order does not need these. That is covered by Charge order.
Assign roles to other users	Edit role + Edit user + View users	Fixably ticks Edit user automatically when you tick Edit role, and removes Edit role if you untick Edit user. This lets someone assign existing roles to users. Creating or changing the roles themselves is always admin-only.
Import stock	Import stock + View background jobs + Create difference list	Imports run in the background and produce a difference list to confirm. Fixably ticks the two extra permissions when you save a role with Import stock. If an older role is missing them, open the role and save it again.
Delete order lines	Delete draft order line and/or Delete confirmed order line	With only Delete draft order line, the user can remove lines that are still in draft but not confirmed lines.
Reveal encrypted task data (for example passcodes)	Reveal order task encrypted data or Reveal order task encrypted data only on orders assigned to the user	The first works on every order. The second only works on orders where the user is the handler. To limit a role to its own orders, give only the second. The default User role has both, so remove the first.
Open another user's User Settings (for example to renew their GSX token)	Manage other users' settings	This must be granted through a role. It is not on the default User role. Employees can never open the settings of an admin this way.
Create brand-new order tags (not just pick existing ones)	Create new order tags + Edit tags	Edit tags lets the user choose from existing tags. Create new order tags lets them add new ones. Admins can always create tags.
Change a customer's billing customer	Edit customer	The billing customer and billing reference fields only appear on the customer card for users with Edit customer.

Common problems and fixes

What you see	Likely cause	What to do
I changed a role, but nothing changed when I checked.	You are checking with an admin account. Admins skip role permissions.	Check with a user whose Access level is User (Employee access).
A role has a permission ticked, but the user still can't do it.	A Security setting is switched off (see the first table), or a required companion permission is missing (see the second table).	Check both tables above.
A user can still do something I removed from their role.	Another of their roles grants it (permissions add up), or the user's Access level is Admin (Full access).	Open the user card and check every role they hold and their Access level.
Hide product prices, Hide customer information or Locked to default location and store is ticked, but the user is not restricted.	The user holds another role where the same setting is not ticked. These settings only apply when every role agrees. Admins are never restricted.	Tick the setting on all of the user's roles, or remove the extra role.
A user suddenly has the simplified home screen and is missing menus.	One of their roles has Use simplified home screen ticked. One role is enough, and it applies to admins too.	Untick it on that role, or remove that role from the user.
A technician (or manager) is missing from the Handler list.	None of their roles has Can be assigned as Order Handler. When Roles & Permissions is on, this applies to admins too.	Add the permission to a role the person holds.
A user is missing from the user statistics report.	None of their roles has Visible in User Report.	Add the permission to a role the person holds.
A user can open the product card but the price fields are greyed out.	Employees are allowed to edit product prices is off.	Turn it on under System Settings → Security → General.
Order line prices are read-only for a user.	Allow employees to edit prices on order is off, or the role is missing Edit order line prices.	Both must allow it.
A user has Advanced reports or Status duration permissions but no Reports menu.	The menu needs View reports, View stats for users or View stats for user's location.	Add one of these as well.
The Stock menu is missing for employees.	Employees are allowed to manage stocks is off.	Turn it on. If the setting is already on, check that the user's role has View stocks.
A permission described in the KB is not in the role editor.	The role editor only shows permissions for features and integrations that are switched on for your account. For example, Appointments permissions only appear when the internal appointment scheduler is enabled, and GSX permissions only appear when GSX is connected.	Enable the feature or integration first. If you think it should already be on, contact Support.
A user has lost all of their roles.	Saving the roles on a user card replaces the whole set with what is ticked at that moment.	Open the user card, tick the right roles again and save.
I can't rename or delete the User role.	This role is protected. A rename is quietly undone, and it cannot be deleted.	To use a different default role, create a new role, tick Default role for new users on it, and leave User unassigned.
I can't delete a role.	It is the current default role, or no default role exists to move its users to.	Make another role the default first. When you delete a role, its users are moved to the default role. The confirmation tells you how many users will be moved and where.
"Role must have permissions" when saving.	A role needs at least one permission ticked.	Tick at least one permission (Enable Idle Mode counts).
A role can't be assigned to a user.	Roles from Roles & Permissions can only be assigned to users with Access level User (Employee access) or higher. Customers can't hold them.	Check the user's Access level.
We switched Roles & Permissions off and on again, and our old roles came back.	Switching it off does not delete your roles or assignments. They are kept and reused when you switch it back on.	Delete or edit any roles you no longer want.
Idle Mode doesn't log out an admin.	Enable Idle Mode only applies to employees through their role.	Expected behaviour.
An employee can't remove an admin's login.	Admin accounts can't have their login removed from the user card. No permission allows it.	Change the user's Access level to User (Employee access) first if the login really has to be removed.

Still stuck?

Contact Support and include:

The name of the affected user and their Access level
The roles assigned to them
What they tried to do, where in Fixably, and what happened (a screenshot helps)
Whether an admin can do the same thing

roles permissions troubleshooting security