Skip to content

User Management

Users, roles, a permission matrix, groups, and multi-site membership — RBAC without the guesswork.

Updated

User Management

Find it: Management → User Management (Admin group).

Sound familiar?

  • "Who has access to approve purchase orders? Nobody's sure."
  • "A contractor left — did we revoke everything?"
  • "Permissions are a free-for-all because roles are too coarse."

Access control that nobody understands is the same as having none.

The Problem

Roles get bloated ("admin-lite"), permissions are granted ad hoc, and offboarding is incomplete. When you can't answer "who can do X?", you either over-share or block real work.

What OpexMX User Management Does

Gives you users, roles, a real permission matrix, and groups — plus multi-site membership — so access is explicit, reviewable, and revocable.

Permission Matrix (RBAC)

Permissions are an entity × action matrix (e.g. ticket.read, pm.create, workflow.approve), managed through a dedicated UI — not buried in the role row. Assign a role a clean set of capabilities; change it in one place.

Users & Roles

Manage users (profile, email verification, push preferences) and roles. Grant roles to users; stack roles where it makes sense.

Groups & Teams

Group users (crews, teams, shifts) and assign roles and membership at the group level — far less churn than per-user management.

Multi-Site Membership

Users belong to sites. Grant or revoke site membership per user, so a technician sees only their site's assets and work.

Self-Service

Users can verify their password and self-delete their account; the audit trail stays intact.

How It Works

  1. Define roles by selecting capabilities in the permission matrix.
  2. Create users and assign roles.
  3. Group users into teams/crews as needed.
  4. Scope users to sites.
  5. Review access periodically; revoke on offboarding.

Who Uses This?

RoleWhat They Care About
AdminsLeast-privilege that still lets people work
SecurityWho-can-do-what, answerable in seconds
HRClean onboarding and offboarding
Multi-site OpsPer-site visibility without separate logins

Pro Tips

  • Build a few well-named roles rather than one per person.
  • Use groups for crews — it survives reorgs better than per-user edits.
  • Audit the matrix quarterly; prune stale grants.
  • Revoke site membership the day someone transfers.

Integrations

  • Every module: the matrix gates tickets, PM, parts, workflows, and more
  • Sites: membership scopes asset and work visibility
  • Audit Log: permission changes are recorded