Custom Roles

Custom roles let you define exactly what users can access, beyond what the predefined roles offer.

When to Use Custom Roles

Create custom roles when:

Predefined roles don't match your organizational structure
You need a role with a specific subset of permissions
Different teams need different access levels
You want to implement least-privilege access

Example Use Cases

Custom Role	Purpose	Key Permissions
Travel Coordinator	Book travel for others, no approvals	Travelers, Passports, Delegations
Budget Analyst	View spending, no configuration	Read Budgets, Read Requests
Regional Manager	Approve requests for a region	Process Requests, Read Users
Compliance Officer	Audit access, no changes	Read-only across all features

Creating Custom Roles

Prerequisites

Admin role or Write Company Roles permission
Access to company dashboard

Steps

Navigate to Roles in the dashboard
Click Create Role
Enter role details:
- Name — Display name (e.g., "Travel Coordinator")
- Description — Purpose of the role
- Status — Active/Inactive
Select permissions from the matrix
Click Create

Permission Selection

The Permission Matrix

Permissions are displayed in a grid organized by category. The matrix shows:

Group checkboxes — Select/deselect all permissions in a category
Individual checkboxes — Toggle specific permissions
Permission count — Shows how many permissions are selected (e.g., "12 of 26 selected")

Selection Features

Group Checkbox — Select/deselect all permissions in a category
Indeterminate State — Shows when some permissions in a group are selected (partial fill)
Select All — Toggle all permissions at once
Permission Count — Shows selected vs total

At least one permission is required for every role.

Role Code Generation

When you create a custom role, a code is automatically generated from the name:

Name	Generated Code
Travel Coordinator	`TRAVEL_COORDINATOR`
Regional Manager	`REGIONAL_MANAGER`
Budget Analyst	`BUDGET_ANALYST`

The code:

Is uppercase with underscores
Must be unique within the company
Cannot use reserved codes (MEMBER, MANAGER, ADMIN)
Is used internally for identification

Editing Custom Roles

You can modify any aspect of a custom role:

Editable	Yes
Name	✅
Description	✅
Permissions	✅
Status	✅

Editing Steps

Find the role in the Roles list
Click the Edit button
Modify desired fields
Click Save Changes

Permission changes take effect immediately. Users with the role will gain or lose access on their next request.

Deleting Custom Roles

Custom roles can be deleted if no users are assigned.

Prerequisites for Deletion

Role must be a custom role (not predefined)
No users currently assigned to the role

Deletion Steps

Reassign any users to a different role
Find the role in the Roles list
Click the Delete button
Confirm deletion

If Users Are Assigned

You'll see an error if users are assigned. The error message indicates how many users need to be reassigned first.

Reassign these users to a different role, then retry deletion.

Role Status

Roles can be active or inactive:

Status	Effect
Active	Role can be assigned to users
Inactive	Role cannot be assigned; existing users keep access

Deactivating a role does not revoke access from currently assigned users. It only prevents new assignments.

Best Practices

Least Privilege

Grant only the permissions needed:

❌ Avoid	✅ Better
Give everyone Admin role "just in case"	Create specific roles for each function

Meaningful Names

Use descriptive names that indicate purpose:

❌ Avoid	✅ Better
"Custom Role 1"	"Travel Coordinator - EMEA"

Document Purpose

Use the description field to explain:

Who should have this role
What they can do
What they cannot do

Regular Audits

Periodically review:

Which roles exist and their permissions
Who has each role
Whether roles still match organizational needs

Migrating Between Roles

When changing a user's role:

Find the user in the Users list
Click Edit
Select the new role from the dropdown
Save changes

The user's permissions update immediately.

Custom Roles

On this page