All guidesHow Horizon213 thinks
Who can do what
The four levels of access, what each one really means, and why read-only is a wall rather than a hidden button.
- Steps
- 4 · About 3 min
- Who can do this
- Owner · Manager · Accountant · Team member · Read only
Access is decided per person, per company. Somebody can run one company and never know the others exist.
There are two layers: what you are in the organisation, and what you are in each company. Most people only ever meet the second.
The four levels
Owner / administrator of the organisation. Everything, in every company. The only people who can create a company, manage team access, or share a contact or product across the group. This is you, and probably nobody else.
Manager. All the daily work, plus the company's own configuration: identity, modules, fiscal defaults, business-specific fields, CSV imports. A manager runs a branch without being able to create another one.
Accountant. Daily work plus the books: posting journal entries, closing and reopening periods, bank reconciliation, posting payroll. Not settings. This is the person who answers to the tax authority, and the split exists so they can do that without also being able to reconfigure the business.
Team member. Creates and updates the everyday records — invoices, deliveries, receipts, stock movements, payments. No settings, no imports, no team access.
Read only. Every register and every report, and no control that changes anything.
What read-only actually means
Two things, not one.
The controls are not drawn — a read-only user sees the invoice, not the buttons that would confirm or cancel it, and the sidebar tells them so.
And the database refuses the write regardless. If a request were crafted by hand to bypass the screen entirely, it would still be rejected, because the rule lives in the data, not in the page.
That is worth knowing when you give someone read-only access to reassure a partner, an auditor, or a bank: it is a real boundary, not a politeness.
Group view is read-only for everybody
A workspace with several companies can be viewed as a group — consolidated figures, every record naming the company it came from.
Nobody can write anything there, including you. Every transaction has to have an unambiguous owner, and a screen showing five companies at once cannot say which one a new invoice belongs to. Choose a company first.
What this means when you invite somebody
Give the least that lets them do their job — not out of suspicion, but because it is the setting that survives contact with reality. The person who only takes counter sales does not need the settings screen, and the day they click something they did not mean to, the boundary is what saves the afternoon.
You can change somebody's level later, and the change applies the next time they load a page. Nothing they already recorded is affected: their work stays theirs, with their name on it.
Next, you might want to
- Invite a teammate and choose what they can doSend an expiring invitation link scoped to the companies and the level of access you choose.
- Why nothing here is ever editedHorizon213 corrects mistakes by posting the opposite, not by changing what was written. This is the rule behind almost every "you cannot" in the guides.