Skip to the guide
H2Horizon213 GuideHorizon213 ERPAll guides
Ask a question

All guidesSet up your company

Change or revoke someone's access

Move a person between roles, suspend them without deleting them, and do it per company.

Steps
4 · About 2 min
Who can do this
Owner · Manager

Before you start

People change jobs, leave, or need less access than they were given. Access lists everybody who can reach this workspace, with one line per company they can reach.

Set the role and the status

Screenshot: member-access

What to look at:

  1. Role — what they can do in this company: owner, manager, accountant, member, or read-only. Change it and press save; it takes effect immediately, including for a session they already have open. Who can do what sets out the ladder.

  2. Status — active or suspended. Suspending keeps the person and everything they did, and stops them getting in.

Both are per company. Somebody can be a manager in one entity and read-only in another, and changing one line changes nothing about the others.

Suspend rather than remove

When somebody leaves, suspend them.

Everything they created stays attributed to them: the invoices they raised, the payments they took, the entries they posted. That is what the activity trail is for, and a removed person makes a year of history read as though nobody did any of it.

Suspension is also reversible in one press, which matters more often than people expect — somebody on long leave, a contractor between engagements, an account locked while a question is sorted out.

Narrowing rather than removing

If the problem is that somebody can do too much, the answer is usually a smaller role rather than no access at all.

Moving a person to read-only leaves them able to do their job's reading part and removes the risk. It is also a much easier conversation than switching them off, and it avoids the outcome that actually causes damage: somebody who cannot get in borrowing an account that can.

Employees and users are not the same

Removing somebody's access does not touch their employee record, their salary profile, or their payslips — and changing their employee status does not affect whether they can sign in.

Two separate things, deliberately. Most employees never have an account at all.

You cannot lock yourself out by accident — but in a workspace with one owner, consider adding a second before changing your own line. An owner is the only role that can restore the others, and there is no support desk behind a self-hosted deployment.

Next, you might want to