How access works

A user can open a feature only when the selected park owns the module and the assigned role grants the required action. Park assignment, module entitlement, and role permission work together.

  • Park assignment controls which parks appear.
  • Module entitlement controls which product areas exist for that park.
  • Role permission controls View, Create, Edit, Delete, and other supported actions inside those areas.
  • The same action permission controls list buttons and direct routes; hiding a button alone is not authorization.

Protected roles and users

  • Super Admin has all platform permissions and its role assignment is read-only.
  • The park Owner receives the permissions made available to that park and can manage local roles.
  • Super Admin and Owner cannot be deleted from their protected scope.
  • Protected Super Admin and Admin permission sets are visible as read-only rather than editable checkboxes.
  • A park owner does not see the platform Super Admin role in local role management.

Create safe access

  1. 1

    Open Admin → Roles & Permissions and create or review a custom role.

  2. 2

    Grant only the required View, Create, Edit, Delete, approve, refund, or administrative actions.

  3. 3

    Save, reopen the role, and confirm the selected permissions remain checked.

  4. 4

    Open Admin → Users and create the user.

  5. 5

    Assign the correct park or parks and a permitted role.

  6. 6

    Ask the user to sign in and confirm the visible navigation and row actions.

Understand listing actions

Create buttons and View, Edit, Delete, Activate, or Deactivate row actions appear only when the current user has the matching permission. Some records, such as owner-managed locations, may allow Edit while Delete remains intentionally unavailable.

Permission updates should not sign you out

After saving a role, the current session should refresh its effective permissions. An unexpected logout indicates an authorization or session-refresh problem, not a successful permissions update.

A menu or action is missing

Check the active park, the park’s assigned modules, the user’s park assignment, the role permission, and whether the record is protected. Directly entering a hidden URL must not bypass these controls.

Least privilege

Start with the minimum access required and add permissions only when the workflow needs them.