# Recommended Permission Sets

Starting points for common roles. Create a permission group for each role (use **Copy** to start from an existing group), then adjust to your business. Every role should also have *Managers - Change Self Password*, *Managers - Update Self Information* and *Managers - Two Factor Auth (2FA)*.

## Administrator

**Managers - System Administrator** (full access). Keep this group for a few trusted people, and use *Restrict To...* so resellers can't assign it.

## Super Reseller (has sub-resellers)

- **Users:** Index, Create, Update, Activate, Activate using manager balance, Extend Service, Change Profile, Rename, Disconnect, Deposit Money, Withdraw Money, Show Sessions, Show User History, Show Users Invoices, Export to Excel.
- **Managers:** Index, Create, Edit / Update, Deposit Money, Withdraw Money, Self Deposit.
- **Profiles:** Index, Pricing Management.
- **Cards:** Series Index, Generate Refill Cards, Download, Designer, Change Owner.
- **Reports:** Activations, Managers Journal, Managers Invoices.

## Reseller

- **Users:** Index, Create, Update, Activate, Activate using manager balance, Extend Service, Disconnect, Show Sessions.
- **Managers:** Self Deposit (if online top-up is used).
- **Cards:** Series Index, Download (if the reseller sells cards).
- **Reports:** Activations.

## Support / Helpdesk

- **Users:** Index, Show Sessions, Show User History, Disconnect, Live Traffic Monitor, Ping, Edit MAC addresses, MAC Lock User, Reset Daily Quota, Show Support Tickets, List All Users (or List All Group Users).
- **Reports and Logs:** Auth Log (Dialup), Sessions.
- No money permissions (Activate, Deposit, Withdraw).

## Accountant

- **Billing**, Users - Show Users Invoices, Users - Show Users Journal.
- **Reports:** Activations, Managers Invoices, Managers Journal, Money Transfers, Payment Gateway Transactions, Export Journal.
- **Managers:** Index, Show Invoices, Show Receipts, Show Journal.

## Point of Sale (shop counter)

- **Users:** POS, Index, Activate, Activate using manager balance (or using voucher).
- With *Users - POS* the Users List stays empty until the cashier searches for an exact username, phone or ID.

<p class="callout warning">Avoid giving resellers: *Users - Edit Advanced Fields*, *Users - Delete Active Users*, *Managers - Login As*, *Tools*, *Backup* and *Settings* permissions.</p>

All permissions are described in [Permissions Reference](https://help.snono-systems.com/books/sas-radius/page/permissions-reference).