Assigning Roles and Setting Per-Person Permission Overrides

Access in CPR Enroll is managed by role. Assign a person to a role and they inherit that role’s permissions; change the role and everyone holding it changes with it. Where one individual genuinely needs something different, you add a per-person override on top — without disturbing anyone else.

Before You Begin

• Find it at Settings → Permissions. The page has two tabs: Roles and A Person.
• The header sets the model: set one access level per module for this role, then expand a module to fine-tune individual tabs.
• Built-in roles are marked System role and carry a description — for example, Admin reads “Full operations and user management; not org Settings. As many as desired.”

✔ Users only see what they can access. Modules a user has no access to are hidden from their navigation entirely — which is why a colleague may not see a menu item you can see.

Step 1: Edit a Role

1. Open the Roles tab.
2. Choose a role from the dropdown.
3. Set the level for each module using the buttons on the right.
4. Expand a module (the chevron on the far right) to switch individual actions on and off.
5. Click Save.

Each module is listed with an action count, such as Classes — 27 / 31 actions, so you can see at a glance how far a role has been narrowed.

Step 2: Understand the Access Levels

Step 3: Use the Bulk Controls

• Search modules… filters the list.
• Set all to: None / View / Edit / Full applies one level across every module at once — useful as a starting point before you narrow it down.
• Reset to defaults returns the role to its shipped configuration.

✔ Start restrictive. Set all to: None, then grant what the role actually needs. It is far easier to justify than working down from Full.

Step 4: Push the Change to Existing Users

When you save an updated role, you can choose to apply the change to everyone already assigned to it. This removes the need to touch users one at a time and keeps permissions in step with the role.

Step 5: Override One Person

1. Open the A Person tab.
2. Pick the role, then search for the person.
3. Grant or remove a single permission for that individual.

Overrides are flagged clearly and can be removed at any time. They sit on top of the role and do not alter the underlying role for anyone else.

Step 6: Know What Happens When New Features Ship

When CPR Enroll adds a new permission, it is evaluated against default access and assigned to applicable roles automatically, so new features become available without manual admin work. Your custom overrides are preserved unless a default rule applies.

Best Practices

• Change the role first and the person second. If two people need the same exception, it is a role, not an override.
• Apply role changes to existing users when you save — otherwise the role and the people holding it drift apart.
• Review overrides periodically. They are flagged for a reason: each one is an exception someone has to remember.
• Use Reset to defaults when a role has been edited past recognition, then re-narrow deliberately.
• Before troubleshooting “the menu is missing”, check the role. Hidden modules are a permissions outcome, not a bug.

Frequently Asked Questions

✔ You’re all set. Roles for the rule, overrides for the exception — and the navigation each person sees follows automatically.