Users, groups, and policies

Access is built from three things. A policy lists pages and what may be done on each — view, add, edit, delete, export, import — and whether that is allowed or denied. A user group is a set of people; attach policies to the group and everyone in it gets them. And a user gets permissions from their job function, from the groups they are in, and from any policy attached to them directly.

• Deny always wins. If any policy denies something, no other policy can allow it.
• Anything no policy allows is not allowed.
• The Dashboard is a page like any other. Every job function opens it, and so does any policy that allows it. Someone who cannot open it goes straight to the first page they can open when they sign in.

Where to find it

Open Administration → User Management. The pages are Dashboard (counts and anything that needs a look), Users, User groups, Policies, Access analysis, and Labor (the names you pick in Sale Transit).

Job functions

Every user has a job function. It decides who may change whom, and each one comes with a ready-made policy of the same name, kept up to date for you.

Create a user

1. 1

   Open Users

   Go to Administration → User Management → Users and choose Create user.

2. 2

   Enter their details

   Name, mobile number (they sign in with it), an optional email, a starting password, and their job function.

3. 3

   Choose how they get permissions

   Add to groups (recommended), Copy permissions from someone who does the same work, Attach policies directly, or simply keep the job function's defaults.

4. 4

   Review and create

   The person can sign in straight away. If their permissions could not be saved, their page says so and they start with the job function's defaults until you try again. Until they sign in for the first time, you can still correct their details and set their password (see Who can change a person's details below).

Accounts you look after yourself

A master can keep extra sign-ins that they use themselves, such as a second phone number. These are managed accounts. When a master creates a user, Who looks after this account? offers The person themselves (the usual choice) or Me — I will manage it.

• A managed account is always a new account, and its phone number must be yours. Choose Send code, type the code that arrives on that phone, and choose Verify. If the number or email already belongs to an account, it can't be used for a new managed account.
• A managed account can never be a master or own an organisation, so the Master (full access, permanent) job function is not offered for it.
• You look after its name, phone, email, address and password. Its page shows Managed by you beside Account.
• To bring one of your managed accounts into another organisation where you are a master, open Users there and choose Add my managed account. Pick the account and its Job function in this organisation, then choose Add to this organisation. No other organisation can add it.
• The code is sent by text message. If text messages can't be sent at the moment, the number can't be checked, and the account can't be created until they can.

Give someone one page only

For example, to let a staff member use Masters › Item › Stock Input and nothing else in Items:

1. 1

   Create a policy

   Go to Policies → Create policy and name it, for example *Stock input only*.

2. 2

   Find the page

   Under Pages and actions (Pages on a phone), search for *Stock Input* and choose it — its actions appear beside the list (on a phone they open full screen). Beside Edit, choose Allow. View is allowed with it, because an action on a page you cannot open is no use.

3. 3

   Save and attach

   Create the policy, then attach it to the person (their Permissions tab → Add permissions) or to a group they are in.

Give a whole section or group — including future pages

Choose a section (such as Masters) or a group (such as Masters › Item) in the list, and use Full access, Read only, or Clear at the top of its settings — or set its actions one by one. A setting made there covers every page under it including pages added later, so you never have to come back and tick a new page. A setting made on a single page covers only that page. When some pages under a section or group have settings of their own, they are listed under Pages with their own settings, each one a click away.

Allow, Deny, and not set

• Each action has three choices: Allow, Deny, and Not set. Under it, Right now says what the policy does and what decides it — this setting, a group or section above it, or the policy's own list of permissions.
• Use Deny for exceptions — for example allow the whole Transactions section but deny Delete on Sale.
• A Deny of a broad permission also denies everything narrower that it covers: denying Edit on Modify Item also denies Edit on Item Stock Input. To give everything a job function gives *except* part of it, open that job function's policy under Policies and choose Duplicate to edit. In the copy, choose the page and look at the action you want gone: where it comes from the job function's own list of permissions, its Right now line says so and Turn off there appears under it. That removes it without a Deny, and names anything else it turns off before it does. Then attach your copy in place of the job-function policy.
• The Review tab (with a count beside it) lists anything worth a look before you save. It points out a Deny that would also stop another page working, because that page needs the same permission. It also points out a rule that cannot work as written: a Deny that has no effect because the same policy allows something broader that opens the same actions, or an Allow that has no effect because the same policy denies something broader that covers it. Where that broader permission comes from the policy's own list, it offers Turn off … instead, so the Allow is kept. The same list is shown on the policy's own page. Deny always wins.
• The Other permissions tab (Other on a phone) holds rights that are not a page of their own, such as approving vouchers or sending broadcasts.
• If a policy also covers pages that are hidden for your organisation (such as reports you do not use), they are listed on the Other permissions tab under Pages not shown here. They still apply, and you can remove them there.
• Simulate, at the bottom of the editor, shows what the policy would allow on its own, before you save it.

Customise layout

Every page has a Customise layout action, next to View. Where a page lets people choose what it shows — the Fields button on Masters › Item › Item Stock Input, and the Layout button on vouchers — only people allowed Customise layout on that page see that button, and they can change what the page shows for themselves. Everyone else sees the page laid out the way the organisation has chosen as its default.

Save as the default for everyone changes that organisation default, so it also needs Setup · Master Forms · Manage on the Other permissions tab.

Choose which item fields a page shows

On an item page, open Fields on this page under its actions. Field rules go with the page's own View or Edit, so set those on the page first. Each group of fields, and each field inside it, can be Editable, Read-only or Hidden, and Set every field: sets them all at once. Only the fields set to Editable can be changed through the page, and Editable needs the page's Add or Edit to be allowed.

• On Add Item, Modify Item and Item Stock Input, a Hidden field is not shown, and a Read-only field can be seen but not changed. The item box that F2 opens on a voucher and the Item panel in Quick Actions do the same for your own custom fields, both when adding an item and when changing one; their other fields show as normal. On any other page the section says so: the page shows every field it normally shows, and Hidden stops those fields being given through that page.
• Item Name, Alias, Unit and Item Group stay visible whenever any other field is, so each item can be told apart.
• Choosing Read-only or Editable for Purchase price also lets the person see purchase prices wherever they see items. Set every field: leaves it as it is.
• Stock amounts (the value of the opening and current stock) work the same way: choosing Read-only or Editable for a stock amount, or for the Opening stock or Current stock group, also lets the person see stock values wherever they see items, and Set every field: leaves them as they are. A custom policy that grants item pages shows stock amounts only if it also allows them in Fields on this page, like purchase cost. Someone who cannot see stock values is not shown them in item lists or the item analysis, and the item aging report, which shows each item's stock value, is not available to them.
• Whatever a page shows, a change to a field the person may not change is refused wherever items are changed, including imports and the prices a purchase updates. In the list you pick items from, the prices shown with each item leave out any the person may not see.
• Never allow (every item page), at the foot of the section, sets a field to Never change or Never see on every item page and for every way items are changed. No Allow, in this policy or another, can undo it.

See what someone can do

Each user's Effective access tab lists every page. Choose one to see each action: Allowed — by the policy that decides it, Denied — by the policy that denies it, or Not allowed. On a phone, a person's page has a Show list at the top instead of tabs — pick Effective access there. Access analysis answers the other question: pick a page and see everyone who can open it and what they can do there.

A change to someone's permissions reaches them within about 30 seconds while Kaalchakra is open on their screen, or as soon as they come back to it — without signing them out.

Invite someone who already uses Kaalchakra

People can belong to more than one organisation with a single sign-in. To bring in someone who already has a Kaalchakra account — for example they run or work in another organisation — a master sends them an invitation. They join only if they accept.

1. 1

   Open Invitations

   In Administration → User Management → Users, open the Invitations tab and choose Invite someone (only masters see this button).

2. 2

   Enter their phone or email and job function

   Enter the phone number or email they signed up with and choose the job function they should have in your organisation. You get the same answer whether or not that number or email has an account, so an invitation never tells you who uses Kaalchakra.

3. 3

   They accept

   They see the invitation in Profile settings (the menu under their picture), under Organisations, and choose Accept or Decline. Once they accept, your organisation appears in their organisation switcher. Give them groups or policies afterwards like anyone else.

Who can change a person's details

Once someone has signed in, only they can change their name, phone, email, address, and password — from Profile settings in the menu under their picture in the top-right corner. You can still change their job function, data tags, groups, permissions, and status. Before their first sign-in, someone who outranks them can correct their details and set their password. Each person's page shows which applies, beside Account: Manages own account or Not signed in yet — or Managed by you for an account you look after yourself, whose details only you change (see Accounts you look after yourself above). Someone who forgets their password chooses Forgot password on the sign-in page.

Blocking and removing

From a user's page you can block someone — an immediate stop in this organisation that you can undo with Unblock. A master can also remove someone from the organisation, from their page or from Users (select them, then Actions). A removed person can no longer sign in to this organisation, but their Kaalchakra account is not deleted: they keep their sign-in and any other organisations they belong to. They stay in the list as Removed, so the documents they created keep their name. To bring back someone you removed, send them an invitation. A master cannot be removed.

Saving a change to someone's profile does not sign them out — they stay signed in on their devices. Setting a new password for someone does sign them out everywhere, on every device they are using, and they sign in again with the new password.

Seeing who uses Kaalchakra

Organisation → Usage shows who in your organisation is on Kaalchakra right now, which of your people have used it in the last 7, 30 or 90 days, when each person was last seen, which areas they use (transactions, reports, masters and so on) and whether they open it as the installed app or in a browser. It is for the people who manage your team, so it needs a policy that allows View on Organisation › Usage.

• It shows online times and pages only — never what anyone typed into a form or searched for.
• Online means a Kaalchakra tab was open and visible on that person's device within the last 5 minutes. A tab left in the background, or closed, shows as offline within 5 minutes. If the status cannot be read it is shown as unknown, never as offline.
• Active means the person used Kaalchakra inside the window you chose — opened a page or had it open on screen. Dormant means they did not, and the date shown is the last time they were seen.
• History for a person shows, day by day, when they were online and for how long, which hours of the day they use Kaalchakra most (Indian Standard Time), and the pages they opened in order. History is kept for 90 days.
• "Pages opened" counts the distinct pages a person opened in the window. Opening the same page again in the same sitting is not counted twice.
• Only your own organisation is ever shown.