# Access by section

The full grid of what each role reaches. **Legend:** 👁 read-only · ✏️ read and write · — no access.

All access shown here is then filtered by the employee's scope — see [Scope: what data an employee can see](/books/console-yF7/page/scope-what-data-an-employee-can-see).

| Section | admin | hub_manager | hub_operator | dispatcher_manager | branch_manager | report_viewer | polygon_manager | cms_editor | employee_manager | third_party_manager | alarms_config_manager |
|---|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|
| Hub — orders and status | ✏️ | ✏️ | ✏️ basic | — | 👁 | — | — | — | — | — | — |
| Hub — force delivery / cancel | ✏️ | ✏️ | — | — | — | — | — | — | — | — | — |
| Hub — modify ETA | ✏️ | ✏️ | — | — | ✏️ | — | — | — | — | — | — |
| Branch alarms | ✏️ | ✏️ | 👁 | — | 👁 | — | — | — | — | — | — |
| Driver alerts | ✏️ | 👁 | 👁 | — | 👁 | — | — | — | — | — | — |
| Alarm threshold config | ✏️ | — | — | — | — | — | — | — | — | — | ✏️ |
| Archived alarms | ✏️ | 👁 | — | — | — | — | — | — | — | — | — |
| Dispatcher | ✏️ | — | — | ✏️ | — | — | — | — | — | — | — |
| Scheduler | ✏️ | — | — | ✏️ | — | — | — | — | — | — | — |
| Store config | ✏️ | ✏️ | 👁 | ✏️ | ✏️ | 👁 | 👁 | — | — | — | — |
| Pause / resume delivery | ✏️ | ✏️ | — | ✏️ | ✏️ | — | — | — | — | — | — |
| Third-party — brand config | ✏️ | — | — | ✏️ | — | — | — | — | — | ✏️ | — |
| Third-party — store config | ✏️ | — | — | ✏️ | — | — | — | — | — | — | — |
| Delivery zones | ✏️ | — | — | ✏️ | — | — | ✏️ | — | — | — | — |
| Metrics | ✏️ | 👁 | 👁 | 👁 | — | 👁 | — | — | — | — | — |
| Sales reports | ✏️ | — | — | — | — | 👁 | — | — | — | — | — |
| Employees and own drivers | ✏️ | — | — | — | — | — | — | — | ✏️ | — | — |
| CMS — complaints and resources | ✏️ | — | — | — | — | — | — | ✏️ | — | — | — |
| Chatbot config ¹ | ✏️ | — | — | — | — | — | — | — | — | — | — |
| External API management ¹ | ✏️ | — | — | — | — | — | — | — | — | — | — |
| Voice agent ¹ | ✏️ | — | — | — | — | — | — | — | — | — | — |
| Promotional codes ¹ | ✏️ | — | — | — | — | — | — | — | — | — | — |
| Voucher codes ¹ | ✏️ | — | — | — | — | — | — | — | — | — | — |
| Role and assignment management | ✏️ | — | — | — | — | — | — | — | ✏️ | — | — |

¹ **Recently added modules**, currently reachable by `admin` only. See [The role catalogue](/books/console-yF7/page/the-role-catalogue).

## Notes on reading this table

- `super_admin` has ✏️ on every row and is omitted to keep the table readable.
- `branch_viewer` is a read-only support role covering store configuration only; it is omitted for the same reason. Combine it with another role rather than using it alone.
- "✏️ basic" for `hub_operator` means the everyday hub actions, but **not** the critical ones — force delivery, cancel and modify ETA are excluded.
- **Role and assignment management** splits in two: `employee_manager` can assign existing roles, set scope and manage exceptions, but cannot create or edit role definitions. See [Managing roles from the console](/books/console-yF7/page/managing-roles-from-the-console).

## If a role is nearly right

Don't look for a role that matches a person exactly. Either combine two roles ([Common role combinations](/books/console-yF7/page/common-role-combinations)), or keep the closest role and add a single exception ([Individual permission exceptions](/books/console-yF7/page/individual-permission-exceptions)).