Common role combinations
Because an employee can hold several roles and all of them share one scope, most real profiles are built by combining two or three roles rather than looking for a perfect single match.
| Real profile | Roles | Scope |
|---|---|---|
| Operations manager who also views reports | hub_manager + report_viewer |
Customer, or explicit by store |
| Operations manager who manages alarm thresholds | hub_manager + alarms_config_manager |
Customer, or explicit by store |
| Operations manager who also runs the dispatcher | hub_manager + dispatcher_manager |
Customer, or explicit by store |
| Shift operator who also views reports | hub_operator + report_viewer |
Explicit — their stores |
| Store manager with access to reports | branch_manager + report_viewer |
Explicit — their stores |
| Brand manager who doesn't operate orders | employee_manager + polygon_manager + third_party_manager |
Explicit — brand |
| Delivery zone technician | polygon_manager |
Explicit — brand |
| Management, data only | report_viewer |
Customer |
| Full administrator | admin |
Customer |
Why hub_manager doesn't include the dispatcher
hub_manager deliberately focuses on hub operations. If your operations manager also needs the dispatcher, the scheduler or third-party carriers, assign hub_manager + dispatcher_manager.
Each role keeps its own area of responsibility, and the permissions combine automatically. This is preferred over widening hub_manager, because it keeps the two responsibilities visible and separately removable.
Rules of thumb
Combine roles, don't request new ones. Most needs are a combination that already exists. A new role definition requires a request to the development team — see Requesting a new or changed role.
Roles only ever add. Assigning a second role never reduces what the first one granted, and never widens what data is visible. Only scope controls that.
Use exceptions for the one-off case. If a profile matches an existing role except for a single ability, keep the role and add an individual grant or deny — see Individual permission exceptions.