Permissions and Role Management

Overview

This documentation explains how Piyovi controls access to pages, data, settings, and actions. It is written for company administrators who create roles, assign roles to users, review access, or troubleshoot missing and unexpected access.

Use this document to:

• Understand the difference between permissions, roles, users, and the Super User setting.
• Create job-based roles that give users only the access they need.
• Assign and remove roles without accidentally leaving access through another role.
• Understand why a user may see a page but not its buttons, or may have a permission but not see the related feature.
• Look up the purpose of every production permission in the full permission reference.

Who should manage permissions? Only trusted company administrators should manage roles and user access. The ability to edit roles can be used to grant any available permission, including high-risk administrative permissions.

How Piyovi Access Works

Piyovi uses role-based access control. A permission is not normally assigned directly to a user. Permissions are collected into roles, and one or more roles are assigned to the user.

1. Permission	2. Role	3. User	4. Effective access
A named capability, such as viewing carriers or shipping an order.	A job-based collection of permissions, such as Shipper, Admin.	A person who can hold one or more roles.	Every permission granted by any assigned role.

Permission types

Type	What it means	Typical example
Manage	Broad control over a module or record type. Usually includes creating, editing, deleting, and viewing.	Manage Company
Read-Only	Allows a user to open and review a page or record without changing it.	Address Book - Readonly
Action	Allows one specific operation. Action permissions are often added to a base Manage or Read-Only permission.	Ability to Ship, Ability to Update Shipment
View	Allows a user to see a specific item or sensitive field, such as freight cost or comments.	Ability to View Discounted Cost

Rules that determine access

Rule	What administrators need to know
Roles are additive	When a user has multiple roles, Piyovi combines them. A second role cannot deny access granted by the first role.
Any matching permission may be enough	A page or action may allow access when the user has any one of several accepted permissions.
Manage Company is broad	This permission is checked as a company-wide fallback in many areas and can grant much more access than its name suggests.

How to Manage Roles and User Access

In most configurations, role and user administration is available from the Settings or Users & Roles area.

Required administrator access

Permission	Purpose
Manage Role	Create and edit roles, including the permissions included in each role.
Manage User	Create, edit, activate, or deactivate company users and assign roles.

Create a role

1. Open User Roles : From the company administration area, open User Roles. Confirm that you are working in the correct company.
2. Select Add Role : Create a clear, job-based role name such as Shipping Clerk, Invoice Auditor, or Carrier Administrator.
3. Add a description: Describe the job purpose, intended users, and any limits, such as no cost visibility or no approval access.
4. Select permissions: Start with the module access permission, then add only the actions and sensitive views required for the job
5. Save and test: Save the role and test it with a non-administrator user before assigning it broadly.

Assign a role to a user

1. Open Users: Open the company user list and select the user who needs access.
2. Review current roles: Check every role already assigned to the user. Remember that access from all roles is combined.
3. Assign the role: Select the required role or roles and save the user.
4. Validate access: Confirm the user can open the required pages and complete the required actions, while restricted data and actions remain hidden.

Change or remove access

• To update multiple users at once, edit the shared role. Every user assigned to that role receives the change.
• To change access for one user only, assign a different role or create a separate job-based role. Avoid creating a personal role unless there is a genuine business need.
• To remove access, remove the permission from every assigned role that contains it, or remove the role from the user.

Why access may remain after a permission is removed? The same permission may still be granted by another assigned role, by Manage Company, or by the Super User setting. Review the user's complete access, not only the role you changed.

Permission Reference

This reference lists every production permission from the permission inventory. Permission names are retained exactly so administrators can match this docyument to the Piyovi role editor.

Carrier Management

Carrier availability, company carrier configuration, accounts, services, rates, and rate-shopping controls.

Permission name	Type	What it allows
Manage Carrier	Manage	Full control over which carriers a company uses.
Carrier - Readonly	Read Only	View-only access to a company's carrier configuration.
Manage Rate Shop	Manage	Full control over rate-shopping configuration (automatically comparing carrier rates).
Manage Rate Shop Rule	Manage	Full control over rate shop rule configuration.
Rate Shop Rules - Readonly	Read Only	View-only access to rate shop rule configuration.

Company Setup and Administration

Company-wide settings, profiles, security configuration, domains, navigation, metadata, and audit access.

Permission name	Type	What it allows
Manage Company	Manage	Frequently checked alongside a more specific permission as an either/or fallback — effectively a company-wide master key for all actions.
Manage Piyovi	Manage	Manage to Piyovi login (default).
User Profile	Manage	Manage the user's own Piyovi profile settings (default).
Company Preference	Manage	Manage general company-wide preference settings.
Manage Api key	Manage	Full control over API keys used for external system access.
Manage Company Migration	Manage	Full control over data migration tools.
Manage Custom Attribute	Manage	Full control over custom fields/attributes added to entities.
Manage SSO	Manage	Full control over Single Sign-On configuration (Security) for the company.
Manage Company Lookup	Manage	Full control over lookup/reference data tables used across the company.
Company Lookup - Readonly	Read Only	View-only access to lookup/reference data.
Manage NMFC	Manage	Full control over NMFC freight classification codes (Shipping & Compliance).
NMFC - Readonly	Read Only	View-only access to NMFC freight classification codes (Shipping & Compliance).
Manage Navi	Manage	Full control over NAVI Agent.
Manage metadata	Manage	Full control over custom company metadata fields.
Manage metadata - Readonly	Read Only	View-only access to company metadata fields.
Manage Activity	Manage	View/manage the company-level activity log.
View Shipment Audit Logs	View	View-only access to the activity log.

Locations and Addresses

Warehouses, facilities, saved addresses, and address validation configuration.

Permission name	Type	What it allows
Manage Location	Manage	Full control over the company's shipping locations (Organization).
Location - Readonly	Read Only	View-only access to company locations (Organization).
Manage Address Book>	Manage	Full control over saved ship-to addresses (Shipping & Compliance).
Address Book - Readonly	Read Only	View-only access to the address book (Shipping & Compliance).
Manage Address Validation	Manage	Full control over address validation configuration (Shipping & Compliance).
Address Validation - Readonly	Read Only	View-only access to address validation settings (Shipping & Compliance).

Products and Packages

Package definitions, products, and SSCC label configuration.

**Permission name **	Type	What it allows
Manage Package	Manage	Full control over package/box definitions (Shipping & Compliance).
Package - Readonly	Read Only	View-only access to package definitions (Shipping & Compliance).
Manage Product	Manage	Full control over the product catalog used when creating shipments (Shipping & Compliance).
Product - Readonly	Read Only	View-only access to the product catalog (Shipping & Compliance).
Manage SSCC Configuration	Manage	Manage SSCC label configuration (Shipping & Compliance).

Users and Roles

Company users, role definitions, user preferences, password reset, exports, and shipment field access.

**Permission name **	Type	What it allows
Manage User	Manage	Full control over company user accounts — create, edit, deactivate users (Organization).
Users - Readonly	Read Only	View-only access to the user list (Organization).
Manage User Preference	Manage	Manage individual user preference settings.
User Shipment Preference	Manage	Manage a user's default shipment preferences.
User Shipment Preference - Readonly	Read Only	View-only access to a user's shipment preferences.
User AESDirect Preference	Manage	Manage a user's AESDirect (export filing) preferences.
User AESDirect Preference - Readonly	Read Only	View-only access to a user's AESDirect preferences.
Manage Role	Manage	Full control over creating/editing user roles and what permissions each role contains.
Roles - Readonly	Read Only	View-only access to role definitions.
Manage Shipment Field Access Control	Manage	Full control over field-level access rules on the shipment form — i.e. which fields a given role can see or edit.
User Reset Password	Action	Permission to reset another user's password.
Ability to Export User	Action	Permission to export the user list (e.g. to Excel/CSV).

Shipment Operations

Shipment creation, packing, shipping, updating, cancellation, documents, manifests, consolidation, and spot quotes.

Permission name	Type	What it allows
Manage Shipment	Manage	The core "full control over shipments" permission — create, edit, delete shipment records(Ship, Rate Shop and Shipments).
Shipment - Readonly	Read Only	View-only access to shipment records — the read-only counterpart to Manage Shipment.
View Shipments	View	View-only access to shipment records/details.
Ability to Pack	Action	Permission to perform the "pack" step of a shipment — assigning items to boxes/packages.
Ability to Ship	Action	Permission to actually execute a shipment with a carrier — the core "ship" action.
Ship - Readonly	View	A special view-only mode for the Ship screen — lets a user see the shipping workflow without being able to actually ship.
Ability to Cancel Shipment	Action	Permission to cancel a shipment.
Ability to Update Shipment	Action	Permission to edit/update an existing shipment's details.
Ability to Validate Shipment	Action	Permission to run shipment data validation (Validate icon in ship screen).
Ability to Copy Shipment	Action	Permission to duplicate an existing shipment.
Ability to Archive Shipment	Action	Permission to archive completed/old shipments.
Tms Inbound Ship	Action	Permission to create inbound (receiving) shipments.
Ability to Add Shipment Comment	Action	Permission to add a comment to a shipment.
Ability to View Shipment Comment	View	View-only access to shipment comments.
Shipment Upload Document	Action	Permission to upload documents (BOLs, customs forms, etc.) to a shipment from Shipments screen (Upload document icon visible under the action).
Ability to Export Shipment	Action	Permission to export shipment data (e.g. to Excel/CSV) ( Visibility of Excel export icons and Master export icon in Shipments screen).
Ability to Compare Options	Action	Permission to compare shipping rate/carrier options before booking.
Manage Batch Shipment	Manage	Full control over batch shipment creation workflows.
Batch Shipment - Readonly	Read Only	View-only access to batch shipments.
Manage Shipment Confirm	Manage	Full control over the shipment confirmation workflow.
Shipment Confirm - Readonly	Read Only	View-only access to shipment confirmation records.
Company Label Preference	Manage	Manage shipping label format preferences.
Enforce Business Rule	Action	Permission tied to enforcement of business rules before shipping.
Manage Manifest	Manage	Full control over manifest Shipments.
Shipment Manifest - Readonly	Read Only	View-only access to manifest shipments.
Manage Consolidation	Manage	Manage control access to the consolidate button (Ship screen).
Consolidation Rules - Readonly	Read Only	View-only access to the consolidation rule page ( Shipping & Compliance).
Manage Consolidation Rule	Manage	Full control over Consolidation Rule page access ( Shipping & Compliance).
Manage Shipment Consolidation	Manage	Full control over consolidated shipments report.
Shipment Consolidation - Readonly	Read Only	View-only access to consolidated shipments report.
Shipment Pickup - Readonly	Read Only	View-only access to carrier pickup requests.
Manage Shipment Spot Quote	Manage	Full control over spot quote requests.
Shipment Spot Quote - Readonly	Read Only	View-only access to spot quote requests.

Cost and Financial Visibility

Separate permissions for freight cost, discounts, published cost, billing, and freight markup rules.

Permission name	Type	What it allows
Ability to View Published Cost	View	Permission to see the "published" cost of a shipment.
Ability View Shipment Billing Details	View	Permission to see billing details tied to a shipment.
Ability to View Discounted Cost	View	Permission to see discounted cost applied of a shipment.
Ability to View Marked Up Cost	View	Permission to see marked up cost.
Manage Shipment Freight Cost	Manage	Full control over freight cost data on shipments.
Shipment Freight Cost - Readonly	Read Only	View-only access to shipment freight cost.
Manage Freight Markup Rule	Manage	Full control over freight markup rules — how cost is marked up for billing.
Freight Rules - Readonly	Read Only	View-only access to freight markup rules.

Returns

Return shipment configuration, processing, saving, and read-only access.

Permission name	Type	What it allows
Manage Return Shipment	Manage	Full control over return shipment configuration.
Ability to Return Ship	Action	Permission to create/process a return shipment.
Ability to Save Return Shipment	Action	Permission to save a draft/in-progress return shipment.
Return Shipment - Readonly	Read Only	View-only access to return shipment configuration.

Rules Engine and Rate Structure

Business rules, rate/pricing structures, and their read-only counterparts.

Permission name	Type	What it allows
Manage Rule	Manage	Full control over the business rules engine.
Rules - Readonly	Read Only	View-only access to business rules.
Manage RPS	Manage	Full control over restricted party screening.
RP Screening- Readonly	Read Only	View-only access to restricted party screening.
Manage Rate Structure	Manage	Full control over rate structures.
Rate Structure - Readonly	Read Only	View-only access to rate structures.

Export Compliance and AES

AESDirect and export filing configuration, submission, and view access.

Permission name	Type	What it allows
Manage AESDirect	Manage	Full control over AESDirect filing configuration for export compliance(Export).
AES Direct - Readonly	Read Only	View-only access to AESDirect export filing configuration(Export).
Manage Export Filings	Manage	Full control over export filing records/configuration.
Export Filing - Readonly	Read Only	View-only access to export filing records.
File Export	Action	Permission to file/submit compliance export documents.

Documents

Document templates, document rules, and custom shipment documents.

Permission name	Type	What it allows
Manage Documents	Manage	Full control over shipment document (labels, BOLs, etc.) configurations .
Manage Documents - Readonly	Read Only	View-only access to document configurations.
Manage Document Rule	Manage	Full control over rules governing which documents rules.
Document Rules - Readonly	Read Only	View-only access to document rules.
Manage Custom Document	Action	Permission to access custom document configuration of a shipment.

Data Import and Export

Company data import and export configuration and jobs.

Permission name	Type	What it allows
Manage Export	Manage	Full control over shipment data export configuration/jobs.
Manage Import	Manage	Full control over data shipment import configuration/jobs.

Integrations and Connectors

External integrations, webhooks, devices, connectors, file exchange, and storage channels.

Permission name	Type	What it allows
Manage Integration	Manage	Full control over integrations configuration.
Integration - Readonly	Read Only	View-only access to integration configuration.
Manage Webhook	Manage	Full control over outbound webhook configurations.
Webhook - Readonly	Read Only	View-only access to webhook configuration.
Manage Connector	Manage	Full control over external system connector configuration.
Manage File Exchange	Manage	Full control over file exchange configuration.
File Exchange - Readonly	Read Only	View-only access to file exchange configuration.
Manage Storage Channel	Manage	Full control over storage channel configuration (File exchange).
Storage Channel - Readonly	Read Only	View-only access to storage channel configuration (File exchange).

Invoicing and Invoice Audit

Invoice audit, reports, approvals, rejection, posting, archiving, comments, rules, and widgets.

Permission name	Type	What it allows
Manage invoice Audit	Manage	Full control over invoice audit Configuration (Shipping & Compliance).
Invoice Audit - Readonly	ReadOnly	View-only access to invoice audit records.
Manage Invoice Reports	Manage	Full control over invoice reports (to get this page need to combine the Manage report permission).
Invoice Reports - Readonly	Read Only	View-only access to invoice reports.
Ability to Export Invoice Report	Action	Permission to export invoice reports.
Ability to approve an Invoice	Action	Permission to approve an invoice.
Ability to reject an Invoice	Action	Permission to reject an invoice.
Ability to post an Invoice	Action	Permission to post an invoice into the accounting record.
Ability to Archive Invoices	Action	Permission to archive invoices.
Ability to View Invoice Comment	View	View-only access to invoice comments.
Ability to Add Invoice Comment	Action	Permission to add a comment to an invoice.
Manage Invoice Rule	Manage	Full control over invoice rules.
Invoice Rules - Readonly	Read Only	View-only access to invoice rules.
Manage Invoice Widgets	Manage	Full control over invoice-related dashboard widgets.

Reports and Dashboards

Reports, dashboards, widgets, report sharing, and scheduled report administration.

Permission name	Type	What it allows
Manage Report	Manage	Full control over tracking shipments reports.
Manage Operational Report	Manage	Full control over operational metrics reports.
Ability to Share Reports	Manage	Full control over reports shared across users.
Manage Shipment Insights Report	Manage	Full control over shipment analytics/insights reports.
Manage Dashboard	Manage	Full control over dashboard configuration.
Ability to Share Dashboard	Action	Permission to share a dashboard with other users.
Manage Shipment Widgets	Manage	Full control over shipment-related dashboard widgets.
Manage Operational Widgets	Manage	Full control over operational metrics dashboard widgets.
Manage Report Scheduler	Manage	Full control over scheduled report configuration.
Report Scheduler - Readonly	Read Only	View-only access to scheduled reports.
Manage Report Scheduler Log	Manage	View/manage the execution log of scheduled reports.
Report Scheduler - Invoice	Action	Permission tied to scheduling invoice reports specifically.
Report Scheduler - Shipment	Action	Permission tied to scheduling shipment reports specifically.

Notifications

Notifications, recipients, channels, channel users, and notification templates.

Permission name	Type	What it allows
Manage Notification	Manage	Full control over notifications themselves.
Notification - Readonly	Read Only	View-only access to notifications.
Manage User Notification	Manage	Manage which users receive notifications.
Manage Notification Channel	Manage	Full control over notification channels (email, SMS, Teams, etc.).
Notification Channel - Readonly	Read Only	View-only access to notification channels.
Manage User Notification Channel	Manage	Manage which users are assigned to which notification channel.
Manage Notification Template	Manage	Full control over notification message templates.
Notification Template - Readonly	Read Only	View-only access to notification templates.

Launchpad

Launchpad module management and read-only access.

Permission name	Type	What it allows
Manage Launchpad	Manage	Full control over the Launchpad feature module.
Manage Launchpad - Readonly	Read Only	View-only access to the Launchpad module.
Manage Domain	Manage	Full control over domain configuration.
Manage Domain - Readonly	Read Only	View-only access to domain configuration.
Manage Page	Manage	Full control over custom company pages (e.g. a tracking page).
Manage Page - Readonly	Read Only	View-only access to custom company pages.

How to Choose the Right Permissions

Permissions that need extra care

Permission or area	Risk and guidance
Manage Company	Acts as a broad company-wide fallback in many screens. Prefer specific permissions when practical.
Manage Role	Allows a user to create roles containing any permission and assign those roles. Treat as permission-granting authority.
Manage Api key / SSO / Integration / Webhook / FileExchange	Can expose or change system-to-system connectivity. Limit to integration or security administrators.
Carrier account and rate permissions	May expose carrier credentials, account numbers, negotiated rates, and pricing logic.
Cost and billing view permissions	May expose freight cost, discounts, published cost, markup, and billing information.

Manage versus Read-Only : Normally choose one permission from the pair based on whether the user should edit. Because some workflows use separate checks, test every business-critical page and action before publishing the role.

Recommended Role Templates

These templates are starting points. Adjust them for your company workflow, licensed features, locations, and separation-of-duties requirements. Test each role before production use.

Shipping Clerk

For warehouse or shipping users who create, pack, validate, and ship orders but should not manage billing or company settings.

Access group	Recommended permissions
Core	Manage Shipment; Ability to Pack; Ability to Ship; Ability to Update Shipment; Ability to Validate Shipment; Ability to Add Shipment Comment; Ability to View Shipment Comment
Optional	Ability to Copy Shipment; Shipment Upload Document; Ability to Compare Options; Ability to Export Shipment; Tms Inbound Ship
Usually exclude	Ability to View Marked Up Cost; Ability to View Discounted Cost; Ability to View Published Cost; Ability View Shipment Billing Details; invoice approval/posting permissions; company administration permissions

Note : Grant Ability to Cancel Shipment or Ability to Archive Shipment only when the clerk is expected to perform those actions.

Shipping Supervisor

For team leads who oversee the complete shipment lifecycle, exceptions, manifests, and operational corrections.

Access group	Recommended permissions
Core	Manage Shipment; Ability to Pack; Ability to Ship; Ability to Update Shipment; Ability to Validate Shipment; Ability to Cancel Shipment; Ability to Copy Shipment; Ability to Archive Shipment; Shipment Upload Document; Ability to Export Shipment; Ability to Compare Options; Manage Manifest
Optional	Ability to View Marked Up Cost; Ability to View Discounted Cost; Ability to View Published Cost; Manage Batch Shipment; Manage Shipment Confirm; spot quote or consolidation permissions
Usually exclude	Users, roles, API keys, SSO, invoice posting, or integration administration unless the supervisor also owns those responsibilities

Note : Cost permissions should be approved separately from shipment operational access.

Billing / Invoice Administrator

For users who review freight invoices, compare costs, approve or reject invoices, and manage invoice reports.

Access group	Recommended permissions
Core	Manage invoice Audit; Manage Invoice Reports; Ability to approve an Invoice; Ability to reject an Invoice; Ability to post an Invoice; Ability to View Invoice Comment; Ability to Add Invoice Comment; Ability to View Marked Up Cost; Ability to View Discounted Cost; Ability View Shipment Billing Details
Optional	Ability to Archive Invoices; Ability to Export Invoice Report; Manage Invoice Rule; Manage Invoice Widgets
Usually exclude	Ability to Ship; Ability to Cancel Shipment; carrier credential management; company role administration

Note: Consider separating invoice review from invoice posting when your company requires approval separation.

Read-Only Auditor

For internal or external reviewers who need evidence and visibility but must not change records or execute actions.

Access group	Recommended permissions
Core	The relevant *ReadOnly permissions for shipments, carriers, users, rules, reports, integrations, and invoices; View Shipments; View Rule; View Shipment Audit Logs; required comment view permissions
Optional	Cost and billing view permissions only when included in the approved audit scope
Usually exclude	All Manage permissions; all Action permissions such as Ship, Cancel, Approve, Reject, Post, Export, or Reset Password

Note: Read-only access is module-specific. Include only the modules required by the audit scope.

Carrier and Rate Administrator

For transportation administrators who configure carriers, service levels, accounts, rates, and rate-shopping rules.

Access group	Recommended permissions
Core	Manage Carrier; Manage Carrier Service Level; Manage Carrier Account; Manage Carrier Special Service; Manage Carrier Rates; Manage Rate Shop; Manage Rate Shop Rule
Optional	Manage Freight Markup Rule; Manage Rate Structure; Manage RPS; carrier charge management for approved platform administrators
Usually exclude	User-role administration, invoice posting, SSO, API keys, and unrelated company settings

Note: Carrier account permissions may expose credentials and negotiated pricing. Limit this role to trusted transportation administrators.

Integration Administrator

For technical users who configure external systems, webhooks, file exchange, connectors, storage channels, and connected devices.

Access group	Recommended permissions
Core	Manage Integration; Manage Webhook; Manage Connector; Manage File Exchange; Manage Storage Channel
Optional	Manage Api key; Manage Worstation; Manage SSO
Usually exclude	Shipment cancellation, invoice approval/posting, user-role administration, or cost visibility unless required for support

Note: Review this role whenever an integration is retired or ownership changes. Credentials and API access should follow company security procedures.

Company Administrator

For a small number of trusted users responsible for company setup, users, roles, carriers, and company preferences.

Access group	Recommended permissions
Core	Manage User; Manage Role; Company Preference; required company setup permissions
Optional	Manage Company; Manage Api key; Manage SSO; Manage Navi; Manage Activity
Usually exclude	Super User unless platform-wide unrestricted access is explicitly required and approved

Note: Prefer specific administration permissions. Add Manage Company only after confirming that the broader access is intended.

Troubleshooting Access Issues

Symptom	What to check
The user cannot see a page or menu item	Confirm the user has the module's Manage, Read-Only, or accepted View permission. Also verify that the company feature is enabled and the menu is available in the company navigation.
The user sees the page but cannot edit	The user probably has Read-Only or View access but not the matching Manage or action permission.
The user can edit but cannot complete a specific action	Add the specific action permission, such as Ability to Ship, Ability to Cancel Shipment, Ability to approve an Invoice, or Ability to post an Invoice.
The user cannot see cost or billing information	Review Ability to View Marked Up Cost, Ability to View Discounted Cost, Ability to View Published Cost, Ability View Shipment Billing Details, and related freight-cost permissions.
The user has more access than expected	Review every assigned role, Manage Company, and the Super User setting. Access is additive and cannot be denied by another role.
Access remains after removing a permission	The same permission may exist in another role, or access may be granted by a broader permission or Super User.
The user has a permission but the feature is not visible	The company may not have the related feature enabled, or the company navigation may not expose the module.
A role change affected many users	Roles are shared. Editing a role changes access for every user assigned to it. Review the role's user list before changing it.