---
title: "Access management in Sapera (overview)"
description: "What permissions are, where to find them, how they are scoped, and links to one sub-article per area."
url: https://support.sapera.io/en/articles/549-access-management-in-sapera-overview
collection: "Permissions"
updated: 2026-06-26
language: en
alternates: [da]
---

# Access management in Sapera (overview)

What permissions are, where to find them, how they are scoped, and links to one sub-article per area.

Access management decides **what each employee may see and do** in Sapera. Instead of granting rights to every single user, Sapera works with **groups** (roles): you give the group a set of permissions, and all users in the group inherit them.

## The three building blocks

-   **Users** — the individual employee's login.
    
-   **Groups** — a collection of users that should have the same rights (e.g. "Cashiers", "Bookkeepers", "Store managers").
    
-   **Permissions** — the concrete rights that can be assigned, e.g. whether you may create users or view financial entries.
    

Each permission can be in one of three states:

-   **Allow** — the right is granted.
    
-   **Deny** — the right is explicitly withdrawn (wins over an inherited "Allow").
    
-   (empty) — not set; the user does not have the right unless it is inherited from somewhere else.
    

## How to find access management

You administer users and rights from **Financial**:

Financial → **Security** → **Users** / **Groups** / **Login security**

-   **Users** — create, edit, disable and reset employees' logins.
    
-   **Groups** — create roles and assign permissions in one place.
    
-   **Login security** — IP blocking and login monitoring.
    

> Note: To see the **Security** menu item, your own user must have access to it. If you cannot see the menu item, you probably lack permissions — contact support.

## How permissions are scoped

Permissions work at three levels — it is important to know the difference:

1.  **Per organizational unit** — most user and membership rights apply only in the organizational unit (store/department) where they are granted. An employee may therefore have the right to create users in one store but not in another.
    
2.  **Globally** — a few rights (e.g. IP blocking) apply across the entire installation.
    
3.  **Menu visibility** — some "permissions" only control whether a menu item is visible, not the action itself. They hide/show the entry, while the action behind it is protected by its own right.
    

## Overview of permission areas

The permissions are grouped the way you see them in the permission tree. Some concern users and access in general; others control concrete functions in a specific area (the POS, Accounting, etc.).

**Users and access:**

-   **Users and passwords** — create/edit/disable/delete users, change other users' passwords, 2-factor. → [Open article](https://support.sapera.io/en/articles/550.md)
    
-   **Organizational units** — create, edit and archive stores/departments; access and visibility of financial entries. → [Open article](https://support.sapera.io/en/articles/551.md)
    
-   **Memberships** — who may add/remove members in a group. → [Open article](https://support.sapera.io/en/articles/552.md)
    
-   **Application/service rights** — which apps and integrations a user may access. → [Open article](https://support.sapera.io/en/articles/553.md)
    
-   **Login security (Block IP)** — IP blocking and login monitoring. → [Open article](https://support.sapera.io/en/articles/554.md)
    
-   **UI rights** — minor user-interface settings (keyboard/input method, access to permission setup). → [Open article](https://support.sapera.io/en/articles/555.md)
    
-   **Menu visibility (Security)** — controls which security menu items are shown. → [Open article](https://support.sapera.io/en/articles/556.md)
    

**Rights per area:**

-   **Accounting** — close/open financial periods, post in a closed period, counter-entries; plus visibility of accounting screens. → [Open article](https://support.sapera.io/en/articles/557.md)
    
-   **Inventory** — cost prices, stock entries, merging products, stock transfers; plus visibility of Inventory screens. → [Open article](https://support.sapera.io/en/articles/641.md)
    
-   **Sales, purchasing and invoicing** — sales orders, purchasing, invoices, gift cards, payments; plus screen visibility. → [Open article](https://support.sapera.io/en/articles/642.md)
    
-   **Communication, payments and setup** — SMS/e-mail log, payment integrations (Vipps, Stripe, etc.) and menu layout. → [Open article](https://support.sapera.io/en/articles/643.md)
    
-   **The POS** — what cashiers may do at the POS (custom price, discount, return, customer creation, settlements, payments, etc.). → [Open article](https://support.sapera.io/en/articles/559.md)
    
-   **Actors** — view/edit CPR number, merge actors, and role rights per organizational unit. → [Open article](https://support.sapera.io/en/articles/560.md)
    
-   **Documents and notes** — edit/delete other users' notes on e.g. customers and invoices. → [Open article](https://support.sapera.io/en/articles/561.md)
    
-   **Reports** — access per report tag. → [Open article](https://support.sapera.io/en/articles/562.md)
    
-   **Tasks and calendar** — view other users' time registrations; visibility of task type/status setup. → [Open article](https://support.sapera.io/en/articles/563.md)