Users and access
Every module uses these accounts. Nothing in Sentrello keeps a separate list of logins — connect a new module and your existing colleagues can use it immediately, with the access they already have.
People
Settings → Users lists everybody with access. Invite somebody by email; they set their own password from the link. Nobody types a password for somebody else.
An invitation that is never accepted expires. A person who leaves is removed here, and loses access to every module at once — which is the argument for one list rather than five.
Policies
What somebody can do is decided by the policies attached to them. A policy grants specific permissions on specific modules: read invoices, create contacts, update settings.
Five are set up for you and cover most businesses:
| Policy | Roughly |
|---|---|
| Administrators | Everything, including settings and other people's access |
| Executives | Everything operational; reads the money screens |
| Managers | Their team's work, and the customers behind it |
| Staff | Day-to-day work; no settings, no books |
| Customers | The customer portal only |
Groups do the same job for a department — sales, marketing, accounting, customer service — so a new joiner gets the right access by being put in the right group rather than by somebody remembering fourteen switches.
Two-factor authentication
Any person can turn on two-factor authentication from their own profile, and an administrator can require it. Recovery codes are shown once, when it is enabled.
Store them somewhere other than the machine you sign in from. Losing both the device and the codes means an administrator has to reset the account.
How permissions are enforced
Twice, deliberately.
A module only loads if the licence entitles it, and every route inside it checks the permission again before doing anything. The screen showing or hiding a button is a convenience, not the enforcement — a request made directly to the API is checked exactly the same way.