User Permissions and Settings
Path: Home, Configure, User Settings. The page has four tabs across the top:User Management, User Role Group, Bulk Edit User Role Groups, Set Permission for Role Groups.
User Management tab
Lists every user in the workspace. Filter controls at the top:In Group (role-group filter dropdown), Reset Filter, + Create Users button.
The grid columns:
| Column | What it means |
|---|---|
| Username | Email address used to log in |
| Full Name | Display name |
| Login Details | Login count and last login timestamp |
| Role Groups | Which role groups the user belongs to (comma-separated for multiple) |
| Action | Edit |
| Status | Active toggle |
Super User (full admin), and named role groups for warehouse, customer service, finance, etc.
User Role Group tab
Defines the role groups themselves. Each group has a name and a description. Add a new group, delete an existing one, rename.Bulk Edit User Role Groups tab
For workspaces with many users, bulk-edit is faster than per-user editing. Select users, apply or remove a role group across the selection.Set Permission for Role Groups tab
The permission grid. Per role group, toggle the per-feature permissions:- View permissions (can the role see this surface).
- Edit permissions (can the role edit data on this surface).
- Delete permissions (can the role delete records on this surface).
- Bulk-action permissions (can the role do destructive bulk operations).
| Role | Typical permissions |
|---|---|
| Super User | All view, edit, delete, bulk |
| Admin | All view, edit. Limited delete and bulk. |
| Customer Services | View Orders, edit Order Stage, view Customer Services. No Configure access. |
| Warehouse | View Orders, view Picking, view Goods Received, edit Goods Received. No financial access. |
| Finance | View Sales, VAT, Returns, Accounts Payable. No edit on operational surfaces. |
| Buyer | Edit Suppliers, edit Purchase Orders, view Inventory Age. |
Use cases
- Day-zero role setup. Define the role groups before inviting users. Once roles are in place, new users land in the right access shape from the start.
- Audit trail. When Stock Movement Log shows an unexpected manual edit, the user record tells you who and the role tells you whether they should have had that permission.
- Departing employee. Toggle Status to Inactive immediately. Their session terminates at next refresh; their role group assignments are preserved for the audit trail.
Common gotcha
The Status toggle deactivates the user but does not delete them. The user count under Organisation Settings still includes inactive users for licensing. To fully remove, delete from the User Management grid.A note on role concentration
Concentrating power in a single Super User is a single-person-of-failure risk. Best practice: at least two Super Users per workspace, and grant Super User only to people who genuinely need it. Most operational tasks can be handled by a non-Super-User Admin role.Shipping & Carrier Configuration
Path: Home, Configure, Shipping & Carrier Configuration. This page lists every shipping carrier connected to the workspace. The default UK setup typically includes:| Carrier | Logo | Domestic | International |
|---|---|---|---|
| Royal Mail | shown | Domestic Services | International Services |
| DPD | shown | Domestic Services | International Services |
| Parcelforce | shown | Domestic Services | International Services |
| Interlink Express | shown | Domestic Services | International Services |
Edit Settings link. Clicking edit opens the per-carrier configuration: API credentials, account number, default service level for domestic and international, label dimensions.
What each carrier integration does
- Label production. When an order moves to the Courier Label Printed stage, CloudHub calls the carrier API to generate the shipping label, which prints via the Document Print Management routing.
- Tracking. The carrier returns a tracking number that gets pushed back to the marketplace order record (Amazon, eBay, etc.).
- Pickup booking. Some carriers (DPD, Parcelforce) support API pickup booking. Configure the cutoff time and the pickup is auto-booked at the right time of day.
- Cost capture. The cost per label is captured back to the Shipping Costs report.
Service levels
Each carrier exposes multiple service levels: next-day, standard, signed-for, tracked-48, etc. Configure the default service per carrier. Override per-order via the Order Workflow routing rules.Use cases
- Default carrier for retail orders. Royal Mail Tracked-48 for sub-2kg parcels. Configure as the default in the workflow.
- Default carrier for B2B. DPD next-day for bulk orders.
- International routing. Parcelforce for international orders, with country-specific service-level rules.
- Carrier negotiation lever. Once a quarter, review the Shipping Costs report by carrier. The volume going to each carrier is the negotiation evidence for the next contract review.
Common gotcha
Carrier credentials expire. If labels suddenly stop generating, the API credentials are the most likely cause. Re-authenticate via Edit Settings; do not delete and recreate the carrier row, since the historical orders reference it.How these two surfaces interact
The Shipping & Carrier Configuration is what produces labels. The User Permissions decide who can edit the carrier configuration and who can override carrier choice on a per-order basis. A common access pattern:- Super User can edit Shipping & Carrier Configuration (rare changes, sensitive credentials).
- Admin can override carrier choice per order via Order Workflow rules.
- Customer Services can override carrier choice on a single order at dispatch time (for special-handling cases).
- Warehouse can print labels on the configured default carrier; cannot change carrier.
Cross-link to the rest of the AI OS
| Need | Where to go |
|---|---|
| Live carrier KPI | Nerve Centre, the connector card |
| ”Why is DPD failing on label generation today?” | Vortex Mind, dispatch operational diagnostics; also check carrier credentials |
| ”Show me users with Delete permission on Purchase Orders” | User Permissions Set Permission for Role Groups, this section |
| ”Open a fix for the recurring DPD label failures” | Actions Kanban |
Common questions
Can a user belong to multiple role groups? Yes. Permissions are additive across all assigned role groups. A user in both Customer Services and Buyer gets the union of both sets of permissions. What is the difference between Status (Active/Inactive) and Delete? Inactive disables login but preserves the user record for audit. Delete removes the user record. Always go Inactive first; Delete only when the user record is genuinely no longer needed (and even then, audit trails for the user’s past actions are preserved by design). How do I add a new carrier that is not on the default list? Custom carrier integrations are supported via support@247cloudhub.co.uk. The default UK list covers the major couriers; international expansions and regional couriers are available on request. Each integration takes 1-2 weeks to wire up. What if a carrier label fails to generate at dispatch time? The order stays in the Courier Label Printed stage with an error flag. Customer Services should retry, and if persistent, switch carrier on the order via the workflow override. Persistent failures are usually credentials, account-number issues, or oversize/weight violations.Next steps
- Return to the Configure overview for the wider setup map.
- See Workflows and Pricing Rules for how carrier choice is wired into the order workflow.
- Consult the CloudHub overview for how the configured services feed every action verb.