Roles & permissions reference¶
CherryLedger seeds 13 system roles. This page lists what each one is for and the key capabilities it grants. Administrators can also create custom roles.
Two layers of access
Permissions decide what a user can do. Cooperative & factory scoping decides whose data —
users never see other cooperatives, and factory staff are limited to their factory unless they hold
FACTORY_VIEW_ALL.
The system roles¶
| Role | For | Key capabilities |
|---|---|---|
| SUPER_ADMIN | Platform owner (SaaS) | Everything, across all cooperatives — including creating cooperatives. |
| COOP_ADMIN | Cooperative administrator | Full control within their cooperative: factories, members, users, roles, pricing, payouts, sales; can view all factories. |
| FACTORY_MANAGER | Runs one factory | Members, deliveries, receipts, scale, view own factory's users and reports. No pricing/payouts. |
| WEIGHING_CLERK | Weighing bay | Record deliveries, print receipts, read members. Nothing financial; no Users screen. |
| CASHIER | Member cash desk | Issue advances, read collections/members, read payouts. |
| FINANCE_OFFICER | Finance | Set prices, manage deductions, issue advances, prepare payouts. |
| STORE_KEEPER | Farm inputs store | Issue inputs on credit, read members. |
| FIELD_OFFICER | Agronomy / extension | Read members and collections, update member details, view reports. |
| QUALITY_GRADER | Quality grading | Read collections and sales. |
| MARKETING_OFFICER | Coffee sales | Manage sales/auction lots, read pricing. |
| AUDITOR | Oversight | Read-only across modules, including the audit log. |
| BOARD_MEMBER | Committee | Read finance, approve payouts, view audit and reports. |
| MEMBER | Farmer | Self-service portal access only. |
Who can see the Users screen¶
Only roles that hold USER_READ — SUPER_ADMIN, COOP_ADMIN, FACTORY_MANAGER and AUDITOR.
All other roles never see it. Of these, only Super Admin and Coop Admin can see across factories
(FACTORY_VIEW_ALL); a Factory Manager sees only their own factory's staff.
Who can approve payouts¶
PAYOUT_APPROVE is held by COOP_ADMIN and BOARD_MEMBER, keeping approval separate from the
finance staff who prepare the run.
This list can change
Roles and permissions may be extended over time. The Changelog records changes.