Skip to main content

​
How to use this page

This matrix is designed for brand owners and organization admins who need to build or troubleshoot roles.
  • Use the capability column to find the behavior you want.
  • Use the permission column to configure the role.
  • Also verify the related module is enabled for the brand.

​
Core rules

  • *.view usually controls whether a user can open a section or list.
  • *.create controls creation flows.
  • *.update controls edits, state changes, and many operational actions.
  • *.delete controls destructive actions.
  • *.export controls exports where supported.
  • Metrics are separate from feature permissions.

​
Common capability matrix

CapabilityTypical permissionNotes
Open Conversions listconversions.viewAlso requires the brand’s conversions-related module to be enabled.
Create manual conversion-style flowsconversions.createPlan rules may still limit creation in some cases.
Update conversion-related operational actionsconversions.updateUsed for actions like subscription updates and fulfillment operational flows.
Open Customers reportcustomers.viewSeparate from conversions visibility.
Export customerscustomers.exportExport is separate from view.
Open Fulfillment listconversions.viewFulfillment list access is based on conversions access.
Configure or inspect integrationsintegrations.viewSeparate from fulfillment list visibility.
Open Merchants settingsmerchants.viewNeeded for merchant settings and some merchant-dependent selectors.
Open Products settingsproducts.viewProduct management is separate from conversions/customers.
Open Pagespages.viewBase pages access.
Open Advanced pages toolspagecomponents.view, collections.view, trackingscripts.view, backendscripts.view, files.view, and related page permissionsAdvanced page tooling can depend on several permissions.
Open Custom Reportsreports.viewIn some UI contexts analytics.view may also appear; use the report-specific permission model when assigning roles.
Open Tracking reportstracking.view or reporting.utm_performance.viewDepends on the report page.
Open Billingbilling.invoices.view, billing.cards.viewBilling checks use the .view form.

​
Metrics access matrix

Metrics are assigned separately from page permissions.
BehaviorMetric requirement
See all dashboard metrics*
See only selected metricsAdd only those metric keys to the role
Hide the dashboard metric grid, cards, and metrics tableLeave the role with no metric grants
Examples of metric keys include:
  • revenue
  • sales
  • net_revenue
  • conversion_rate
  • refund_total

​
Conversions-only viewer

  • conversions.view
  • selected metrics if you want dashboard visibility

​
Customers-only viewer

  • customers.view
  • customers.export only if export is required
  • selected metrics only if you want dashboard analytics

​
Reports reader

  • reports.view
  • report-specific permissions such as conversions.view, customers.view, tracking.view, or reporting.utm_performance.view
  • selected metrics if the dashboard should also be visible

​
Operations user

  • conversions.view
  • conversions.update
  • optionally integrations.view if they should inspect integration setup
  • optionally merchants.view if they need merchant settings or merchant-based selectors

​
Important differences to remember

  • Feature permissions decide what pages and actions a user can access.
  • Metrics decide whether analytics widgets and dashboard numbers appear.
  • A user may be able to view Fulfillment without being able to view Integrations.
  • A user may see Reports but only be allowed into a subset of report pages.

​
Next step

If a role still behaves unexpectedly, use Restricted Role Troubleshooting.