Create Custom Roles and Review the Audit Log

Last updated: 2026-07-09 Summary:

• Custom roles let you build a permission set that isn’t covered by the four built-in roles — pick exactly what a person can see and do.
• The audit log is your record of who did what: every create, update, delete, approval, and sign-in, with a field-level change diff.
• Both are Pro-tier features. On lower plans you’ll see an Upgrade required prompt.

Before you start: Invite and manage users covers adding people and the four built-in roles (Owner, Admin, Accountant, Viewer). This page is for when those four aren’t enough.

Create a custom role

1. Go to Administration → Roles (/admin/roles). The page splits System Roles (built-in, locked) from Custom Roles (yours).
2. Click Create Custom Role.
3. Enter a Role Name (2–50 characters) and a Description.
4. In the Permissions card, expand each module panel and tick the permissions this role should have. Use the panel’s Select All checkbox to grant a whole module at once.
5. Click Create Role. Assign it to a person the same way you assign any role — see Invite and manage users.

Faster: clone an existing role. On any role, click Clone, give the copy a name and description, and click Create & Customize. The new role starts with the source role’s full permission set — trim it down instead of building from scratch. This is the easiest way to make, say, an “Accountant, but no payroll” role.

Built-in system roles are marked with a lock: you can Clone them but not edit or delete them. Custom roles get Edit and Delete (deleting one warns you to reassign anyone still on it first).

Review the audit log

1. Go to Administration → Audit Log (/admin/audit-log).
2. Each row is one recorded action, with Timestamp, User, Action, Entity Type, Description, and IP Address. Click a row to expand a field-level change diff showing what changed from and to.
3. Narrow the list with the filters: User, Action (Created, Updated, Deleted, Approved, Voided, Posted, Login, Logout), Entity Type (for example “invoice”), and Date Range. Clear filters resets them.
4. Use Export CSV or Export PDF to hand a record to a reviewer or auditor.

Where people get tripped up

• “Create Custom Role / Audit Log gives an Upgrade required prompt.” Both features are on the Pro tier (and the Pro-equivalent trial). On lower plans the Roles list is still viewable, but creating or editing a custom role and opening the audit log need the upgrade. See Plans and feature entitlements and Pricing.
• “I can’t edit a built-in role.” By design — system roles are locked so their behavior stays predictable. Clone one and edit the copy.
• “Deleting a role broke someone’s access.” Reassign everyone off a custom role before deleting it; the delete dialog warns you for this reason.
• Audit log vs Activity. The audit log is the change record with diffs. A separate Activity page shows session activity — don’t confuse the two when hunting for a specific edit.

See also

• Invite and manage users
• Plans and feature entitlements
• Pricing