Access Denied: understanding permissions and roles
If MobilityManager shows Access Denied when you open a page or perform an action, you are signed in successfully but your role does not include the permission that action requires. This article explains how roles and permissions work so you can request the right access.
Symptom
A screen, button, or export returns Access Denied, or a menu item you expect is missing. You are not asked to sign in again, which confirms the issue is permissions, not authentication.
Cause
Access in MobilityManager is controlled by role-based access control (RBAC). Every protected action is guarded by a specific permission such as vehicles:edit, bookings:approve, or belege:view. Your permissions come from the role or roles assigned to you within the company (tenant) you are currently working in. If your current role does not grant the required permission, the action is denied.
Permissions are evaluated per company. If you belong to more than one company, you may have different roles in each, so the same action can be allowed in one company and denied in another.
The built-in roles
Three system roles ship with the product, and administrators can also create custom roles with a hand-picked set of permissions.
| Role | Intended for | Typical access |
|---|---|---|
| SystemAdmin | Platform administrators | Every permission, including user, role, tenant, and license administration. |
| FleetManager | Day-to-day fleet operations | Runs the operational modules end to end (vehicles, bookings, damage, expenses, and more). The most financially sensitive actions, such as financial corrections and budget management, are intentionally withheld and remain SystemAdmin-only. |
| Driver | Self-service end users | Create and view their own bookings, view the fleet they can book, and manage their own driving licence. Drivers do not see finance or admin areas such as Belege (Expenses). |
Note: SystemAdmin automatically receives every permission, including any added with a new module, so there is no need to update it by hand when the platform grows.
Resolution
- Confirm which company you are working in. If you have access to several, switch to the correct one; your roles may differ between them.
- Decide which capability you need, for example approving bookings or viewing expenses, so you can describe it precisely.
- Ask an administrator to either assign you a role that includes the required permission or add that permission to a custom role you already hold.
- Sign out and back in so your session token is rebuilt with the updated roles. Role changes take effect with a fresh sign-in.
Tip: If a whole module is missing rather than a single action being denied, the cause may be your license rather than your role. See the related article on modules that are not enabled.
Related
- I do not see a module that should be available
- I cannot log in: a step-by-step checklist
- A company (tenant) is not showing at login
- Understanding trace IDs in error messages
