The permission catalog and categories
This article explains the permission catalog in MobilityManager: how permissions are named, how they are grouped into categories, and how they combine into the access a user actually has.
How permissions are named
Every permission is a short key in the form resource:action, such as vehicles:view, bookings:approve, or users:manage. Each permission also has a human-readable display name (for example "View vehicles") and a category, so you can browse them by area rather than memorising keys.
Permission categories
Permissions are grouped by the module or area they govern. The catalog includes these categories:
| Category | Governs |
|---|---|
| Tenants | Creating, editing, deactivating, and viewing tenants. |
| Users | Managing, creating, editing, deleting, and viewing users. |
| Roles | Managing roles and assigning or removing them. |
| Vehicles | The Fahrzeugakte (vehicle file): create, edit, delete, view. |
| Bookings | Managing, approving, rejecting, creating, and viewing bookings. |
| Settings / Reports | Platform settings and reporting. |
| Damage management / CRM | Damage cases and customer records. |
| Strafmandate | Penalty notices: view, assign driver, forward to authority, manage workflow. |
| Belege | Expense documents: view, transition, mark paid, compliance trail, correct financials. |
| Documents / Email Templates | Shared document uploads/downloads and email templates. |
| Driver License / License Verification | Driver licences and the Führerscheinkontrolle (driver's licence check). |
| Warehouse / Maintenance / Tankmanagement | Lagerverwaltung, Wartungsplanung, and fuel management modules. |
| Versicherung / Fleet Cost | Insurance management and the Fleet Cost Cockpit (TCO analytics). |
| Software License | Installing and replacing the system's software licence. |
Coarse and fine permissions
Many modules offer both a broad permission and finer ones. For example, Vehicles has a "manage" permission alongside separate create, edit, delete, and view permissions. This lets you grant a role read-only visibility (view) or full control (manage) depending on the job.
Note: Some permissions are deprecated as the product evolves. Deprecated permissions do not appear as options when you configure a custom role and do not count toward a user's access, so you only ever assign current permissions.
How permissions reach a user
Users are never granted permissions directly. A user holds roles per tenant, and each role carries permissions:
- System roles — SystemAdmin holds every permission in the catalog; FleetManager and Driver hold fixed, curated sets.
- Custom roles — hold exactly the permissions an administrator selects from the catalog.
When a user holds more than one role in a tenant, their effective permissions are the union of all those roles' permissions.
Viewing the catalog
Administrators with roles:manage can browse the full permission catalog, which is what you use when configuring custom roles. Each entry shows its key, display name, category, and description so you can choose confidently.
Tip: To see what you personally can do in the current tenant, review your own permissions and roles from your account. This is also the quickest first step when diagnosing an unexpected "Access Denied".
Related
- Assign permissions to a custom role
- Create a custom role
- Troubleshooting "Access Denied" errors
- The SystemAdmin role and what it can do
