> ## Documentation Index
> Fetch the complete documentation index at: https://learn.nexudus.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Users and roles

> Create administrator accounts, limit their location access, and assign permission groups.

## Overview

Use **Users and roles** to control who can access the Nexudus dashboard and what they can do. A user is an individual staff account. A role is a permission, and a user role is a reusable group of permissions that you assign to users.

Go to **Settings → Users** to manage staff accounts, and **Settings → Roles** to manage permission groups. You need administrator access or the corresponding user and role permissions.

<Info>
  Permissions are additive. A user receives the combined permissions of every user role assigned to them.
</Info>

## Create a user

<Steps>
  <Step title="Open Users">
    Select **Settings → Users** and add a user.
  </Step>

  <Step title="Enter account details">
    Add the person's name, email address, preferred language, and default location.
  </Step>

  <Step title="Set sign-in access">
    Set or generate a password. Enable password reset on first sign-in when appropriate.
  </Step>

  <Step title="Set location access">
    On the access section, select the locations the user can work with.
  </Step>

  <Step title="Assign user roles">
    Assign the permission groups needed for the person's work, then save the account.
  </Step>
</Steps>

## User fields

| Field              | Description                                                            |
| ------------------ | ---------------------------------------------------------------------- |
| Full name          | Identifies the staff member in the dashboard                           |
| Email              | Their sign-in address and, where enabled, SSO identity                 |
| Default location   | The location selected when the user signs in                           |
| Preferred language | The dashboard language for that user                                   |
| Password           | A new or generated password; you can require a reset at next sign-in   |
| Locations          | Limits the locations whose records the user can access                 |
| User roles         | Permission groups assigned to the user                                 |
| API access         | Allows this user account to authenticate API integrations when enabled |
| MAC addresses      | Optional device restrictions for the account                           |

## Build a permission group

<Steps>
  <Step title="Open user roles">
    Go to **Settings → Roles → User roles**.
  </Step>

  <Step title="Create or copy a group">
    Create a named group, or start from a supplied template such as read-only, billing, or operations.
  </Step>

  <Step title="Choose permissions">
    Select the permissions needed for the job, then save the group.
  </Step>

  <Step title="Assign the group">
    Return to the user record and add the group in its access section.
  </Step>
</Steps>

## Permission names

Permissions use an entity and action, such as `Customer-Read` or `Invoice-Create`.

| Suffix | Allows the user to        |
| ------ | ------------------------- |
| List   | View a list of records    |
| Read   | Open an individual record |
| Create | Add records               |
| Edit   | Change records            |
| Delete | Remove records            |

## Administrators and API access

An **administrator** has unrestricted dashboard access. Administrator access overrides assigned user roles, so reserve it for staff who administer the platform.

Enable **API access** only for accounts used by a trusted integration. Use a separate, least-privilege account where possible and review it when the integration changes.

## Best practices

* Give users the smallest set of permissions that lets them complete their work.
* Restrict users to the locations they need.
* Use named user roles instead of manually recreating the same permissions for each user.
* Remove access promptly when a staff member changes role or leaves.

## Related pages

* [Roles and permissions](/platform/roles-and-permissions)
* [Multi-location management](/platform/multi-location)
* [Settings and configuration](/platform/settings/overview)