The access profile, a single idea
Six kinds: business, temporary restriction, external contractor, intern, read-only, audit and compliance. A profile is assigned to users, to native Dolibarr groups and to entities, with a start and an end date.
Deny wins
A user may carry several profiles. "Denied" beats "allowed", which beats "inherited". The rule is written once in the engine and applied everywhere, including by the simulator and by the API.
Per-object rights
A catalogue of 44 real Dolibarr objects. For each one: create, read, update, delete as allowed, denied or inherited, plus read-only and the hiding of archiving, duplication, spreadsheet and export.
Per-field rights
Five modes: normal, hidden, read-only, mandatory, external link removed. Value masked by a configurable pattern, applied on the list, on the card and on exports as you choose.
No-code profile builder
One table, one row per object, four drop-downs. The whole matrix is saved in a single submission, and a row that says nothing is not stored.
Interface: menus, buttons, tabs, filters
Hiding of top and left menus with or without their children, of buttons by selector and by action code, of card tabs, of search filters, of groupings and of the column picker.
Record-level rules
Several conditions combined with AND or OR, thirteen operators including "current user" and "current entity", granting or denying the matching records. The fragment goes into the SQL of the list: the rows never leave the database.
Documents, exports and mass actions
Restriction of PDF templates, of CSV, Excel and Word exports, of statistics and mail merge, with a row cap, a full block and a watermark. Blocking of mass actions, from archiving to e-mailing.
Password policy
Validity period, minimum length, uppercase, digit, special character, history, number of attempts and lockout duration, per profile. Per-user expiry with a countdown and lockout after N failures.
Automatic reminders
E-mails seven days then one day before expiry, with a send queue and a failure log, and a warning banner on every page as the deadline approaches.
Sessions and monitoring
A journal of logins and logouts with IP address, device, duration, pages viewed and denied accesses; an activity journal naming the rule that denied; login attempts with their failure reason.
Monitor and log in as
Who is connected right now, forced logout, and logging in as another user with a mandatory reason and a traced duration.
Perimeter: delegations, IP, time windows
Temporary delegation of a profile during an absence with automatic revocation, IP address filters as allow or deny lists, and permitted time windows per day of the week.
Simulator and access matrix
The simulator answers, object by object, "what does this user see and what can they do", by asking the engine that actually applies the rules. The matrix crosses objects and profiles, one colour per verdict.
Audit, alerts and steering
An audit trail of every rights change with the value before and after, security alerts at three levels with a handling queue, a dashboard, 51 reports in 10 families, CSV, Excel, Word, PDF and JSON exports, a 34-route REST API.
Installable demonstration data
A complete configuration of about 4,400 rows installs on activation and uninstalls in one click, without touching a single row your users created.
