Built-in roles, the permission matrix, and how to assign roles to staff members per brand in Pycer.
Pycer uses role-based access control (RBAC) to determine what each staff member can see and do. Roles are assigned per brand, so the same person can be a Manager on one brand and a Viewer on another. For authentication details, see Login and authentication.
Built-in roles
Pycer ships with four built-in roles. Custom roles are not yet supported in v3.0.0.
Role
Scope
Typical use
Super Admin
Global - all brands, all settings
Server owner who installed Pycer
Admin
Per-brand - full access within assigned brands
Business manager who controls one or more brands
Manager
Per-brand - can manage payments and view reports
Operations lead handling day-to-day transactions
Viewer
Per-brand - read-only access to transactions and reports
Auditor or accountant who needs visibility only
Permission matrix
Permission
Super Admin
Admin
Manager
Viewer
View brands
✅
✅
✅
✅
Manage brands
✅
✅
❌
❌
Manage staff
✅
✅
❌
❌
Manage roles
✅
❌
❌
❌
View customers
✅
✅
✅
✅
Manage customers
✅
✅
✅
❌
View transactions
✅
✅
✅
✅
Manage transactions
✅
✅
✅
❌
Manage refunds
✅
✅
✅
❌
View invoices
✅
✅
✅
✅
Manage invoices
✅
✅
✅
❌
View payment links
✅
✅
✅
✅
Manage payment links
✅
✅
✅
❌
Manage gateways
✅
✅
❌
❌
View reports
✅
✅
✅
✅
View audit log
✅
✅
✅
❌
Manage domains
✅
✅
❌
❌
Manage plugins
✅
✅
❌
❌
Manage system settings
✅
✅
❌
❌
Manage API keys
✅
✅
❌
❌
Balance verification
✅
✅
❌
❌
System update
✅
❌
❌
❌
How to assign a role
Go to People → Staff.
Click Edit on the staff member’s row.
Select the role from the dropdown.
Choose the brands this role applies to.
Click Save.
The role takes effect the next time the staff member loads a page. If they are currently logged in, ask them to refresh the browser or log out and back in.
Per-brand role assignment
The same staff member can hold different roles on different brands. When you edit a staff member, you see a list of all brands with a role selector next to each one. This lets you give someone Admin access on Brand A but only Viewer access on Brand B.
Do not give the Admin or Super Admin role to staff who only need to view reports. Use the Viewer role instead and follow the principle of least privilege.
