New user and permissions

An employee's access lifecycle in CoreX ERP: when the employee starts, a role is prepared and an account is opened; at first sign-in the employee sets a password and sees only the screens and buttons of their own job; when the employee leaves, the account is closed. For the concepts, first read the Permission model.

Scenario

On 2 November 2026, a sales representative joins the demo company's sales team. The representative will write quotations and sales orders and give commercial approval to sales orders; they will not write price lists, will not close sales orders manually (that is the sales manager's job), and will not see the purchasing and administration screens. On the same day, the account of an employee leaving the team is to be closed.

• Role: Demo — Satış Temsilcisi (Demo — Sales Representative; from the ready-made Satış Temsilcisi (Sales Representative) template, with erp-sales-orders.close removed — 113 permissions)
• New user: Demo Satış Temsilcisi — [email protected]
• Departing user: Demo Eski Çalışan (Demo Former Employee) — [email protected]

Role design ──► Open account ──► (Restriction / extra permission) ──► First sign-in ──► Permission check ──► Departing employee
 Roles           Users             Users                                 Change your       menu, button,       Deactivate
 (113 perms)     Invitation        Actions menu                          password          403, log            (role and record remain)
                 pending or Active

1. Prepare the role

Yönetim › Kullanıcı ve Roller › Roller (Administration › Users and Roles › Roles)

The person could also have been given the ready-made Satış Temsilcisi (Sales Representative) role. Because the scenario does not want the permission to close sales orders, a new role is created from the template:

1. Yeni Rol (New Role) → Rol adı (Role name): Demo — Satış Temsilcisi → Rol şablonu (Role template): Satış Temsilcisi · Eleman (Sales Representative · Staff).

New Role — properties and template

1. 1Role name — cannot be changed later
2. 2Role template — starting permissions
3. 3Scope — modules the role writes in
4. 4Permissions and Screens tabs
5. 5Create Role

2. On the Yetkiler (Permissions) tab, type siparis in the search box and clear the Satış Siparişleri · Kapat (Sales Orders · Close) check box. The tab counter drops from 114 to 113.

Role — permission tree

1. 1Granted / total permissions
2. 2Search — module, page or action
3. 3Module — ticks all at once
4. 4Action — a single permission
5. 5Permission not granted in this role
6. 6Read Only — keeps only View permissions

3. On the Ekranlar (Screens) tab, the catalog comes from the template (31 screens); without changing it, click Rolü Oluştur (Create Role).

Role — Screens (menu catalog)

1. 1All screens — every permitted screen in the menu
2. 2Adds screens the role writes to
3. 3Area › section › screen — shown in the menu
4. 4Selected / total screens

The role appears in the list in the "Kurumun rolleri" (Organization's roles) area, with the modules it writes to in the Kapsam (yazma) (Scope — write) column. A role created from a template is not linked to the template; all of its permissions can be changed. Details: Create a role.

2. Open the account

Yönetim › Kullanıcı ve Roller › Kullanıcılar › Yeni Kullanıcı (Administration › Users and Roles › Users › New User)

1. Ad (First name) Demo, Soyad (Last name) Satış Temsilcisi, E-posta (E-mail) [email protected].
2. Davet e-postası gönder — kullanıcı şifresini kendisi belirlesin (Send an invitation e-mail — let the user set their own password) (recommended).

New User — User Information

1. 1Tabs — information, roles, org unit
2. 2E-mail — login ID, cannot be changed later
3. 3Invitation — single-use link valid for 3 days (recommended)
4. 4Administrator sets the password — account opens at once
5. 5Lock on failed attempts
6. 6Send Invitation — needs e-mail settings

3. On the Roller (Roles) tab, select Demo — Satış Temsilcisi.

New User — Roles tab

1. 1Roles — count of selected in brackets
2. 2Search role or area
3. 3Tick the role; several roles allowed

4. Click Davet Gönder (Send Invitation). The account is opened with the Davet bekliyor (Invitation pending) badge; the person sets a password with a link valid for 3 days. Details: Invite a user.

Invitation in the demo environment

The demo installation has no e-mail settings; Davet Gönder (Send Invitation) stopped with this message and the account was not opened: "E-posta gönderimi yapılandırılmamış (Yönetim › Özelleştirme › Genel › E-posta Ayarları). Davet bağlantısı gönderilemez; hesabı şifre belirleyerek açabilirsiniz." (E-mail sending is not configured (Administration › Customization › General › E-mail Settings). The invitation link cannot be sent; you can open the account by setting a password.) The scenario continued with the second option: Şifreyi ben belirleyeyim (I will set the password) → Rastgele Üret (Generate Random) → İlk girişte şifre değiştirilmesi zorunlu olsun (Require password change at first sign-in) selected → Hesabın açıldığını kullanıcıya e-postayla bildir (Notify the user by e-mail that the account was opened) cleared → Oluştur (Create). Notification: "Kullanıcı oluşturuldu: Demo Satış Temsilcisi" (User created: Demo Satış Temsilcisi). Details: Create a user with a password.

New User — administrator sets the password

1. 1Password — 8+ characters, a digit, a lowercase letter
2. 2Generate and Copy
3. 3Change password at first login
4. 4Notice e-mail — password is not included
5. 5Create

The account appears in the list in Aktif (Active) status, with the new role in the Roller (Roles) column:

Users list

1. 1New User — opens an account by invitation or password
2. 2Search by name or e-mail
3. 3Role filter
4. 4Status: Active · Inactive (disabled) · Locked · All
5. 5Row: name, roles and account (e-mail)
6. 6Actions — edit, permissions, password, disable

3. Restrictions and extra permissions, if needed

Not needed for the sales representative. When needed, use the row's İşlemler (Actions) menu:

• Organizasyon Kısıtlaması (Organizational Restriction) — narrows a warehouse keeper to their own warehouse, or an operator to their own work center: Grant an organizational restriction.
• Ekstra Yetkiler (Extra Permissions) — a permission outside the role for a single person (e.g. temporary quotation approval): Grant an extra permission.

User row Actions menu

1. 1Name, phone, roles and org unit
2. 2Personal permissions on top of roles
3. 3Narrows rights to warehouses and work centers
4. 4Reset link or manual password
5. 5Disables the account — record is kept

4. First sign-in

On the sign-in screen, the user signs in with their e-mail and the password provided to them. Because the password was set by the administrator, the application first opens the Parolanızı değiştirin (Change your password) screen: "Güvenliğiniz için devam etmeden önce parolanızı değiştirmeniz gerekiyor." (For your security, you need to change your password before continuing.) — Mevcut parola (Current password), Yeni parola (New password), Yeni parola (tekrar) (New password, again) → Parolamı Değiştir ve Devam Et (Change My Password and Continue). The Home page then opens; the person's role (Demo — Satış Temsilcisi) is shown below the greeting.

For an account opened by invitation, instead of this step the Hesabınızı etkinleştirin (Activate your account) page from the e-mail link is used (full name and password → Hesabımı Etkinleştir — Activate My Account).

The sign-in and the password change leave a trace on the administrator side:

Access Log

1. 1Event filter — login, failed login, lock, logout
2. 2Search by user or e-mail
3. 3Event type
4. 4Source address

Audit Log

1. 1User filter
2. 2Entity type — which record
3. 3Create · Update · Delete
4. 4Changed fields
5. 5Old and new value

5. Check the permissions

Verified in the demo environment by signing in as the new user:

Check	What is seen
Top menu	Satış, Stok Yönetimi, Lojistik Yönetimi, Üretim, Ana Veriler, Finans (Sales, Inventory, Logistics, Production, Master Data, Finance). Satın Alma, Servis, Bakım, Yönetim (Purchasing, Service, Maintenance, Administration) are absent.
Satış › Sipariş Yönetimi › Satış Siparişleri (Sales › Order Management › Sales Orders)	Yeni Sipariş (New Order) is available. On a draft sales order, Düzenle (Edit), Siparişi Onayla (Approve Order) and Siparişi İptal Et (Cancel Order) are available.
Satış › Teklif Yönetimi › Satış Teklifleri (Sales › Quotation Management › Sales Quotations)	On a draft quotation: Gönder (Send), Düzenle (Edit), İptal Et (Cancel); on a sent quotation: Siparişe Dönüştür (Convert to Order), Revize Et (Revise), Kaybedildi (Lost).
Satış › Ana Veriler › Fiyat Listeleri (Sales › Master Data › Price Lists)	The list can be read; only Dışa Aktar (Export) is available — there is no new list button (no erp-sales-price-lists.create).
The address of the purchase order list	Not in the menu, but it opens via the address and can be read (read baseline); there is no Yeni Sipariş (New Order) button.
The /users, /roles, /module-management addresses	"Bu işlemi gerçekleştirmek için yetkiniz bulunmuyor." (You do not have permission to perform this operation.) · "Erişim gerekiyorsa sistem yöneticinizle iletişime geçin." (If you need access, contact your system administrator.) · Ana Sayfa'ya dön (Back to Home)

If a user says they cannot see a button, check in this order:

1. Does their role (or their unit's role, or their extra permissions) have the permission for that operation? Find the button's source in the Permission list and check it on the role's Yetkiler (Permissions) tab.
2. Is the feature enabled in Modül Yönetimi (Module Management)? If it is disabled, the message is "Bu özellik kuruluşunuzda etkin değil." (This feature is not enabled in your organization.)
3. If the screen is not in the menu, is it in the role's Ekranlar (Screens) catalog?
4. Does the document's status allow the button? If a rule blocks it, the button is visible but disabled; hovering over it shows the reason.

6. Close the departing employee's account

Yönetim › Kullanıcı ve Roller › Kullanıcılar (Administration › Users and Roles › Users) — row Demo Eski Çalışan › İşlemler (Actions) › Devre Dışı Bırak (Deactivate) → Devre dışı bırak (Deactivate).

Disable the account?

1. 1Login closes, open session ends; roles are kept

The account cannot sign in; an open session is dropped on the next request. The record is not deleted: its roles remain, past documents continue to show the account, and pending invitation and password links become invalid. The account appears under the Durum: Pasif (devre dışı) (Status: Inactive — deactivated) filter and, if necessary, can be reopened together with its roles with Geri Yükle (Restore).

Disabled accounts and Restore

1. 1Status: Inactive (disabled)
2. 2Disabled badge
3. 3Restore — reopens with its roles

Details: Deactivate a user.

FAQ / Troubleshooting

Message or situation	Cause	What to do
"E-posta gönderimi yapılandırılmamış (Yönetim › Özelleştirme › Genel › E-posta Ayarları). Davet bağlantısı gönderilemez; hesabı şifre belirleyerek açabilirsiniz." (E-mail sending is not configured … The invitation link cannot be sent; you can open the account by setting a password.)	There are no e-mail settings.	Have the e-mail settings configured, or open the account with Şifreyi ben belirleyeyim (I will set the password).
"Hesap açıldı ama davet e-postası gönderilemedi (…)" (The account was opened but the invitation e-mail could not be sent (…))	The account was opened; the e-mail did not go out at that moment.	İşlemler › Daveti Yeniden Gönder (Actions › Resend Invitation).
"Bu davet geçersiz ya da süresi dolmuş." (This invitation is invalid or has expired.)	The link exceeded 3 days, was already used, or a newer one was sent.	Daveti Yeniden Gönder (Resend Invitation).
"Bu işlemi gerçekleştirmek için yetkiniz bulunmuyor." (You do not have permission to perform this operation.)	No permission (HTTP 403).	Add the permission to the user's role or assign a suitable role; the change takes effect immediately.
"Bu özellik kuruluşunuzda etkin değil." (This feature is not enabled in your organization.)	The role has the permission, but the feature is disabled.	Enable the feature in Modül Yönetimi (Module Management).
"Devam etmeden önce parolanızı değiştirmeniz gerekiyor — bu parolayı sizden başka biri de biliyor." (You need to change your password before continuing — someone other than you also knows this password.)	A password change is required at first sign-in.	The user completes the Parolanızı değiştirin (Change your password) screen.
"E-posta veya parola hatalı." (Incorrect e-mail or password.)	Wrong e-mail or password.	Check the description in Erişim Günlüğü (Access Log) (Hatalı parola (Wrong password) / Bilinmeyen e-posta (Unknown e-mail) / Hesap devre dışı (Account deactivated)).
"Hesap … başarısız giriş denemesi nedeniyle kilitlendi. …" (The account was locked due to … failed sign-in attempts. …)	5 failed attempts, 15-minute lock.	Wait, or Unlock the account; if the password was forgotten, send a link.
"Çok fazla deneme yapıldı. 60 saniye sonra tekrar deneyin." (Too many attempts. Try again in 60 seconds.)	More than 10 sign-in attempts per minute from the same address.	Wait a minute and try again.
'<depo kodu>' deposunda işlem yetkiniz yok. (You do not have permission to operate in warehouse '<warehouse code>'.)	Organizational restriction.	Add the warehouse to the restriction, or leave the task to an authorized person.
An assigned approval role does not appear in the approval inbox	The approval role is read from the session's role names.	The user should refresh the page.
"Kendi hesabınızı devre dışı bırakamazsınız. Bunu başka bir yönetici yapmalı." (You cannot deactivate your own account. Another administrator must do this.)	You tried to close your own account.	Another administrator does it.
"… Yönetici rolünü taşıyan son etkin hesap. …" (… the last active account with the Administrator role. …)	The role is being removed from the last administrator.	First give the Administrator role to another user.
"Lisans en çok … etkin kullanıcıya izin veriyor; …" (The license allows at most … active users; …)	The license's user limit is reached.	Deactivate an unused account or extend the license.

Step-by-step tasks

1. Create a roleRole from a template, permissions and screens.2a. Invite a userInvitation by e-mail.2b. Create a user with a passwordIf there are no e-mail settings.3a. Organizational restrictionWarehouse and work center.3b. Extra permissionA permission specific to one person.Change a roleRole assignment when the job changes.Reset a passwordLink or manual password.6. DeactivateDeparting employee.