# New user and permissions

> From opening an account for a new employee to closing the account of a departing employee — role design, user invitation, role assignment, first sign-in, permission check and deactivation.

URL: https://erpdocs.corexlogic.com/en/surecler/yeni-kullanici-ve-yetki

An employee's access lifecycle in CoreX ERP: when the employee starts, a role is prepared and an account is opened; at
first sign-in the employee sets a password and sees only the screens and buttons of their own job; when the employee
leaves, the account is closed. For the concepts, first read the [Permission model](https://erpdocs.corexlogic.com/en/yonetim/yetki-modeli).

> **Scenario**
On 2 November 2026, a **sales representative** joins the demo company's sales team. The representative will write
quotations and sales orders and give commercial approval to sales orders; they will not write price lists, will not
close sales orders manually (that is the sales manager's job), and will not see the purchasing and administration
screens. On the same day, the account of an employee leaving the team is to be closed.

- Role: **Demo — Satış Temsilcisi** (Demo — Sales Representative; from the ready-made **Satış Temsilcisi** (Sales
  Representative) template, with `erp-sales-orders.close` removed — 113 permissions)
- New user: **Demo Satış Temsilcisi** — `satis.temsilcisi@demo.corexlogic.com`
- Departing user: **Demo Eski Çalışan** (Demo Former Employee) — `eski.calisan@demo.corexlogic.com`

```
Role design ──► Open account ──► (Restriction / extra permission) ──► First sign-in ──► Permission check ──► Departing employee
 Roles           Users             Users                                 Change your       menu, button,       Deactivate
 (113 perms)     Invitation        Actions menu                          password          403, log            (role and record remain)
                 pending or Active
```

## 1. Prepare the role

**Yönetim › Kullanıcı ve Roller › Roller** (Administration › Users and Roles › Roles)

The person could also have been given the ready-made **Satış Temsilcisi** (Sales Representative) role. Because the
scenario does not want the permission to close sales orders, a new role is created from the template:

1. **Yeni Rol** (New Role) → **Rol adı** (Role name): `Demo — Satış Temsilcisi` → **Rol şablonu** (Role template):
   **Satış Temsilcisi · Eleman** (Sales Representative · Staff).

![New Role — properties and template](https://erpdocs.corexlogic.com/en/en/img/screens/yonetim/rol-yeni.png)
1. Role name — cannot be changed later
2. Role template — starting permissions
3. Scope — modules the role writes in
4. Permissions and Screens tabs
5. Create Role

2. On the **Yetkiler** (Permissions) tab, type `siparis` in the search box and clear the **Satış Siparişleri · Kapat**
   (Sales Orders · Close) check box. The tab counter drops from 114 to 113.

![Role — permission tree](https://erpdocs.corexlogic.com/en/en/img/screens/yonetim/rol-yetkiler.png)
1. Granted / total permissions
2. Search — module, page or action
3. Module — ticks all at once
4. Action — a single permission
5. Permission not granted in this role
6. Read Only — keeps only View permissions

3. On the **Ekranlar** (Screens) tab, the catalog comes from the template (31 screens); without changing it, click
   **Rolü Oluştur** (Create Role).

![Role — Screens (menu catalog)](https://erpdocs.corexlogic.com/en/en/img/screens/yonetim/rol-ekranlar.png)
1. All screens — every permitted screen in the menu
2. Adds screens the role writes to
3. Area › section › screen — shown in the menu
4. Selected / total screens

The role appears in the list in the "Kurumun rolleri" (Organization's roles) area, with the modules it writes to in the
**Kapsam (yazma)** (Scope — write) column. A role created from a template is not linked to the template; all of its
permissions can be changed. Details: [Create a role](https://erpdocs.corexlogic.com/en/yonetim/islemler/rol-olusturma).

## 2. Open the account

**Yönetim › Kullanıcı ve Roller › Kullanıcılar › Yeni Kullanıcı** (Administration › Users and Roles › Users › New User)

1. **Ad** (First name) `Demo`, **Soyad** (Last name) `Satış Temsilcisi`, **E-posta** (E-mail)
   `satis.temsilcisi@demo.corexlogic.com`.
2. **Davet e-postası gönder — kullanıcı şifresini kendisi belirlesin** (Send an invitation e-mail — let the user set
   their own password) (recommended).

![New User — User Information](https://erpdocs.corexlogic.com/en/en/img/screens/yonetim/yeni-kullanici.png)
1. Tabs — information, roles, org unit
2. E-mail — login ID, cannot be changed later
3. Invitation — single-use link valid for 3 days (recommended)
4. Administrator sets the password — account opens at once
5. Lock on failed attempts
6. Send Invitation — needs e-mail settings

3. On the **Roller** (Roles) tab, select **Demo — Satış Temsilcisi**.

![New User — Roles tab](https://erpdocs.corexlogic.com/en/en/img/screens/yonetim/yeni-kullanici-roller.png)
1. Roles — count of selected in brackets
2. Search role or area
3. Tick the role; several roles allowed

4. Click **Davet Gönder** (Send Invitation). The account is opened with the **Davet bekliyor** (Invitation pending)
   badge; the person sets a password with a link valid for 3 days. Details: [Invite a user](https://erpdocs.corexlogic.com/en/yonetim/islemler/kullanici-davet-etme).

> **Invitation in the demo environment**
The demo installation has no e-mail settings; **Davet Gönder** (Send Invitation) stopped with this message and the
account was not opened: "E-posta gönderimi yapılandırılmamış (Yönetim › Özelleştirme › Genel › E-posta Ayarları). Davet
bağlantısı gönderilemez; hesabı şifre belirleyerek açabilirsiniz." (E-mail sending is not configured (Administration ›
Customization › General › E-mail Settings). The invitation link cannot be sent; you can open the account by setting a
password.) The scenario continued with the second option: **Şifreyi ben belirleyeyim** (I will set the password) →
**Rastgele Üret** (Generate Random) → **İlk girişte şifre değiştirilmesi zorunlu olsun** (Require password change at
first sign-in) selected → **Hesabın açıldığını kullanıcıya e-postayla bildir** (Notify the user by e-mail that the
account was opened) cleared → **Oluştur** (Create). Notification: "Kullanıcı oluşturuldu: Demo Satış Temsilcisi" (User
created: Demo Satış Temsilcisi). Details: [Create a user with a password](https://erpdocs.corexlogic.com/en/yonetim/islemler/kullanici-sifreyle-olusturma).

![New User — administrator sets the password](https://erpdocs.corexlogic.com/en/en/img/screens/yonetim/yeni-kullanici-sifre.png)
1. Password — 8+ characters, a digit, a lowercase letter
2. Generate and Copy
3. Change password at first login
4. Notice e-mail — password is not included
5. Create

The account appears in the list in **Aktif** (Active) status, with the new role in the **Roller** (Roles) column:

![Users list](https://erpdocs.corexlogic.com/en/en/img/screens/yonetim/kullanicilar.png)
1. New User — opens an account by invitation or password
2. Search by name or e-mail
3. Role filter
4. Status: Active · Inactive (disabled) · Locked · All
5. Row: name, roles and account (e-mail)
6. Actions — edit, permissions, password, disable

## 3. Restrictions and extra permissions, if needed

Not needed for the sales representative. When needed, use the row's **İşlemler** (Actions) menu:

- **Organizasyon Kısıtlaması** (Organizational Restriction) — narrows a warehouse keeper to their own warehouse, or an
  operator to their own work center: [Grant an organizational restriction](https://erpdocs.corexlogic.com/en/yonetim/islemler/organizasyon-kisitlamasi-verme).
- **Ekstra Yetkiler** (Extra Permissions) — a permission outside the role for a single person (e.g. temporary quotation
  approval): [Grant an extra permission](https://erpdocs.corexlogic.com/en/yonetim/islemler/ekstra-yetki-verme).

![User row Actions menu](https://erpdocs.corexlogic.com/en/en/img/screens/yonetim/kullanici-islemler.png)
1. Name, phone, roles and org unit
2. Personal permissions on top of roles
3. Narrows rights to warehouses and work centers
4. Reset link or manual password
5. Disables the account — record is kept

## 4. First sign-in

On the sign-in screen, the user signs in with their e-mail and the password provided to them. Because the password was
set by the administrator, the application first opens the **Parolanızı değiştirin** (Change your password) screen:
"Güvenliğiniz için devam etmeden önce parolanızı değiştirmeniz gerekiyor." (For your security, you need to change your
password before continuing.) — **Mevcut parola** (Current password), **Yeni parola** (New password), **Yeni parola
(tekrar)** (New password, again) → **Parolamı Değiştir ve Devam Et** (Change My Password and Continue). The Home page
then opens; the person's role (**Demo — Satış Temsilcisi**) is shown below the greeting.

For an account opened by invitation, instead of this step the **Hesabınızı etkinleştirin** (Activate your account) page
from the e-mail link is used (full name and password → **Hesabımı Etkinleştir** — Activate My Account).

The sign-in and the password change leave a trace on the administrator side:

![Access Log](https://erpdocs.corexlogic.com/en/en/img/screens/yonetim/erisim-gunlugu.png)
1. Event filter — login, failed login, lock, logout
2. Search by user or e-mail
3. Event type
4. Source address

![Audit Log](https://erpdocs.corexlogic.com/en/en/img/screens/yonetim/islem-kayitlari.png)
1. User filter
2. Entity type — which record
3. Create · Update · Delete
4. Changed fields
5. Old and new value

## 5. Check the permissions

Verified in the demo environment by signing in as the new user:

| Check | What is seen |
|---|---|
| Top menu | **Satış, Stok Yönetimi, Lojistik Yönetimi, Üretim, Ana Veriler, Finans** (Sales, Inventory, Logistics, Production, Master Data, Finance). **Satın Alma, Servis, Bakım, Yönetim** (Purchasing, Service, Maintenance, Administration) are absent. |
| Satış › Sipariş Yönetimi › Satış Siparişleri (Sales › Order Management › Sales Orders) | **Yeni Sipariş** (New Order) is available. On a draft sales order, **Düzenle** (Edit), **Siparişi Onayla** (Approve Order) and **Siparişi İptal Et** (Cancel Order) are available. |
| Satış › Teklif Yönetimi › Satış Teklifleri (Sales › Quotation Management › Sales Quotations) | On a draft quotation: **Gönder** (Send), **Düzenle** (Edit), **İptal Et** (Cancel); on a sent quotation: **Siparişe Dönüştür** (Convert to Order), **Revize Et** (Revise), **Kaybedildi** (Lost). |
| Satış › Ana Veriler › Fiyat Listeleri (Sales › Master Data › Price Lists) | The list can be read; only **Dışa Aktar** (Export) is available — there is no new list button (no `erp-sales-price-lists.create`). |
| The address of the purchase order list | Not in the menu, but it opens via the address and can be read (read baseline); there is no **Yeni Sipariş** (New Order) button. |
| The `/users`, `/roles`, `/module-management` addresses | "Bu işlemi gerçekleştirmek için yetkiniz bulunmuyor." (You do not have permission to perform this operation.) · "Erişim gerekiyorsa sistem yöneticinizle iletişime geçin." (If you need access, contact your system administrator.) · **Ana Sayfa'ya dön** (Back to Home) |

If a user says they cannot see a button, check in this order:

1. Does their role (or their unit's role, or their extra permissions) have the permission for that operation? Find the
   button's source in the [Permission list](https://erpdocs.corexlogic.com/en/yonetim/izin-listesi) and check it on the role's **Yetkiler**
   (Permissions) tab.
2. Is the feature enabled in **Modül Yönetimi** (Module Management)? If it is disabled, the message is "Bu özellik
   kuruluşunuzda etkin değil." (This feature is not enabled in your organization.)
3. If the screen is not in the menu, is it in the role's **Ekranlar** (Screens) catalog?
4. Does the document's status allow the button? If a rule blocks it, the button is visible but disabled; hovering over
   it shows the reason.

## 6. Close the departing employee's account

**Yönetim › Kullanıcı ve Roller › Kullanıcılar** (Administration › Users and Roles › Users) — row **Demo Eski Çalışan** ›
**İşlemler** (Actions) › **Devre Dışı Bırak** (Deactivate) → **Devre dışı bırak** (Deactivate).

![Disable the account?](https://erpdocs.corexlogic.com/en/en/img/screens/yonetim/devre-disi-onay.png)
1. Login closes, open session ends; roles are kept

The account cannot sign in; an open session is dropped on the next request. The record is not deleted: its roles remain,
past documents continue to show the account, and pending invitation and password links become invalid. The account
appears under the **Durum: Pasif (devre dışı)** (Status: Inactive — deactivated) filter and, if necessary, can be
reopened together with its roles with **Geri Yükle** (Restore).

![Disabled accounts and Restore](https://erpdocs.corexlogic.com/en/en/img/screens/yonetim/kullanicilar-pasif.png)
1. Status: Inactive (disabled)
2. Disabled badge
3. Restore — reopens with its roles

Details: [Deactivate a user](https://erpdocs.corexlogic.com/en/yonetim/islemler/kullaniciyi-devre-disi-birakma).

## FAQ / Troubleshooting

| Message or situation | Cause | What to do |
|---|---|---|
| "E-posta gönderimi yapılandırılmamış (Yönetim › Özelleştirme › Genel › E-posta Ayarları). Davet bağlantısı gönderilemez; hesabı şifre belirleyerek açabilirsiniz." (E-mail sending is not configured … The invitation link cannot be sent; you can open the account by setting a password.) | There are no e-mail settings. | Have the e-mail settings configured, or open the account with **Şifreyi ben belirleyeyim** (I will set the password). |
| "Hesap açıldı ama davet e-postası gönderilemedi (…)" (The account was opened but the invitation e-mail could not be sent (…)) | The account was opened; the e-mail did not go out at that moment. | **İşlemler › Daveti Yeniden Gönder** (Actions › Resend Invitation). |
| "Bu davet geçersiz ya da süresi dolmuş." (This invitation is invalid or has expired.) | The link exceeded 3 days, was already used, or a newer one was sent. | **Daveti Yeniden Gönder** (Resend Invitation). |
| "Bu işlemi gerçekleştirmek için yetkiniz bulunmuyor." (You do not have permission to perform this operation.) | No permission (HTTP 403). | Add the permission to the user's role or assign a suitable role; the change takes effect immediately. |
| "Bu özellik kuruluşunuzda etkin değil." (This feature is not enabled in your organization.) | The role has the permission, but the feature is disabled. | Enable the feature in **Modül Yönetimi** (Module Management). |
| "Devam etmeden önce parolanızı değiştirmeniz gerekiyor — bu parolayı sizden başka biri de biliyor." (You need to change your password before continuing — someone other than you also knows this password.) | A password change is required at first sign-in. | The user completes the **Parolanızı değiştirin** (Change your password) screen. |
| "E-posta veya parola hatalı." (Incorrect e-mail or password.) | Wrong e-mail or password. | Check the description in **Erişim Günlüğü** (Access Log) (Hatalı parola (Wrong password) / Bilinmeyen e-posta (Unknown e-mail) / Hesap devre dışı (Account deactivated)). |
| "Hesap … başarısız giriş denemesi nedeniyle kilitlendi. …" (The account was locked due to … failed sign-in attempts. …) | 5 failed attempts, 15-minute lock. | Wait, or [Unlock the account](https://erpdocs.corexlogic.com/en/yonetim/islemler/kilit-kaldirma); if the password was forgotten, send a link. |
| "Çok fazla deneme yapıldı. 60 saniye sonra tekrar deneyin." (Too many attempts. Try again in 60 seconds.) | More than 10 sign-in attempts per minute from the same address. | Wait a minute and try again. |
| `'<depo kodu>' deposunda işlem yetkiniz yok.` (You do not have permission to operate in warehouse '&lt;warehouse code&gt;'.) | Organizational restriction. | Add the warehouse to the restriction, or leave the task to an authorized person. |
| An assigned approval role does not appear in the approval inbox | The approval role is read from the session's role names. | The user should refresh the page. |
| "Kendi hesabınızı devre dışı bırakamazsınız. Bunu başka bir yönetici yapmalı." (You cannot deactivate your own account. Another administrator must do this.) | You tried to close your own account. | Another administrator does it. |
| "… Yönetici rolünü taşıyan son etkin hesap. …" (… the last active account with the Administrator role. …) | The role is being removed from the last administrator. | First give the Administrator role to another user. |
| "Lisans en çok … etkin kullanıcıya izin veriyor; …" (The license allows at most … active users; …) | The license's user limit is reached. | Deactivate an unused account or extend the license. |

## Step-by-step tasks

- [1. Create a role](https://erpdocs.corexlogic.com/en/yonetim/islemler/rol-olusturma) — Role from a template, permissions and screens.
  - [2a. Invite a user](https://erpdocs.corexlogic.com/en/yonetim/islemler/kullanici-davet-etme) — Invitation by e-mail.
  - [2b. Create a user with a password](https://erpdocs.corexlogic.com/en/yonetim/islemler/kullanici-sifreyle-olusturma) — If there are no e-mail settings.
  - [3a. Organizational restriction](https://erpdocs.corexlogic.com/en/yonetim/islemler/organizasyon-kisitlamasi-verme) — Warehouse and work center.
  - [3b. Extra permission](https://erpdocs.corexlogic.com/en/yonetim/islemler/ekstra-yetki-verme) — A permission specific to one person.
  - [Change a role](https://erpdocs.corexlogic.com/en/yonetim/islemler/kullaniciya-rol-atama) — Role assignment when the job changes.
  - [Reset a password](https://erpdocs.corexlogic.com/en/yonetim/islemler/sifre-sifirlama) — Link or manual password.
  - [6. Deactivate](https://erpdocs.corexlogic.com/en/yonetim/islemler/kullaniciyi-devre-disi-birakma) — Departing employee.