How to Invite Users and Assign Roles in CrmLeaf

Overview

Every person who works in CrmLeaf is a user inside your Company. Every user is automatically given the base employee role, and can additionally carry one further role on top of it — admin, or any custom role your Administrator has created — which is what actually decides the extra access they get. Client is a separate kind of account, managed on its own screen rather than alongside employees and admins. The permission scope attached to a role decides which records its holder sees.

This article covers how application users (employees and administrators) are created, invited and managed from Settings → Manage User, how roles work, and how seats are limited by your plan. Client accounts are covered separately in How to Manage Clients and the Client Portal in CrmLeaf.

How It Works

A person becomes an application user either by being created directly with an account already active, or by being sent an invitation they accept themselves. Either way, they always end up with an employee record and the base employee role, plus whichever additional role was assigned.

Create or invite → Employee record is created → Base role + one additional role → Assign permission scope → Assign work

• Every application user holds the base employee role. On top of that, they can hold exactly one additional role — admin, or a custom role such as a "QA" or "Sales Manager" role your Administrator created. Roles are not three mutually exclusive buckets; they're a base role plus an optional elevated one.
• Custom roles are created and deleted from Settings → Roles & Permissions — an Administrator is not limited to the roles that ship by default.
• The admin role is capacity-limited: your plan caps how many users can hold it at once, separately from your overall user seat limit.
• Sign-in access and account status are two independent switches, not one. A user can be active but have sign-in disabled (no login credentials exist for them at all), or have sign-in enabled but be marked inactive. Only a user who is both active and sign-in enabled counts against your seat limit.
• Application users can be brought in two ways from Settings → Manage User: Create User, which creates the account immediately (with login access, status and the welcome email each set independently), or Invite User, which opens the same invitation flow used from HRMS → Employees — an email or link invitation the person accepts themselves, setting their own password. An accepted invitation always creates an employee record.
• Employees can also be brought in by CSV import, or an interactive import grid that validates each row before it is accepted.
• An employee record is paired one-to-one with a user account and holds reporting manager, designation, department, bank details, nominees, skills, documents and visas.
• A client is a real user account on its own screen, so clients can sign in to the client portal and see their invoices, estimates, proposals and contracts.
• Your plan's seat limit is enforced when a user becomes both active and sign-in enabled, so granting access can be refused if the account is at its limit — separately from the admin-seat cap above.
• Which modules a role can reach is driven by your package, and the ownership scope for each module is set per role.

Who Can Use This Feature?

Administrator

• Invite users and assign their role.
• Import employees in bulk and correct rows that fail validation.
• Set the ownership permission scope for each role and module.
• Monitor the account against its seat limit.

This functionality is available only to Administrators.

Prerequisites

• The company profile is complete.
• Designations and departments exist, if you are adding employees who need them.
• Seats are available under your plan's limit.
• You have decided the role and permission scope each person needs.

Roles: the Base Role and Custom Roles

Every application user holds the base employee role. On top of it, a user can hold exactly one additional role, which is what actually grants elevated access. Client is not part of this either/or — it's a separate account type with its own screen.

For Administrators

Step 1: Decide the role before you create or invite

What to do: Every person will automatically get the base employee role. Decide, on top of that, whether they also need admin (full access to settings and permissions — keep this to a small group, and remember it's capacity-limited by your plan) or a custom role you've already set up. Choose client instead, on its own screen, for customers who need portal access rather than application access.

What to verify: Each person on your list has exactly one intended additional role, or none.

Step 2: Create or invite the application user

Go to: Settings → Manage User

What to do: Use Create User to set the person up immediately — name, email and role, plus three independent switches: Login Access, Account Status, and whether to send a welcome email with their credentials. This always creates an employee record in the same step. Use Invite User instead to send an email or link invitation so the person accepts it and sets their own password — the same invitation flow also available from HRMS → Employees.

What to verify: The person appears in the Manage User list (or, for a pending invitation, on its Invitations tab), and — if you sent a welcome email or invitation — that it reached the address you entered.

Step 3: Complete the employee record

Go to: HRMS → Employees

What to do: Open the employee record created in Step 2 and complete reporting manager, designation and department.

What to verify: The employee record is complete and the person appears correctly in HRMS listings.

Step 4: Import several employees at once

What to do: Use Import for a CSV file, or use the interactive import grid, which validates row by row so you can correct problems before the records are created.

What to verify: The import reports no failed rows, and the expected number of employees appears in the list.

Step 5: Add a client user

Go to: CRM → Clients

What to do: Create the client record with its company profile and contacts. Because a client is a real user account, the client can sign in to the portal to view invoices, estimates, proposals and contracts. Client accounts do not appear in Manage User unless you switch on its "Show Client accounts" filter.

What to verify: The client can reach the portal, and sees only their own documents.

Step 6: Create a custom role, if the defaults aren't enough

Go to: Settings → Roles & Permissions

What to do: Create a custom role for any access pattern the default admin and employee roles don't cover — for example a "QA" or "Sales Manager" role. For each module, set the ownership scope the role should have — none, owned, added, both or all. This scope is what decides which records a user sees, not simply whether a page opens.

What to verify: Sign in as a test user carrying that role and confirm the record list contains what you expect and nothing more.

Step 7: Check your seat usage

What to do: Keep track of how many users your plan allows to be both active and sign-in enabled at once, and separately, how many can hold the admin role. Both limits are enforced at the point a user would newly consume a seat.

What to verify: You can still add the users you have planned. If not, review the plan before the rollout date.