brotherton-erpnext/erpnext/docs/user/manual/en/setting-up/users-and-permissions/user-permissions.md

User Permissions

Limit access for a User to a set of documents using User Permissions Manager

Role Base Permissions define the periphery of document types within which a user with a set of Roles can move around in. However, you can have an even finer control by defining User Permissions for a User. By setting specific documents in User Permissions list, you can limit access for that User to specific documents of a particular DocType, on the condition that "Apply User Permissions" is checked in Role Permissions Manager.

To start with, go to:

Setup > Permissions > User Permissions Manager

User Permissions Manager displaying how users can access only a specific Company.

Example

User 'aromn@example.com' has Sales User role and we want to limit the user to access records for only a specific Company 'Wind Power LLC'.

1. We add a User Permissions row for Company.

   

   Add User Permissions row for a combination of User 'aromn@example.com' and Company 'Wind Power LLC'.

</figure>

1. Also Role "All" has only Read permission for Company, with 'Apply User Permissions' checked.

   

   Read Permission with Apply User Permissions checked for DocType Company.

</figure>

1. The combined effect of the above two rules lead to User 'aromn@example.com' having only Read access to Company 'Wind Power LLC'.

   

   Access is limited to Company 'Wind Power LLC'.

</figure>

1. We want this User Permission on Company to get applied on other documents like Quotation, Sales Order, etc. These forms have a Link Field based on Company. As a result, User Permissions on Company also get applied on these documents, which leads to User 'aromn@example.com' to acces these documents having Company 'Wind Power LLC'.

   

   Users with Sales User Role can Read, Write, Create, Submit and Cancel Quotations based on their User Permissions, since 'Apply User Permissions' is checked.

</figure>
<figure>
	<img src="{{docs_base_url}}/assets/old_images/erpnext/user-permissions-quotation-list.png"
		class="img-responsive" alt="Quotation List limited to results for Company 'Wind Power LLC'">
	<figcaption>Quotation List is limited to results for Company 'Wind Power LLC' for User 'aromn@example.com'.</figcaption>
</figure>

1. User Permissions get applied automatically based on Link Fields, just like how it worked for Quotation. But, Lead Form has 4 Link fields: Territory, Company, Lead Owner and Next Contact By. Say, you want Leads to limit access to Users based only on Territory, even though you have defined User Permissions for DocTypes User, Territory and Company. You can do this by setting 'Ignore User Permissions' for Link fields: Company, Lead Owner and Next Contact By.

   

   Sales User can Read, Write and Create Leads limited by User Permissions.

</figure>
<figure>
	<img src="{{docs_base_url}}/assets/img/users-and-permissions/user-permissions-ignore-user-permissions.png"
		class="img-responsive" alt="Set Ingore User Permissions from Setup > Customize > Customize Form">
	<figcaption>Check 'Ingore User Permissions' for Company, Lead Owner and Next Contact By fields using Setup > Customize > Customize Form for Lead.</figcaption>
</figure>
<figure>
	<img src="{{docs_base_url}}/assets/old_images/erpnext/user-permissions-lead-based-on-territory.png"
		class="img-responsive" alt="Lead List is limited to records with Territory 'United States'">
	<figcaption>Due to the effect of the above combination, User 'aromn@example.com' can only access Leads with Territory 'United States'.</figcaption>
</figure>

{next}