ERPNext role permissions design
Designing roles for an ERPNext rollout: standard roles, Role Permissions Manager, role profiles for job functions, submit and cancel rights and avoiding System Manager sprawl.
ERPNext roles, permissions and access control
Controlling who sees and changes what in ERPNext: role and user permissions, field-level access, data masking, multi-company restrictions, two-factor authentication and login policies.
ERPNext user permissions by company, territory and branch
Restricting users to their own records in ERPNext: user permissions on link fields, applying them per DocType, hierarchy-based access for managers and common mistakes that hide data.
ERPNext field-level permissions with perm levels
Hiding or locking sensitive fields such as cost, margin or salary in ERPNext: assigning perm levels, matching role rows and testing what each role sees.
Masking sensitive data in ERPNext with Frappe data masking
Showing masked phone numbers, bank accounts or salaries to some roles while others see full values: data masking in version 16, its experimental status and how it differs from perm levels.
Enabling two-factor authentication in ERPNext
Turning on 2FA for ERPNext users: TOTP apps versus email or SMS codes, enforcing by role, the gap for website users and API logins, and recovery planning.
ERPNext password, session and login policies
Setting login security in ERPNext System Settings: session expiry, single session, login attempt limits and delays, password strength, forced resets and disabling password login with SSO.
Access control for multi-company ERPNext sites
Keeping entities apart on one ERPNext site: company user permissions, company restrictions on items, customers and suppliers, and reporting across companies for group finance.
Using ERPNext as an OAuth 2 provider for other apps
Letting internal apps and integrations authenticate against ERPNext with OAuth 2: registering OAuth clients, bearer tokens, scopes and when to use API keys instead.
Recovering ERPNext admin access after a lockout
Getting back in after removing your own System Manager role or losing the Administrator password: in-app recovery, bench commands and preventing it with a break-glass account.
Securing file uploads in ERPNext
Reducing risk from attachments in ERPNext: allowed file extensions, max file size, guest uploads, public versus private files, EXIF stripping and scanning outside Frappe.
