Role-Based Access Control (RBAC)

Define a framework that governs actions within the platform based on organizational roles. Select default (buyer, manager, catalog admin) or set up custom user roles and assign permissions, such as rights to view, create, edit, cancel, approve, or delete. Users automatically inherit the permissions associated with their designated roles. Restrict permissions to resources, allowing granular control over access.

What the role-based access control feature delivers for your business: 

• Enhanced automated security: Users can only access and make changes to the elements of the system relevant to their job functions and responsibilities, minimizing the risks of errors, unauthorized access, or data breaches.

• Reduced management overhead: Centralized and efficient access management frameworks streamline updates and changes, simplifying and optimizing system administration.  

• Operational efficiency: Predefined permissions and access rights streamline the workflow, reduce confusion, errors, and unnecessary restrictions, ensuring users can work productively in a secure and well-structured work environment. 

Whether an account can sign in to the admin back office is a separate decision from what permissions that account has. An administrator sets the rule by account type or by specific permission, and any denial overrides an allowance.

It’s the answer to a question security reviewers ask often: can a partner integration or a customer’s own system call the API it needs without that account ever being able to open the admin panel. It can, and setting it up is a matter of configuration, not custom development.

Implementers can find the configuration details in Virto’s documentation.

An administrator can give someone full access to orders while making it impossible for them to see the money on those orders.

• One rule for every path: Price visibility is decided by a single service, not left as a side effect of authorization, so the rule reaches every way an order can be read or written: search, get by ID, save, patch, export, and import.
• Overridable by store, store type, or organization: The default is a single global permission, and an override restricts prices per store, per store type, or per organization instead of all-or-nothing.
• Built for the people who handle orders: Warehouse and third-party logistics staff who fulfill orders, outsourced customer service, and franchise or multi-brand structures where regional staff should not see another region’s economics.

The rule holds in exports and imports as well as on screen, which is where partial redaction usually leaks.

RBAC offers a powerful framework for managing access and permissions throughout the platform, and supports complex B2B environments with clear, transparent, and automated systems. Discover more about robust control and administration features in Virto Commerce by visiting our user guide.