HomeHelpAdministrationRole Assignment

Role Assignment

What each of the eight roles can reach, why there is no role hierarchy, and how to change a user's role.

Super AdminLast reviewed 28 Oct 2026

Was this article helpful?

Related Articles

User Management

The Super Admin screen at Admin > Users > User Management: creating users, editing, password resets, deactivating versus archiving, and bulk activate/deactivate.

Organization Setup

Creating an organization with the five-step wizard, then where departments, sections, budget codes, locations and user types are configured.

Pricing Rules

Create and manage markup rules on the Pricing & Markup screen, and understand how the live calculation actually applies them.

Previous

User Management

Next

Organization Setup

Every TravelFlow user has exactly one role. The role decides which screens they can open: each screen carries a list of allowed roles and checks the user's role against that list. Understanding what each role can reach makes it easier to pick the right one.

The Eight User Roles

  1. Super Admin — The only role that can open the admin area: user management, bulk import, consultant permissions, organizations, departments, company settings, pricing, general settings, executive dashboard and the audit log. It is also listed as an allowed role on the consultant and accounting areas, so a Super Admin can reach those too.
  2. Organization Admin — Manages one organization from the portal: Administration > Admin Dashboard, User Management, Groups, Delegations, Exemptions, Security, Audit Logs, Analytics and Settings. Cannot open the Super Admin area.
  3. Organization User — A corporate employee. Submits travel requests, tracks approvals and views their own bookings and documents. No Administration menu.
  4. Consultant Admin — A travel agency administrator. Reaches the consultant area and manages the agency's consultants at Consultant > Consultant Management. Server-side they are granted every consultant permission regardless of permission profile.
  5. Consultant — A travel agent who creates bookings, quotations, invoices and vouchers. What they may do inside the consultant area depends on their permission profile and their per-consultant restrictions.
  6. Accountant Admin — The Finance Manager role. Alongside Super Admin, this is the only role for which the finance-manager check passes, so it is the role that can approve journal entries, approve credit notes, void transactions, close periods and write off bad debts.
  7. Accountant — Accounting staff. Enters transactions, creates invoices, journal entries and credit notes, records payments and runs reports, but cannot approve them.
  8. Both finance roles keep the books of the organisation they belong to. Placed with the agency, they also do the agency’s finance work: every booking, the supplier book, supplier payments, the cancellation queue (Accountant Admin) and the exchange rates. Placed with a client organisation, they see only that organisation’s own records.
  9. Private User — An individual traveller booking for themselves, with no organization attached.

There Is No Role Hierarchy

Roles do not inherit from one another. Access is an exact-match list: each screen declares the roles allowed to open it, and anything else is redirected to the Unauthorized page. A Consultant Admin does not automatically get what a Consultant gets, and an Accountant Admin does not automatically get what an Accountant gets — they get it only where the screen names their role explicitly. Super Admin reaches most modules for the same reason: it is written into those lists by name, not because it sits above the others.

The practical consequence is that a role change can take access away as well as add it. Before moving someone, check that the screens they use every day list the new role.

Changing a User's Role

  1. Go to Admin > Users > User Management (Super Admin only).
  2. Find the user and click the pencil Edit icon on their row.
  3. Open the Role & Access tab and pick the new role from the Role dropdown.
  4. If you chose Organization Admin or Organization User, select an Organization. This is required — saving without one returns Organization roles require an organizationId. If you chose Consultant or Consultant Admin, set a Permission Profile.
  5. Click Save Changes.

You cannot change your own role; attempting it returns Cannot change your own role. Moving a user out of the organization roles clears their organization and department, and moving them out of the consultant roles clears their permission profile.

The user must sign out and sign back in. Their role and permissions are read once when the browser session starts and are not re-read afterwards. Until they do a full sign-out and sign-in, they keep the old navigation and the old access. This is the most common reason a role change "did not work".

What Is Recorded

Saving the Edit User dialog writes an update entry to the audit trail against the user, with the description Updated user account: name (email). Note that the entry does not record which role the user moved from or to, so the audit log tells you that the account was edited and by whom, but not the specific role change. If you need that detail, record it yourself when you make the change.

Tip: If a consultant needs more or less capability but should stay a consultant, change their permission profile at Admin > Users > Consultant Permissions instead of changing their role.