Permission-related problems are among the most common support requests. This article explains how to check your access level, what the common role boundaries actually are, and which account-level blocks look like permission errors but are not.
Checking Your Current Role
On a desktop screen, click your name or email address at the right-hand end of the top navigation bar to open your profile page. That link is hidden below large screens and no area's mobile menu repeats it, so on a phone open the address for your area directly:
- Consultants —
/consultant/profile - Corporate portal users —
/portal/profile - Private travellers —
/private/profile - Accountants —
/accounting/profile - Super admins working in the admin area —
/admin/profile - From anywhere else —
/profile
All six addresses show the same page. Your role appears next to your name in the page header, above the Profile, Security and Preferences tabs, written with underscores replaced by spaces (for example consultant, organization user, accountant). That role determines which modules you can open. If you belong to an organization, a second badge appears beside the role — be aware that it currently prints the organization's internal record identifier rather than its name, so quote it as-is when you report a problem instead of trying to interpret it.
What Access Denied Looks Like
Opening a page your role does not allow redirects you to a screen showing 403 — Access Denied with the text “You don't have permission to access this page.” Data you are not allowed to read usually appears as an empty list rather than an error, and a few pages show their own wording, such as “Access denied. Please ensure you have accounting permissions to view fixed assets.”
Common Permission Boundaries
- The accounting module is restricted to three roles — Accountant, Accountant Admin and Super Admin. Consultants and Consultant Admins are redirected to the Access Denied page, even though Consultant Admins can manage their own team.
- You cannot approve your own travel request — the approval is rejected with “Forbidden: You cannot approve your own travel request.” The rule is that the approver must not be the person who raised the request; Super Admins are exempt.
- Only Finance Managers approve journal entries — other roles get “Forbidden: Only Finance Managers can approve journal entries.” The same segregation-of-duties rule applies: you cannot approve an entry you created, unless you are a Super Admin or the entry was system-generated.
- Private Users have no organizational features — they can only manage their own searches, bookings, documents and profile.
Organization-Specific Access
Data is isolated by organization. You only see bookings, users and records belonging to your organization. If you have been moved to a different organization, or need access to another one, an administrator must update your assignment.
Blocks That Are Not Permission Errors
- Deactivated organization — if your organization is switched off, every page redirects to a screen titled Organization Inactive: “Your organization has been temporarily deactivated by an administrator.” No role change fixes this; the organization has to be reactivated.
- Account lockout — too many failed sign-ins lock the account for a while. The number of attempts, the window they are counted in and the length of the lock are settings a super administrator chooses, not fixed numbers. The login screen shows “Account is temporarily locked. Please try again in N minute(s).”, or “Account is temporarily locked. Please try again later.” when no wait is stated. See the Login Problems and Account Lockout article.
- Forced password change — if an administrator flagged your account, or your password has expired, you are sent to the change-password page before you can reach any module.
Requesting a Role Change
If you need access outside your current role, contact your administrator or raise a support ticket saying which page or action you need. An administrator changes the role directly in Admin > Users > User Management — there is no separate approval workflow, and the change is recorded in the audit trail.