Roles, Permissions & Access Matrix
Complete role definitions, module-level access matrix for all 6 roles across 33 modules, sub-user management, and data isolation rules.
Last updated April 17, 2026
Role Definitions
| Role | Scope | Created By | Primary Use Case |
|---|---|---|---|
| Superadmin | Platform-wide | System | Platform operations, server management, multi-org oversight |
| Admin | Organization | Superadmin | Organization fleet management, user administration, billing |
| User | End-user | Admin | Vehicle monitoring, trip history, alerts, sub-user management |
| Driver | Mobile app | Admin | Mobile app access, own vehicle view, status updates |
| Sub User | Vehicle-scoped | User | Limited vehicle access under a parent user's account |
| Team | Scoped view | Admin | Shared vehicle and dashboard access within a team |
Module Access Matrix
The following table shows the access level for each of the 33 modules across all 6 user roles. Full = full access, View = read-only, Limited = restricted features, None = no access.
| Module | Superadmin | Admin | User | Driver | Sub User | Team |
|---|---|---|---|---|---|---|
| Dashboard | Full | Full | View | None | View | View |
| Maps | Full | Full | Full | Limited | Limited | View |
| Vehicles | Full | Full | View | Limited | Limited | View |
| Drivers | Full | Full | View | None | None | None |
| Users | Full | Full | None | None | None | None |
| Team | Full | Full | None | None | None | View |
| Inventory | Full | Full | None | None | None | None |
| Plans | Full | Full | None | None | None | None |
| Payments | Full | Full | View | None | None | None |
| Transactions | Full | Full | View | None | None | None |
| Landmarks Studio | Full | Full | View | None | None | View |
| Reports | Full | Full | View | None | Limited | View |
| Custom Reports | Full | Full | View | None | None | None |
| Notifications | Full | Full | View | Limited | None | None |
| Logs | Full | Full | View | None | None | None |
| Calendar | Full | Full | View | None | None | None |
| Support | Full | Full | Full | None | None | None |
| Route Optimization | Full | Full | Full | None | None | View |
| Share Track Link | Full | Full | Full | None | None | None |
| AI Agent | Full | Full | Limited | None | None | None |
| Settings | Full | Full | None | None | None | None |
| Accounts (Sub Users) | Full | Full | Full | None | None | None |
| Workflow | Full | Full | View | None | None | None |
| Administrators | Full | None | None | None | None | None |
| Server | Full | None | None | None | None | None |
| SSL | Full | None | None | None | None | None |
| Master Data | Full | None | None | None | None | None |
| Roles | Full | None | None | None | None | None |
| WhatsApp Templates | Full | Full | None | None | None | None |
| User Policy | Full | Full | None | None | None | None |
| Resources | Full | Full | View | None | None | None |
| Finance | Full | None | None | None | None | None |
Sub User Management
Sub Users are managed under User > Accounts > Sub Users tab. They provide vehicle-scoped access under a parent user account.
Sub User CRUD
| Field | Required | Description |
|---|---|---|
| Full Name | Yes | Sub user display name |
| Yes | Login email address | |
| Username | Yes | Unique login username |
| Password | Yes | Account password |
Vehicle Access
- Assign vehicles — select multiple vehicles from the parent user's fleet
- Unassign vehicles — remove vehicle access from the sub user
- Sub users can only see vehicles explicitly assigned to them
- Changes take effect immediately upon save
Sub User Detail
- Profile tab — view and edit sub user profile information
- Danger Zone — delete sub user account (confirmation required)
Data Isolation
OpenVTS enforces strict data isolation between organizations. Each Admin can only see their own organization's data. Users within an organization see only vehicles assigned to them. Sub Users see only explicitly assigned vehicles. Team members see vehicles shared within their team scope.
Vehicle Visibility Rules
| Role | Visible Vehicles | Rule |
|---|---|---|
| Superadmin | All vehicles across all organizations | Platform-wide access |
| Admin | All vehicles in their organization | Organization-scoped |
| User | Vehicles assigned as primary user | User-scoped assignment |
| Driver | Own assigned vehicle only | Single vehicle binding |
| Sub User | Explicitly assigned vehicles only | Parent user assigns access |
| Team | Vehicles shared within the team | Team-scoped sharing |