The permission matrix is the system of 13 capabilities that define what a staff role can do. When you create or edit a custom role, you select which capabilities to grant.
Admin-Side Feature
The 13 Capabilities #
Customer Capabilities #
| Capability | What it Allows |
|---|---|
dmsi_view_customers | View the customer list and customer detail pages |
dmsi_manage_customers | Edit customer records, assign staff members |
dmsi_delete_customers | Delete customer records |
Product Capabilities #
| Capability | What it Allows |
|---|---|
dmsi_view_products | View products and their configuration |
dmsi_manage_products | Create and edit products, configure licensing settings |
dmsi_delete_products | Delete products |
License Capabilities #
| Capability | What it Allows |
|---|---|
dmsi_view_licenses | View the license list and license details |
dmsi_manage_licenses | Create, edit, extend, suspend, and activate licenses |
dmsi_delete_licenses | Delete license records |
Analytics and Billing #
| Capability | What it Allows |
|---|---|
dmsi_view_analytics | View dashboard reports and analytics |
dmsi_manage_billing | Access subscription and billing management |
Team Administration #
| Capability | What it Allows |
|---|---|
dmsi_manage_admin_team | Add, edit, and remove staff team members |
dmsi_manage_roles | Create, edit, and delete custom staff roles |
Capability Implications #
The permission system uses an implication chain so you do not need to check multiple boxes for related permissions:
- Granting delete automatically implies manage (you can’t delete something you can’t manage)
- Granting manage automatically implies view (you can’t manage something you can’t see)
What this means in practice:
If you check dmsi_delete_customers for a role, that role automatically also gets dmsi_manage_customers and dmsi_view_customers. You do not need to check those separately.
In the UI, when you check a delete capability, the corresponding manage and view checkboxes will show as implied. The implications are resolved at permission check time, not at role creation time, so the stored data reflects only explicitly granted permissions.