The Challenge of Multi-Role Operations

Warehouse operations involve people with very different responsibilities and very different needs from a software system. A floor picker needs to see the next location to visit and confirm what was picked; they do not need to see the routing guide rules that determine which carrier a shipment travels on. A supervisor running the afternoon wave needs to create and release fulfilment runs; they do not need to modify the carton type library that controls how the cubing algorithm works. An operations manager configuring new carrier rates needs full administrative access; they should not accidentally trigger a pick confirmation while working in configuration screens.

Without role-based access control, the only safe option is to give everyone limited access — which blocks legitimate work — or give everyone full access — which creates risk. eWAVE's three-tier hierarchy solves this by giving each person exactly the access they need, and no more.

The Three-Tier Role Hierarchy

Each tier inherits all permissions from the tier below it. A Back Office User automatically has all Mobile User capabilities — they can scan on the floor and manage operations from the back office without needing two separate accounts. A Super User automatically has all Back Office and Mobile capabilities. This inheritance model keeps the permission structure simple and prevents the scenario where a promotion creates a gap in someone's operational capability.

Detailed Permission Matrix

Creating Users in eWAVE

1. Navigate to Settings → Users & Companies → Users Only Super Users can access this menu. You will see the list of all existing users in your company.
2. Click New to create a new user Enter the user's full name and email address. The email address becomes their login ID. It must be unique across the entire Odoo instance.
3. Assign the eWAVE role In the Access Rights section, find the eWAVE WMS heading. Select the appropriate role: Mobile User, Back Office User, or Super User. Only one eWAVE role should be assigned per user — the hierarchy handles inheritance automatically.
4. Set any additional Odoo application rights If the user also needs access to Odoo's accounting, purchasing, or sales modules, set those access rights in the same form. A warehouse user who also processes purchase orders in the same Odoo instance needs both eWAVE Back Office and Odoo Purchase User rights.
5. Save and send invitation email When you save a new user record, Odoo automatically sends an invitation email to their email address with a link to set their password. The user clicks the link, sets a password, and can log in immediately.
6. Verify access on the new account Log out and log back in as the new user (or ask them to confirm) that the correct menu items are visible and inaccessible menu items are hidden. The UI automatically adapts to show only what the user's role permits.

Multi-Company User Management

eWAVE fully supports Odoo's multi-company architecture. If your organisation operates multiple warehouses as separate legal entities, each company has its own user list, its own location hierarchy, and its own transaction records. A user assigned to Company A cannot see or interact with Company B's data unless explicitly granted access to Company B as well.

For users who manage multiple companies — a group operations manager, for example — they can be added to multiple companies with appropriate roles in each. When they log in, they see a company switcher in the top navigation bar. All transactions, wave records, and reports are always scoped to the currently active company, preventing accidental cross-company data entry.

Security Best Practices

• Principle of least privilege: assign the lowest role that allows the person to do their job. Upgrade to a higher role only when a specific task genuinely requires it.
• Shared accounts are prohibited: every user must have their own login. Shared accounts make the transaction audit trail useless — if two people share an account, there is no way to know who performed a specific action. Many regulatory frameworks (ISO, FDA, GS1) explicitly require individual user accounts for traceability.
• Deactivate leavers immediately: when an employee leaves, deactivate their account the same day. In eWAVE (Settings → Users), set the user's status to Archived. Their transaction history is preserved; their login is disabled. Do not delete users — this would create gaps in the audit trail.
• Password policy: enforce strong passwords through Odoo's password policy settings (minimum length, complexity requirements). For sensitive operations, consider enabling two-factor authentication (available in Odoo via the TOTP authenticator integration).
• Audit user actions: the transaction log records which user performed every significant action. Periodically reviewing this log — particularly for Super User account actions — is a good operational security practice and may be required for compliance audits.
• At least two Super Users: configure at least two Super User accounts so the system is never inaccessible if the primary admin is unavailable. The second Super User should ideally be a senior manager rather than another warehouse operator.

Mobile Interface: What Each Role Sees

When a user logs into eWAVE on a mobile device, the interface automatically adapts to their role. A Mobile User sees only the scanning workflows appropriate to their current task: receiving, putaway confirmation, pick execution, pack confirmation, or count entry. There are no administrative menus, no configuration screens, and no reports accessible from the mobile interface for this role — keeping the screen clean and focused on the task in hand.

A Back Office User who logs in on a mobile device gets the same mobile scanning capability as a Mobile User, with no additional menus on the mobile view. Their extra permissions become visible when they log in on a desktop browser, where the full back-office interface is available.