Is it possible to have a role attached to a company

Frappe Framework
1

Hello,

in a similar solution than erpnext, we need to have several companies ( called Context in our use case) and let user have a different role per company.
I understand the feature User Permissions but it seems it won’t cover our use case. A simple example:

  • the user A has read/write access to clients defined for Company A
  • the user A has only read access to clients defined for Company B
  • the user A has no access at all to clients defined for Company C

It seems that the user permissions can “only” filter the record based on a column value but can’t change the access mode depending on this column ( ie read/write). The global requirement would be to have role linked to a company.
Is it correct ?

1 Like
2

Yes, you’ve understood it correctly.

Frappe’s permission system has two separate layers, and neither does what you want on its own:

Role Permissions define the access mode (read, write, create, delete, submit…) per role and doctype. These are global, they’re never tied to a field value like Company.

User Permissions restrict which records a user can see based on a link field (e.g. Company). But they’re just allow/deny per record, the access mode stays whatever the role grants. There’s no way to say “write for Company A, read-only for Company B” through User Permissions.

So no, there’s no native “role per company” concept, roles are global.

So you have two realistic options:

  1. Custom solution that combines both layers: give the role write access as a baseline, then add server-side hooks driven by a small mapping table of user → company → mode. This keeps everything in one site.
  2. One site per company + Single Sign-On. Each company is fully isolated, and you assign the user a different role on each site. Simpler permission-wise, but the companies are completely separated (no shared data, cross-company reporting, etc.).

Which fits depends on whether you need the companies to share data or stay isolated.

2 Likes
3

Thanks !
We have finally developed a custom solution based on server-side hooks.

1 Like
4

This would be a valuable feature for the Frappe ecosystem. Many organizations using multi-company setups need users to have different roles depending on the selected company—for example, a user could be an Accounts Manager in Company A but only a Viewer in Company B.

If you’ve already built a working solution, would you consider open-sourcing it as a Frappe app or sharing the implementation? I think many ERPNext users would benefit from it, and it could even evolve into a community-maintained project. I’d be happy to try it out and provide feedback.

5

unfortunately no “reusable” working solution on our side.
We create a dedicated Doctype (UserCompany) to let Admin assign users to a Company, give them read/write access to some Activity Type. Then we create server-side hook using this new doctype.

I don’t believe we can have a out of box solution from Frappe as it’s very custom.

6

Hi @cherrycharan

I think this can be achieved with permission hooks: -

2 Likes