---
description: >-
  Permissions reference for the Inyo Dashboard — every module and permission, what each unlocks in the UI, and how master users and access groups interact.
---

# Permissions Reference

Every capability in the Dashboard is gated by a permission belonging to a module. Access groups bundle these permissions; users get the union of their groups. This page is the reference for building groups in [Access Management](access-management.md).

***

### Permissions by Module

**Home**

| Permission | Unlocks |
| ---------- | ------- |
| View home dashboards | The [Home](home.md) KPI page |

**Payments**

| Permission | Unlocks |
| ---------- | ------- |
| View payment details | [Payments Search](payments/searching-payments.md), [Payment Details](payments/payment-details.md), and [Missing Refunds](payments/missing-refunds.md) |
| Capture transaction | **Capture Payment** / **Capture Partially** buttons |
| Void transaction | **Cancel Payment** button |
| Refund transaction | **Refund Payment** / **Refund Partially** buttons |
| View chargebacks | The [Disputes](payments/disputes.md) pages |
| Create chargeback event | Submitting Accept / Dispute / Arbitration responses |
| Download chargeback evidence | Downloading submitted evidence files |

**Reports**

| Permission | Unlocks |
| ---------- | ------- |
| Manage reports | All [Reports](reports/README.md) pages, including CSV downloads |

**Users Management**

| Permission | Unlocks |
| ---------- | ------- |
| Manage user access | [User search, create, block/enable, reset password](user-management.md); the Members tab |
| Delete user access | Deleting users |

**Access Management**

| Permission | Unlocks |
| ---------- | ------- |
| Manage access groups | The [Groups and Permissions tabs](access-management.md); creating and editing groups |
| Delete access groups | Deleting groups |

**Activity Logs**

| Permission | Unlocks |
| ---------- | ------- |
| View activity logs | [User Activity and User Login Activity](settings.md) |

***

### How Enforcement Works

* **UI and API both enforce.** Menus, pages, and buttons hide without the permission — and the underlying API rejects the call independently, so hiding is convenience, not the security boundary.
* **Per organization.** Permissions are evaluated against the active organization; switching organizations re-evaluates them.
* **Effective at sign-in.** Group changes apply the next time the user signs in.
* **Master users** (designated by Inyo) bypass all permission checks and see everything — reserve this for a small number of administrators.

***

### Suggested Starter Groups

| Group | Permissions |
| ----- | ----------- |
| **Viewer** | View home dashboards, View payment details |
| **Support** | Viewer + Refund transaction, View chargebacks |
| **Disputes** | View payment details, View chargebacks, Create chargeback event, Download chargeback evidence |
| **Finance** | View home dashboards, Manage reports |
| **Admin** | Manage user access, Delete user access, Manage access groups, Delete access groups, View activity logs |