← Hub — NetSuite Roles & Permissions
v10.0
NetSuite — Access Control
NetSuite Roles & Permissions
Complete role-based access control matrix for Global Food Solutions' NetSuite environment. 12 roles, 40+ record types, field-level restrictions, dashboard assignments, and suitelet access controls.
12
Roles
40+
Record Types
4
Key Forms
8
Suitelets
02 Role Definitions 12 GFS roles — description, functions, restrictions, approval authority
A
Administrator
ROLE_ID: 3 · customrole_gfs_admin
Unrestricted system access. Manages configuration, customizations, integrations, user provisioning, and all record types. Reserved for IT personnel and system administrators.
Primary Functions
  • Full CRUD on all record types and transactions
  • System configuration (preferences, accounting periods, tax)
  • SuiteScript deployment and management
  • Custom record/field/form creation
  • User provisioning and role assignment
  • Integration management (TBA, RESTlets, SOAP)
  • Scheduled script monitoring and error logs
Restricted Areas
  • None — full access to all areas
Approval Authority: Unlimited — all transactions, all amounts, all record deletions
CE
CEO / Executive
ROLE_ID: 1020 · customrole_gfs_exec
Read access across all modules with approval authority for high-value transactions. Dashboard-centric role designed for strategic oversight, financial review, and exception approvals.
Primary Functions
  • Read all financial reports (P&L, Balance Sheet, Cash Flow)
  • Approve purchase orders above $50,000
  • Approve vendor bills above $25,000
  • Review sales pipeline and revenue dashboards
  • View all customer and vendor records
  • Access executive KPI dashboards
  • Review audit trail and compliance reports
Restricted Areas
  • System configuration and customization
  • User management and role assignment
  • Script deployment and editing
  • Record type creation or deletion
Approval Authority: PO > $50K, Vendor Bills > $25K, Journal Entries > $100K, Credit Memos > $10K
SM
Sales Manager
ROLE_ID: 1021 · customrole_gfs_sales_mgr
Full access to the sales cycle: customer records, sales orders, estimates, quotes, and reporting. Manages all reps' pipelines, pricing overrides, and commission structures.
Primary Functions
  • Create/edit/approve all Sales Orders
  • Full CRUD on Customer records
  • Create and manage Estimates and Quotes
  • Pricing overrides and discount approvals
  • Sales pipeline and forecast reports
  • Commission reports and rep performance
  • Customer credit limit review
Restricted Areas
  • Vendor records and purchase orders
  • Journal entries and financial adjustments
  • System configuration
  • Payroll and HR records
Approval Authority: SO any amount, Discounts up to 15%, Credit Memos ≤ $5K, Return Authorizations
SR
Sales Rep
ROLE_ID: 1022 · customrole_gfs_sales_rep
Restricted to own customer accounts and sales orders. Can create new SOs and estimates but cannot approve discounts beyond standard pricing. Limited reporting to own territory.
Primary Functions
  • Create Sales Orders for own customers
  • View and edit own Customer records
  • Create Estimates and Quotes (own territory)
  • View own pipeline and commission reports
  • Log activities and calls on customer records
  • View inventory availability (read-only)
Restricted Areas
  • Other reps' customers and SOs
  • Pricing overrides and discount approvals
  • All financial transactions (AP, AR, JE)
  • Vendor records and procurement
  • Inventory adjustments
  • System configuration
Approval Authority: None — all SOs require Sales Manager approval for discounts > 5%
PM
Purchasing Manager
ROLE_ID: 1023 · customrole_gfs_purch_mgr
Full procurement authority: vendor management, purchase orders, receiving, and spend analytics. Manages commodity contracts, vendor scorecards, and replenishment strategies.
Primary Functions
  • Create/edit/approve Purchase Orders
  • Full CRUD on Vendor records
  • Item Receipt processing and receiving
  • Vendor bill matching and approval
  • Spend analysis and commodity reports
  • Blanket PO and contract management
  • Vendor performance scoring
Restricted Areas
  • Sales orders and customer records
  • Journal entries (create/edit)
  • Payroll and HR records
  • System configuration
Approval Authority: PO ≤ $50K, Vendor Bills ≤ $25K, Vendor credit applications
WM
Warehouse Manager
ROLE_ID: 1024 · customrole_gfs_wh_mgr
Manages all warehouse operations: inventory control, receiving, shipping, bin management, transfer orders, and work orders. Oversees cycle counts and shrinkage reporting.
Primary Functions
  • Inventory adjustments and transfers
  • Item Receipt and Item Fulfillment records
  • Bin management and putaway optimization
  • Transfer Orders between locations
  • Work Order creation and completion
  • Cycle count scheduling and execution
  • Shipping label generation and BOL
Restricted Areas
  • Financial transactions (AP, AR, JE)
  • Customer and vendor record creation
  • Sales orders (view-only)
  • Pricing and cost fields
  • System configuration
Approval Authority: Inventory adjustments ≤ $10K, Transfer Orders, Work Order completions
WO
Warehouse Operator
ROLE_ID: 1025 · customrole_gfs_wh_op
Hands-on warehouse role: pick, pack, ship, cycle count, and bin transfer. Limited record access scoped to daily operational tasks. No financial visibility.
Primary Functions
  • Pick/pack/ship item fulfillments
  • Cycle count entry (assigned counts only)
  • Bin-to-bin transfer execution
  • Scan-to-receive (item receipts, limited)
  • View pick tickets and packing slips
  • Print shipping labels
Restricted Areas
  • Inventory adjustments (create/edit)
  • All financial transactions
  • Customer and vendor records
  • Sales orders and purchase orders
  • Cost and pricing fields
  • Reporting beyond operational views
  • System configuration
Approval Authority: None — all adjustments require Warehouse Manager approval
FC
Finance / Controller
ROLE_ID: 1026 · customrole_gfs_finance
Full financial authority: AP, AR, general ledger, journal entries, financial statements, and period close. Primary approver for high-value transactions and budget variances.
Primary Functions
  • Journal Entries (create, edit, approve, reverse)
  • Accounts Payable (vendor bills, payments, credits)
  • Accounts Receivable (invoices, customer payments)
  • Financial reports (P&L, BS, CF, TB)
  • Accounting period open/close
  • Bank reconciliation and deposits
  • Budget management and variance analysis
Restricted Areas
  • System configuration and customization
  • SuiteScript deployment
  • User management
Approval Authority: JE ≤ $100K, Vendor Bills ≤ $25K, Credit Memos any amount, Period close
AP
AP Clerk
ROLE_ID: 1027 · customrole_gfs_ap
Focused AP processing: vendor bill entry, PO matching, payment preparation, and vendor communication. No approval authority; all payments require Finance/Controller sign-off.
Primary Functions
  • Vendor Bill entry and 3-way matching
  • Payment batch preparation
  • Vendor credit application
  • View vendor records (read-only)
  • AP Aging report (own entries)
  • Expense report processing
Restricted Areas
  • Payment approval and execution
  • Journal entries
  • Sales transactions
  • Inventory records
  • Customer records
  • Financial reports (beyond AP aging)
  • System configuration
Approval Authority: None — all bills and payments require Finance/Controller approval
AR
AR Clerk
ROLE_ID: 1028 · customrole_gfs_ar
Focused AR processing: invoice generation, customer payment application, collections follow-up, and aging analysis. Cannot issue credit memos without Finance approval.
Primary Functions
  • Invoice creation from fulfilled SOs
  • Customer payment application
  • AR Aging report and collections tracking
  • Statement generation and distribution
  • View customer records (read-only)
  • Deposit preparation
Restricted Areas
  • Credit memo creation (requires approval)
  • Customer record editing
  • Sales orders and estimates
  • Vendor records and AP transactions
  • Journal entries
  • Inventory records
  • System configuration
Approval Authority: None — credit memos and write-offs require Finance/Controller approval
QM
Quality Manager
ROLE_ID: 1029 · customrole_gfs_quality
Manages compliance records, temperature logs, hold/release decisions, lot traceability, and audit preparation. Critical for FSMA, SQF, and USDA compliance across Edgewood NY and Hermitage PA facilities.
Primary Functions
  • Quality inspection records (CRUD)
  • Temperature log review and sign-off
  • Hold/Release decisions on inventory lots
  • Lot trace and recall simulation
  • Audit record management (SQF, USDA, FDA)
  • Non-conformance reports and CAPA tracking
  • Vendor qualification record management
Restricted Areas
  • Financial transactions (all)
  • Sales orders and customer records
  • Purchase order creation
  • Pricing and cost fields
  • System configuration
Approval Authority: Lot hold/release, Quality inspection sign-off, Vendor qualification status
DR
Driver
ROLE_ID: 1030 · customrole_gfs_driver
Mobile-only role for delivery drivers. Extremely limited scope: delivery confirmation, route view, and temperature log entry. No desktop access; all interactions via mobile Suitelet or companion app.
Primary Functions
  • Delivery confirmation (signature capture)
  • Route view (assigned deliveries only)
  • Temperature log entry (reefer unit readings)
  • POD photo upload
  • Exception reporting (refused, damaged, short)
Restricted Areas
  • All desktop NetSuite access
  • Financial transactions of any kind
  • Customer records (beyond delivery address)
  • Vendor records
  • Inventory adjustments
  • All reporting
  • System configuration
Approval Authority: None — delivery exceptions reviewed by Warehouse Manager
■ 12 roles cover all GFS operational functions. Role IDs are stable; do not reassign.
03 Permission Matrix Record types vs. roles — CRUD access levels, color-coded
CRUD
Full Access
CRU
Limited (no Delete)
Own
Own Records Only
R
Read Only
—
No Access
Record Type Admin CEO Sales Mgr Sales Rep Purch Mgr WH Mgr WH Op Finance AP Clerk AR Clerk Quality Driver
Sales Transactions
Sales Order CRUD R CRUD Own — R — R — R — —
Estimate / Quote CRUD R CRUD Own — — — R — — — —
Return Authorization CRUD R CRU R — CRU — R — R R —
Item Fulfillment CRUD R R R — CRUD CRU R — — — R
Purchasing Transactions
Purchase Order CRUD R — — CRUD R — R R — — —
Item Receipt CRUD R — — CRUD CRUD CRU R — — R —
Vendor Bill CRUD R — — CRU — — CRUD CRU — — —
Vendor Payment CRUD R — — R — — CRUD R — — —
Vendor Credit CRUD R — — CRU — — CRUD CRU — — —
Financial Transactions
Invoice CRUD R R R — — — CRUD — CRU — —
Customer Payment CRUD R — — — — — CRUD — CRU — —
Credit Memo CRUD R CRU — — — — CRUD — R — —
Journal Entry CRUD R — — — — — CRUD — — — —
Deposit CRUD R — — — — — CRUD — CRU — —
Expense Report CRUD R Own Own Own Own — CRUD CRU — Own —
Entity Records
Customer CRUD R CRUD Own — — — R — R — —
Vendor CRUD R — — CRUD — — R R — R —
Employee CRUD R R — R R — CRU — — — —
Contact CRUD R CRUD Own CRUD — — R — — R —
Inventory & Items
Item Record CRUD R R R CRU R R R — — R —
Inventory Adjustment CRUD R — — R CRUD — R — — R —
Transfer Order CRUD R — — CRU CRUD R R — — — —
Work Order CRUD R — — R CRUD R R — — R —
Bin Transfer CRUD — — — — CRUD CRU — — — — —
Cycle Count CRUD — — — — CRUD CRU R — — — —
Quality & Compliance
Quality Inspection CRUD R — — R R — — — — CRUD —
Temperature Log CRUD R — — — R — — — — CRUD CRU
Hold/Release Record CRUD R — — R R — — — — CRUD —
Audit Record CRUD R — — — — — R — — CRUD —
CAPA Record CRUD R — — — — — — — — CRUD —
Reporting & Analytics
Financial Reports CRUD R — — — — — CRUD R R — —
Sales Reports CRUD R CRUD Own — — — R — — — —
Inventory Reports CRUD R R — R CRUD R R — — R —
Procurement Reports CRUD R — — CRUD — — R R — — —
Quality Reports CRUD R — — — R — — — — CRUD —
Saved Searches CRUD R CRU Own CRU CRU — CRUD Own Own CRU —
System & Configuration
Custom Records CRUD R R — R R — R — — CRU —
SuiteScripts CRUD — — — — — — — — — — —
User / Role Mgmt CRUD — — — — — — — — — — —
Integrations (TBA) CRUD — — — — — — — — — — —
■ Matrix covers 40+ record types across 12 roles. Scroll horizontally on smaller screens. "Own" = restricted to records where user is the owner/sales rep.
04 Form Restrictions Field-level visibility per role on key transaction forms
Sales Order Form — Field Visibility by Role
Field Admin CEO Sales Mgr Sales Rep Finance WH Mgr AR Clerk
CustomerEditViewEditEditViewViewView
Item LinesEditViewEditEditViewViewHidden
Unit PriceEditViewEditViewViewHiddenHidden
Discount %EditViewEditViewViewHiddenHidden
Cost (COGS)EditViewHiddenHiddenEditHiddenHidden
Margin %ViewViewViewHiddenViewHiddenHidden
Ship To AddressEditViewEditEditViewEditView
Department (Brand)EditViewEditEditViewHiddenHidden
Credit TermsEditViewViewViewEditHiddenView
Approval StatusEditEditEditViewViewViewView
Purchase Order Form — Field Visibility by Role
Field Admin CEO Purch Mgr Finance WH Mgr AP Clerk
VendorEditViewEditViewViewView
Item LinesEditViewEditViewViewView
Unit RateEditViewEditViewHiddenView
Department (Brand)EditViewEditViewHiddenHidden
Expected Receipt DateEditViewEditViewViewView
LocationEditViewEditViewEditView
Commodity CodeEditViewEditHiddenHiddenHidden
Approval StatusEditEditEditViewViewView
Invoice Form — Field Visibility by Role
Field Admin CEO Finance AR Clerk Sales Mgr
CustomerEditViewEditViewView
Invoice LinesEditViewEditViewView
Amount DueEditViewEditViewView
Due DateEditViewEditEditView
Payment TermsEditViewEditViewView
GL AccountEditViewEditHiddenHidden
Posting PeriodEditViewEditHiddenHidden
Item Record Form — Field Visibility by Role
Field Admin Purch Mgr Sales Mgr WH Mgr Quality Finance
Item Name / SKUEditEditViewViewViewView
DescriptionEditEditViewViewViewView
Base PriceEditEditViewHiddenHiddenView
CostEditEditHiddenHiddenHiddenView
Preferred VendorEditEditHiddenViewViewHidden
Lot / Expiry TrackingEditViewHiddenEditEditHidden
Bin LocationsEditHiddenHiddenEditHiddenHidden
GL Accounts (COGS/Asset)EditHiddenHiddenHiddenHiddenEdit
■ Form restrictions enforced via custom entry forms assigned per role. Edit = editable, View = read-only visible, Hidden = field not rendered.
05 Dashboard Restrictions Home screen portlets assigned per role
Administrator
System Alerts & Script Errors
Scheduled Script Status
Integration Monitor (TBA / RESTlet)
User Login Activity
Customization Change Log
SuiteAnalytics Connect Status
CEO / Executive
Revenue Trend (Weekly / Monthly)
P&L Summary
Cash Position
Top 10 Customers by Revenue
Pending High-Value Approvals
Open AR Aging Summary
Sales Manager
Pipeline Summary & Stage Distribution
Revenue by Rep (Current Month)
Open Sales Orders Awaiting Fulfillment
Customer Activity Feed
Win/Loss Ratio (Rolling 90 Days)
Commission Tracker
Sales Rep
My Open Sales Orders
My Pipeline (Own Opportunities)
My Commission YTD
Recent Customer Activity
Inventory Availability (Read-Only)
Purchasing Manager
Open POs by Vendor
PO Aging & Overdue Deliveries
Spend by Category (MTD)
Commodity Price Tracker
Vendor Performance Scorecard
Pending Vendor Bill Approvals
Warehouse Manager
Open Orders Awaiting Pick
Inbound Receipts Expected Today
Inventory Levels by Location
Cycle Count Schedule
Transfer Orders in Transit
Work Order Status
Warehouse Operator
My Pick Queue (Assigned Tasks)
My Assigned Cycle Counts
Shipping Labels Queue
Finance / Controller
P&L (Monthly / YTD)
Bank Reconciliation Status
AP Aging Summary
AR Aging Summary
Open Journal Entries for Review
Budget vs. Actual Variance
Period Close Checklist
AP Clerk
My Pending Vendor Bills
3-Way Match Queue
Payment Batch Status
AP Aging (My Entries)
AR Clerk
Open Invoices by Due Date
Unapplied Customer Payments
Collections Worklist
AR Aging by Customer
Quality Manager
Open Inspections (Pending Sign-Off)
Lots on Hold
Temperature Alert Log
Open CAPA Items
Upcoming Audit Schedule
Expiry Forecast (30/60/90 Days)
Driver (Mobile Only)
Today's Route & Delivery Queue
Temperature Log Entry
Exception Report
■ Dashboards configured via Setup > Publishing > Dashboard Publishing. Each role sees only assigned portlets.
06 Suitelet Access Custom suitelet access by role
Suitelet Script ID Admin CEO Sales Mgr Sales Rep Purch Mgr WH Mgr WH Op Finance Quality Driver
GFS Quote Builder customscript_gfs_quote Yes — Yes Yes — — — — — —
Pricing Dashboard customscript_gfs_pricing Yes Yes Yes — Yes — — Yes — —
Inventory Portal customscript_gfs_inv_portal Yes Yes Yes Yes Yes Yes Yes — Yes —
Receiving Suitelet customscript_gfs_receiving Yes — — — Yes Yes Yes — Yes —
Driver Delivery App customscript_gfs_driver Yes — — — — Yes — — — Yes
Quality Inspection customscript_gfs_quality Yes — — — — Yes — — Yes —
Lot Trace & Recall customscript_gfs_lot_trace Yes Yes — — — Yes — — Yes —
Financial Close Checklist customscript_gfs_close Yes — — — — — — Yes — —
■ Suitelet access controlled via script deployment audience. AP Clerk and AR Clerk use standard NS screens, not custom suitelets.
07 Role Setup Guide Step-by-step for creating, assigning, testing, and deploying a new role
1
Plan the Role
Document the role's purpose, target users, required record types, and permission levels. Reference this page's permission matrix to determine baseline access. Identify which existing role is the closest match for cloning.
Deliverable: Role specification document listing all record types, permission levels, form assignments, and dashboard portlets.
2
Create the Role in NetSuite
Navigate to the role creation screen. Clone the nearest existing GFS role to inherit base permissions, then modify as needed. Set the role name using the GFS naming convention.
Setup > Users/Roles > Manage Roles > New (or clone existing)
3
Configure Permissions
Set permissions across all tabs: Transactions, Reports, Lists, Setup, and Custom Record. Use the principle of least privilege. For each record type, explicitly set Create, Read, Edit, Delete, or None.
Role Record > Permissions tab > Transactions / Reports / Lists / Setup sub-tabs
Never grant "Full" on Setup permissions unless the role is Administrator. This exposes system configuration.
4
Assign Custom Forms
Create or assign role-specific entry forms that hide sensitive fields (cost, margin, GL accounts). Verify each form shows only the fields documented in Section 04 for this role.
Customization > Forms > Entry Forms > [Form Name] > Roles sub-tab
5
Configure Dashboard
Publish the role's dashboard with only the assigned portlets from Section 05. Remove all default portlets that expose data outside the role's scope. Test the dashboard view as the role.
Setup > Publishing > Dashboard Publishing > [Select Role]
6
Set Suitelet Audience
For each custom suitelet, update the deployment audience to include or exclude the new role. Reference Section 06 for the access matrix.
Customization > Scripting > Script Deployments > [Suitelet] > Audience tab
7
Test the Role
Create a test user and assign only the new role. Log in as the test user and verify: (a) correct records are accessible, (b) restricted records return "Permission Violation", (c) form fields match Section 04, (d) dashboard shows correct portlets, (e) suitelets are accessible or blocked as expected.
Setup > Users/Roles > Manage Users > [Test User] > Access tab > Assign role
Test with production data in Sandbox first. Never deploy a new role directly to production without sandbox validation.
8
Document and Deploy
Update this design system page with the new role. Add the role to the permission matrix, form restrictions, dashboard assignments, and suitelet access tables. Deploy to production via SDF or manual configuration.
Deploy via SDF bundle or manual replication from Sandbox > Production.
9
Ongoing Audit
Review all role assignments quarterly. Check for permission creep (users accumulating roles over time). Verify terminated employees have all roles removed. Run the "User Roles and Permissions" saved search monthly.
Reports > Saved Searches > customsearch_gfs_role_audit
■ All role changes must be tested in Sandbox before production deployment. Document every role modification in the change log.
← Back to Hub · GFS Design System v10.0 · Global Food Solutions, Inc. · 131 Heartland Blvd, Edgewood, NY 11717