Roles & Permissions
BillHive uses role-based access control (RBAC) to manage what each team member can see and do within your billing platform. Every user is assigned one or more roles, and each role grants access to a specific set of resources and actions.
Why Roles & Permissions Matter
As your billing operations scale, different teams need different levels of access:
- Finance needs to manage invoices and payments but shouldn’t modify product catalog
- Sales/CSM needs customer and subscription access but shouldn’t touch payment gateways
- Support needs read access to troubleshoot but shouldn’t create orders or change plans
- Product/Pricing needs catalog and rate plan control but shouldn’t access payment data
Without proper access control, you risk accidental changes, security exposure, and compliance violations. BillHive’s RBAC ensures every team member has exactly the access they need — nothing more, nothing less.
How It Works
BillHive’s authorization system is built on three layers:
User → Role(s) → Permissions → Resources & Scopes- Users are assigned one or more Roles (e.g., Administrator, Finance Manager)
- Each Role maps to a Policy in the authorization engine
- Permissions link policies to Resources (e.g., Invoice, Subscription, Product)
- Each resource has Scopes — the specific actions allowed (e.g.,
find,create,deleteById)
When a user makes an API call, the system evaluates:
- Does the user have a role?
- Does that role’s policy grant access to the requested resource?
- If yes, the request is allowed. If no role matches, the request is denied with
403 Forbidden.
Available Roles
BillHive ships with six predefined roles designed for common billing team structures:
| Role | Purpose | Typical Team |
|---|---|---|
| Owner | Full organizational control across all modules | Founders, C-suite |
| Administrator | Full platform access for day-to-day management | Engineering leads, Ops managers |
| Customer Success Manager | Customer-facing operations and retention | CSM team, Account managers |
| Finance Manager | Billing, invoicing, payments, and financial reporting | Finance team, Controllers |
| Pricing Strategist | Product catalog, rate plans, and pricing configuration | Product managers, Pricing analysts |
| Support Agent | Read-heavy access for customer troubleshooting | Support team, L1/L2 agents |
Owner and Administrator have identical access — full control over all 19 protected resources. The remaining four roles are scoped to their functional domain.
Decision Strategy
When a permission is linked to multiple role policies (e.g., FullInvoicePermission is accessible by Owner, Administrator, Finance Manager, and Support Agent), BillHive uses an Affirmative decision strategy — if any one of the user’s roles grants access, the request is allowed.
This means a user with the Finance Manager role can access invoices even though they don’t have the Owner or Administrator role.
Related Topics
- Roles — Detailed breakdown of each role and its intended use
- Permission Matrix — Full resource-by-role access matrix
- Managing Roles — How to assign and manage roles for users