User Accounts and Access Control (RBAC) in Aerish

This guide is for admins who decide who can sign in to Aerish and which menus they can open. You will learn how to create and import accounts, set roles and permissions, and review profile change requests.

Before you start

• The Users & Access menu group is visible only to Superadmin and Admin.
• Accounts needs the Lihat Pengguna (view users) permission; Access Control needs Lihat Hak Akses (view access rights).
• Profile Change Requests appears only when this feature is in your school's subscription.

Default roles

Every new school gets the following roles (groups). You can change each role's permissions in Access Control.

Role	Typical use
Superadmin	Full access. The account that registers the school becomes Superadmin automatically.
Admin	All permissions by default; manages data and users.
Pengguna	Students. Opens the /user portal and the Aerish app. Guardians use the student's account.
Guru	Teachers: schedules, class attendance, grades, Qur'an memorization, plus their own leave and point requests.
Pengajaran, Staf Pengajaran	Academic management, learning, and assessment.
Pengasuhan, Staf Pengasuhan	Student affairs and student care.
Bendahara, Staf Bendahara	Finance. Staf Bendahara focuses on bills, payments, and wallets.
HR, Staf HR, Kepala Sekolah	HR and staffing menus.
Partner	External partners. Can open POS menus and some Finance menus, depending on the permissions you grant.
Alumni	A marker for alumni. This group on its own does not open a web portal.

There is no built-in parent or canteen role. Parents use the student's account, the homeroom teacher is set on the Class record, and POS cashiers use a Kasir role that you create yourself.

Add an account

1. Open Users & Access → Accounts (/admin/account) and click Add New.
2. Fill in Username, Full Name, Email Address, and Phone Number (7–12 digits after +62).
3. In Select Group, choose at least one role. Set the Status to active or inactive.
4. Under Create Password, fill in Password and Confirm Password, or click Create Random Password. Passwords need at least 8 characters with uppercase, lowercase, a number, and a symbol.
5. Click Save.

Import accounts from CSV

1. On the Accounts page, click Import to open Import User dari CSV.
2. Click Download template CSV and fill it in. Required columns: email, username, password, nama_lengkap, no_hp, groups, active. Optional columns: jenis_kelamin, agama, tempat_lahir, tanggal_lahir, alamat_lengkap, nik, nisn.
3. Drag the .csv file onto the upload box, or click to choose it. Only .csv files are accepted.
4. Check the Review Data table. Click a cell to fix it, or delete rows you don't need.
5. Resolve every listed issue, then click Import.

• For students, set the groups column to Pengguna. If an account has several groups, separate them with a semicolon, for example Guru;Pengasuhan.
• The active column accepts only true or false.
• Emails and usernames cannot be empty or duplicated within the same file.

View and edit an account

• Click a username in the table to open the account detail with the Profile, Parent & Guardian Data, and Documents tabs (for example Family Card, Birth Certificate, Parent / Guardian ID Card, Diploma or Certificate of Graduation, Last Report Card, Passport Photo; PDF, Word, Excel, PowerPoint, JPG, or PNG files up to 5 MB).
• To change the name, email, phone number, groups, or password, click Actions → Edit on the account row.
• Actions → Delete moves the account to the deleted accounts list, so it no longer appears in the active list.

Restore or permanently delete an account

1. On the Accounts page, click Deleted Users to open the deleted accounts page (/admin/account/deleted).
2. Click Restore to bring the account back to the active list.
3. Use Permanent Delete only when the user's data must not be kept. Type the account's username exactly to confirm. This removes the account and its related academic, finance, HR, POS, document, and notification data, and cannot be undone.

Set roles and permissions in Access Control

1. Open Users & Access → Access Control and click Add New.
2. Fill in Role Name and Role Description.
3. Tick the permissions the role needs. Permissions are grouped by module; use the search box or Select all permissions. Selecting every permission at once asks for confirmation, because the role would get full access.
4. Click Save, then give the role to accounts through Select Group.

When you edit an existing role, Aerish shows how many permissions are selected and a summary of permissions added or removed. Use Selected only to filter to the active permissions, and click View changes to expand the changed permission groups before saving.

Create a Kasir (Cashier) role for POS

The POS Cashier Desk menu appears only for a role named Kasir or Cashier (and for Superadmin), and the Kantin (POS) module must be active.

1. In Access Control, click Add New and set Role Name to exactly Kasir.
2. Tick the POS permissions needed, for example Buat Transaksi POS (create POS transactions), Lihat Shift POS, Kelola Shift POS, and Lihat Produk POS.
3. Save, then assign the Kasir role to the cashier's account.
4. Link the cashier to a POS device. Without it, the cashier screen shows "Mesin POS Belum Terhubung" (POS machine not connected).

Review profile change requests

When users change data on their profile page, the change is sent as a request. The new data applies only after an admin approves it.

1. Open Users & Access → Profile Change Requests.
2. Open a request with the Pending status. Compare Requested Changes with Current Values.
3. Click Approve (you may add Admin Notes), or Reject and fill in the required Rejection Reason.

Review profile photo or selfie requests promptly. Until a request is approved, staff cannot use the new photo for face attendance in the Aerish Staf app.

Troubleshooting

• "Please select at least one group": every account needs at least one role.
• "Full name is required": fill in Full Name when you add an account.
• "Kolom wajib tidak ditemukan" (required column not found) when importing: add the listed column to the CSV header row, or start from the template.
• The Import button is disabled: some rows still have issues in the list to fix.
• A user sees a no-access page: the page names the permission required. Add it to their role.
• The cashier menu doesn't appear: make sure the role name is exactly Kasir and the POS module is active.

Next steps

• Sign-in and account security
• How to create user accounts
• POS for the school canteen