Roles & Permissions
Roles & Permissions defines admin access control using role-based access control (RBAC) powered by spatie/laravel-permission. Roles are groups of permissions; each admin account is assigned one role that determines exactly what they can see and do.
'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}public/assets/img/docs/roles/overview.png
Built-In Roles
| Role | Access Level | Notes |
|---|---|---|
| Superuser | Full access to everything, including tenant management | System role — cannot be deleted or modified. Assigned to superuser admins only. Bypasses all RBAC permission checks. |
| Admin | Full access to the tenant | All permissions except superuser-only actions. The default role for new tenant admin accounts. |
| Manager | Operational access | Can create and edit WiFi users, view reports, manage vouchers, and send campaigns. Cannot access system configuration, connectors, or roles. |
| Viewer | Read-only access | Can view all modules but cannot create, edit, or delete anything. Useful for auditors or read-only staff. |
Custom Roles
Create custom roles with any subset of the available permissions. For example, a Support Agent role might have view-users, update-users, and view-portal-log — but nothing else.
Permission Categories
Accounts
Users, vouchers, profiles, top-up codes, WiFi certificates — view, create, update, delete permissions for each.
Device
Network devices and zones — view, create, update, delete.
Captive Portal
Portal templates, journeys, zone mapping, login methods, portal configuration, portal media.
Wifi Enterprise
Enterprise templates, enterprise journeys, enterprise login methods, enterprise configurations, RADIUS certificates, enterprise media.
Connectors
Each connector type (Active Directory, LDAP, RADIUS, SMTP, SMS, WhatsApp, API, PMS, Microsoft, Google) has individual view and edit permissions.
Engagement
Campaigns and surveys — view, create, update, delete.
Reporting
Each report type has a view-report-* permission: bandwidth, login, users, vouchers, insight, security, and others.
Monitoring
view-audit-trail, view-portal-log, view-portal-session, view-radius-test.
System
Settings, admins, organisation, login config, roles, license, scheduler, notifications — typically restricted to Admin role and above.
Subtenants
Subtenants, subtenant admins, subtenant roles, subtenant users — full CRUD permissions for the subtenant management module.
Security
MFA management, API keys, session security, audit integrity.
Actions
Create Role
Enter a role name and select permissions from the categorised checkbox grid. Save to make the role available for assignment to admin accounts.
Edit Role
Change the role name or update the permission set. Changes take effect on the next request for any admin assigned to that role.
Delete Role
Deleting a role is blocked if any admin accounts are currently assigned to it. Reassign those admins to another role first, then delete.
The four built-in roles (Superuser, Admin, Manager, Viewer) cannot be deleted. They can be viewed but not modified — only custom roles are fully editable.
Follow the principle of least privilege — give each role only the permissions it genuinely needs. Start from the Viewer role as a baseline and add specific permissions rather than starting from Admin and removing them.
Required Permissions
view-roles · create-roles · update-roles · delete-roles