Permissions

Arkan ERP uses role-based access control (RBAC) combined with feature gating to control what users can see and do.

Roles

Four roles are available, assigned per company:

Role Comparison

Feature Gating

The platform uses 92 feature flags to control access to functionality based on the subscription plan. Features are gated at the API level using the @RequireFeature() decorator.

How It Works

@RequireFeature('accounting')
@Controller('accounting')
export class AccountingController {
  // All routes in this controller require the 'accounting' feature
}

If a user’s plan does not include the feature, the API returns 403 Forbidden.

Pricing Tiers

Feature Flag Categories

The @RequireFeature Decorator

The @RequireFeature() decorator can be applied at the controller or route level:

// Gate an entire controller
@RequireFeature('hr')
@Controller('hr')
export class HrController { }
 
// Gate a specific route
@Controller('projects')
export class ProjectsController {
  @RequireFeature('sprints')
  @Post(':id/sprints')
  createSprint() { }
}

The decorator checks the active company’s subscription plan against the feature flag. This is enforced server-side — the frontend hides gated features from the UI, but the API is the source of truth.

Multi-Company Permissions

Users can have different roles in different companies. See Multi-Company for details on how company access is managed.

API Endpoints