Managing access

This page is for the administrator and the purchasing manager. It describes what the application does as of 20 October 2026 to make access management easier. The detail is in the user manual (§ 33 nonies, in French) and the operations guide (§ 3 bis, in French).

Read before acting

Any operation on accounts, rights or assignments starts by reading what is currently in force: the list of accounts (profile, active or deactivated, manager), the optional rights and the assignments. An operation made on a misspelt name or on an account that has already changed hands is not always refused by the tool.

What makes management easier

Need	What the tool does
Create an account without choosing its password	A single-use code of 16 characters, shown once, valid for 72 hours. The person chooses a password (at least 12 characters) at first sign-in.
Give only the right that is needed	Each profile creates only the profiles its own may create; nobody creates or manages an account more powerful than their own. Optional rights are opened per profile, with a mandatory reason.
Know whose work you look at	An optional “manager” link on each account. It gives no right.
Remove access without losing anything	Deactivation: an account is never deleted, its identifier cannot be given to someone else, and the last active administrator cannot be removed.
Find who did what	The account log, in the Accounts screen: creation, profile change, manager change, deactivation, reset, rights. It never contains a password.

The steps

1. Read the list of accounts and, for optional rights, python -m tarifs profil option lister.
2. Create the account: identifier, name, profile and, if needed, the manager. Pass the code on through a channel other than the identifier. After 72 hours, the Reset button gives a new one.
3. Change a profile: the effect on the person’s actions is immediate, a task is created in their name, and it is better to tell them.
4. Deactivate when the person no longer needs to sign in: their actions are refused from the next operation and an open session closes within a minute.
5. Read the log of accounts to check the operation.

Two delays not to confuse

A deactivation or a profile change applies to the person’s next actions. An optional right applies at their next sign-in.

What is not there

• Sign-in through the company directory (SSO, LDAP) is not delivered. It is an IT decision, pending, with no committed date. Today, sign-in uses an identifier and a password managed by the tool.
• The account log is kept for 12 months (adjustable), like the technical log it belongs to. The accounts register itself keeps the date and author of creation and deactivation.

For a departure, see When a buyer leaves the company.