Configure user roles

Role configuration is where compliance lives or dies. The shipped seven-group hierarchy gives you a defensible SOC 2 evidence trail out of the box — provided every staff member is assigned the right group and nothing else.

The seven shipped groups

Each group is implicit-rebased (an Officer is a portal user with extra rights; a Branch Manager is a Supervisor with extra rights; and so on). Never tick more than one of these groups for the same user.

Create staff users

For each staff member open Settings → Users & Companies → Users → New and capture:

• Login: the staff member's corporate email; never use 'admin' or shared logins.
• Authentication: enable TOTP via auth_totp — required by SOC 2 control AC-7.
• Allowed companies: the parent company plus any subsidiary they cover.
• Default branch: the branch they sit in (Mumias for a Mumias loan officer).
• Allowed branches: usually the same as default branch; a roving officer may have multiple.
• Group: exactly one of the seven shipped groups.
• HR linked employee: the matching hr.employee for officer-performance tracking.

Segregation-of-duties matrix

The shipped two-person rules (see next page) enforce these blocks at the action level. The matrix here documents the policy.

Officer performance KPIs

The mfi_officer_perf module ships with seven KPIs that score every officer monthly. Link each user to an hr.employee so the scorecard fills.

• New members onboarded — count of members with state=active in the month.
• Loans originated — count of loans applied for.
• Loans approved on first appraisal — quality proxy.
• Portfolio at risk > 30 days — must be ≤ 5%.
• Average days to first call — for dunning officers, must be ≤ 3.
• Cash variance count — must be 0.
• Member NPS — pulled from the iBANK post-transaction survey.

What gets audited

Every login, every group change, every record rule override is logged by mfi_audit. The Internal Audit user can pull the trail from MFI → Audit → Access log.

-- Sample query: who approved every loan in Q1
SELECT loan.loan_number, loan.approved_amount,
       u_approver.login AS approver,
       loan.approval_date
FROM mfi_loan loan
JOIN res_users u_approver ON u_approver.id = loan.approved_by_id
WHERE loan.approval_date BETWEEN '2026-01-01' AND '2026-03-31'
ORDER BY loan.approval_date;

Worked scenarios

Reference

res.users key fields

XML ids of shipped groups

Troubleshooting

See also

• Two Person
• Branches
• Audit
• Soc2