July's sub-accounts solved one-login-each, store whitelists and purchase dispatch. Sellers quickly pushed back: the permission dial was too coarse — before this release, about half of active sub-accounts in production held near-full rights, not because owners were generous, but because there was no finer switch. Wanting to hide profit or revenue simply wasn't an option. Permissions v2 exists for that complaint.

This release doesn't change who can sign in or which stores they see. It splits what they can do from which money figures they can see: function permissions and data visibility are orthogonal. Store / 1688 whitelists stay as they were.

What this feature does for you

Module × View / Action matrix: 14 modules (Dashboard, Products, New Listing, Piggyback Listing, Repricing, Orders, Inventory, Direct-Mail Shipping, Purchasing Centre, Hot Search, Category Analysis / Discovery, Data Reports, Finance, Scrape & Sourcing) grouped as Operations / Trading & Logistics / Data & Tools. Most modules can grant View or Action separately — View alone lets them open the page and refresh lists, while writes (repricing, creating POs, starting/stopping bid rules) are blocked, with a yellow Read-only banner at the top. Granting Action implies View for the same module; you don't tick both.
Three data-visibility switches: orthogonal to modules, all visible by default. The owner can hide Purchase Cost, Profit, or Revenue totals & balances — the orders table loses two columns, the Direct-Mail dispatched tab drops estimated profit, the product-detail drawer has no purchase price, the five dashboard revenue cards and trend sales disappear, and Finance as a whole is unreachable. The security boundary is server-side: actions strip fields by domain before returning. No permission means truly invisible — not a CSS hide.
Anti-inference: hiding cost also hides profit (net profit = net sales − freight − cost; leaving profit lets someone reverse-engineer cost, and the editor locks the profit switch accordingly). On PO profit cells, hiding cost or profit wipes the revenue/cost breakdown entirely into a "hidden" state. Intentionally not masked: the Purchasing Centre job pages themselves revolve around purchase price — granting Purchasing Centre while hiding cost shows a yellow caution in the editor, and you decide.
Role presets + copy: four chips at the top of the permission editor — Buyer (products / orders / shipping + purchasing & restock; sees purchase price, not profit or revenue), Operator (products / listing / piggyback / reprice / shipping, plus data & hot search; no purchase cost or profit), Support (orders / inventory / shipping progress only; all three money domains hidden), Full access (every module + all data visible; store whitelists still apply). One click fills the matrix, then you fine-tune; or copy from another sub-account and edit.
A management page you can actually use: create/edit becomes a wide two-pane dialog with a three-section editor (presets & copy → module matrix with column-level select-all → data switches). List rows summarise access per module, show which data domains are hidden, and badge the matching preset — so you can tell a Support seat from a half-Operator at a glance.

Zero regression for existing sub-accounts: the migration backfills the new view rights and shipping.manage, and legacy JWTs merge those backfilled keys — no mass force-logout. One intentional tightening: product-template import (writes floor price / dimensions / purchase cost) now requires Products · Action; the handful of v1 sub-accounts without it (~5 in production) will see a permission error on import, because that path was always a price write. Sub-account slot counts are unchanged: 2 on Advanced, 4 on Professional, expandable with a quota code.

Real seller scenarios

A buyer who works, not books: tap the Buyer preset — they get Products, Orders, Shipping and the Purchasing Centre, can place 1688 orders and bind sources, and see purchase prices to negotiate; the dashboard has no revenue cards, Orders has no net-profit column, and profit reports are unreachable.
An outsourced operator on trial: tap Operator, shrink the store whitelist to one test shop, and turn off Finance and Reports. They can reprice, list, manage bids and shipping — but purchase-cost and profit columns stay empty. The data they need, none of the family silver.
Support that only tracks orders: tap Support, all three money domains hidden. They see order status, inventory and shipping progress; the dashboard opens but revenue cards are blank, and the Finance entry never appears.
Promoting a veteran seat: copy an existing Buyer account, enable Repricing · View plus Shipping · Action, and turn off Purchasing Centre — in two minutes you have a "dispatch & follow price" role without re-ticking the whole matrix.

Sub-account permissions v2 is part of 辉光ERP's teamwork suite — the all-in-one platform for Takealot cross-border sellers in South Africa. Clear seats keep the books honest.