How people join your company, what the two ways of leaving actually do, and the refusals the server raises to stop an administrator locking everyone out.

The one door in

There is no sign-up page. Every account in your company is here because an administrator added it, from the Users screen, which needs manage_users. Forgetting a password stays self-service; being added does not.

Press Add person. The form asks for an email, a first and last name, a role, and the outlets the person is restricted to, all on one dialog so the last question can't be skipped. Then Send invitation.

What happens next depends on the address:

A new address gets an email with a 72-hour link on which they set their own password. Until they do, their row shows Invited and they can't sign in. Nobody, administrator or Bohari staff, ever types someone else's password.
An address that already has a Bohari account (they work for another customer, say) simply gains your company. They get a notification, no link, and sign in with the password they already use.

Two refusals are worth knowing. An address already in the company gets "That person is already in this company." A role id from another tenant gets "That role does not belong to this company." Roles themselves are fixed per company and picked, not composed, here; see Roles & Permissions.

If the invitation email fails to send, the membership still stands. That's what Resend invitation is for.

Outlets on the invitation

The Restrict to boxes are a restriction list. Tick nothing and the person reaches every outlet in the company. The dialog says so in amber while the boxes are empty: "Nothing ticked means no restriction: this person reaches every outlet in the company. Right for Finance, Procurement and an Auditor, almost never right for anyone based at a branch."

The pinning question lives on this form because the mistake it prevents is not a half-configured user. It's a branch storekeeper who can read the whole company, created by an administrator who added them and stopped.

Two more points:

A role holding manage_outlets can't be pinned. The server answers "This person manages outlets, so they cannot be restricted to a subset of them. Change their role first if they should only reach one branch."
Closed outlets still appear in the list, flagged with a red chip, so pinning someone to a mothballed branch is a choice rather than an accident.

Restrictions are changed later from Company Settings, on the Outlets tab under Who works where. See Company Settings.

Reading the list

Three cards at the top: total users, active, and how many are still awaiting setup. Below them, a table with User, Email, Role, Outlets, Status, Admin and Created. Search matches name, email or role name.

The Status column reads Active, Invited or Inactive, and Inactive wins over Invited: someone switched off can't sign in whether or not they ever set a password. Inactive rows are greyed, because someone scanning for who's still here reads the row, not the column.

The Outlets column never shows a number zero. It shows an amber All outlets chip when the person is unrestricted, or "3 outlets" when they're pinned, because a bare zero would read as "no access" about the one case that means the opposite.

The Admin column marks Bohari platform staff as Platform Owner. Nobody in your company can grant that flag; it's set outside the product.

Resend invitation

Offered only while a row reads Invited. It mints a fresh 72-hour link and emails it. Once the person has set a password the button is refused: "That person has already set a password. They can reset it from the sign-in page." Re-minting a live credential on an administrator's say-so would be an account takeover wearing a helpful label, so Forgot Password is the only path from then on.

Changing a role

Change role opens a picker of your company's roles. A new role binds at once; the person doesn't sign in again, though their own menus only catch up when they next do.

You can't change your own role: "You cannot change your own role. Ask another administrator to do it." And the server won't let the last holder of manage_users be moved off it: "This is the company's last active administrator and cannot be moved off the administrator role. Grant another user an administrator role first."

Two ways out, and they are not the same

Staff turnover in this trade is high, so the leaving half matters as much as the joining half. Each row offers two actions and they do different things.

Remove from company (amber) ends a membership. The dialog says it exactly: they lose this company at once and are signed out of every device, but their Bohari account, their password and any other company they belong to are untouched. Their outlet restrictions here are cleared, so bringing them back later means a fresh invitation. This is the ordinary resignation.

Deactivate (red) switches off the person, not their place here. They're signed out immediately and can't sign in to Bohari at all, including any other company they belong to. The dialog says when it's right (someone who has left the industry, or an account you believe compromised) and points you back to Remove from company if they've simply resigned. Deactivated rows gain a Reactivate link, which needs no confirmation.

Both revoke every live session. Tokens are self-contained and can't be rewritten, so the whole set is invalidated; because of a short per-server cache, the cut-off takes effect within about thirty seconds rather than instantly.

Neither action is offered on your own row, and the server refuses it anyway:

"You cannot remove yourself from this company. Ask another administrator to do it."
"You cannot deactivate your own account. Ask another administrator to do it."

Neither may take out the last active administrator. The refusal names what was attempted: "This is the company's last active administrator and cannot be removed from the company. Grant another user an administrator role first." A platform account can't be deactivated from inside a company at all: "That is a platform account and cannot be deactivated from a company. Remove them from this company instead."

What no administrator can do

Set or see anyone's password. Invitations and resets both go through a link only the recipient holds.
Create a platform administrator. The flag isn't on any form the company can reach.
Learn which other companies a person belongs to. A user outside your company is a plain not-found, whether or not they exist elsewhere.

FAQ

Someone has handed in their notice. Remove or deactivate? Remove from company. It ends their access to you and leaves the rest of their account alone. Reach for Deactivate only when the person, not the job, is the problem: they've left the industry or you suspect the account is compromised.

The invitation email never arrived. Check the row reads Invited, then press Resend invitation. The membership was recorded whether or not the first email got through. If the row reads Active they've already set a password, and the answer is Forgot Password on the sign-in page.

Why can't I pin the new administrator to one branch? Because their role holds manage_outlets, and an outlet-restricted administrator is a contradiction the assignment screen relies on being impossible. Give them a branch role if they should only reach one branch.

I removed someone and they were still in the app a minute later. Their session was revoked at once; the server checks a per-instance cache of that cut-off roughly every thirty seconds, so a request in that window can still succeed. After that they're out everywhere.

Why am I locked out of changing my own row? Deactivating, removing or demoting yourself signs you out mid-sentence with nobody left to undo it. Ask another administrator; if you're the only one, grant a colleague an administrator role first.

User Management