# Extra permissions for team members

> Grant an accountant, approver or viewer specific rights beyond their role without making them an admin.

Source: /help/en/account-and-setup/member-permissions

Roles cover the common cases. When one person needs a single extra right, for example an accountant who manages API keys, add a permission override instead of changing the role.

## Available permissions

| Permission | Allows |
|---|---|
| Delete invoices | Delete draft invoices and documents |
| Edit accepted incoming invoices | Change data on an incoming invoice after it was accepted |
| Reopen filed VAT returns | Reopen a filed VAT return, with a reason. Owners and admins always can |
| Manage API keys | Create and revoke keys and see the request log on the **API access** page |
| Manage webhooks | Create, pause and retry webhooks on the **API access** page |

## Steps

1. Go to **Settings → Team**. You need the owner or admin role.
2. In the **Team Members** table, find the **Permissions** column. Owners and admins show "all"; other members show a button such as "none extra" or "2 extra".
3. Click the button. A panel opens with one switch per permission and a note "Extra rights for <name> beyond the <role> role".
4. Switch a permission on or off. It saves immediately.

## Section access

In the same panel, **Section access** sets what an accountant, approver or viewer sees in four areas: **Incoming invoices**, **Contacts**, **Payments and bank** and **VAT returns**.

- **Edit**: see and change (the accountant default).
- **View**: see only (the approver and viewer default; they cannot be given Edit).
- **None**: the menu entry disappears, the pages show "No access", and payment cards are hidden on invoices.

The database enforces it, so the data is not readable through any other screen either. Owners and admins always see everything.

## Good to know

- If you use two-factor login, changing a member's role or permissions, or removing a member, asks for a fresh code from your authenticator app. See [Two-factor login](/help/en/account-and-setup/two-factor-login).
- The switches add rights; section access only reduces what the role allows.
- Issued (submitted or reported) invoices can never be deleted, whatever the permission. They are corrected with credit or debit notes.
- Without "Manage API keys", the **API access** page shows "Only owners, admins and members with the API keys permission can see keys".
- Permissions are per organization. A CA firm member acting for a client uses the rights they have in that client organization.
- Changing the role to admin makes all overrides irrelevant, since admins have every permission.

## Related

- [Invite users and assign roles](/help/en/account-and-setup/users-and-roles)
- [Webhooks](/help/en/account-and-setup/webhooks-overview)