Roles and permissions checklist for a 3PL WMS

In a single-owner warehouse, a permissions screen is mostly about keeping staff out of settings. In a 3PL it does more work. The stock belongs to your clients, the rates are a commercial secret between you and each of them, and the people logging in include your own team and, often, your clients' staff. A bad permissions setup is how one client sees another's order list, or how a picker "fixes" a stock count and quietly changes an invoice.

This checklist covers who should be able to see and change what, and how to test it before you sign. It sits alongside the wider 3PL WMS feature checklist, which lists roles as one item among many. Here we go one level deeper.

Start with the jobs, not the screens

Write down the jobs people do in your building today. Do not start from the vendor's list of roles. A typical 3PL has these:

• Floor staff: receive, put away, pick, pack, load. They use scanners, mostly.
• Supervisors: fix problems on the floor, approve changes, run counts.
• Customer service: answers client questions, creates and edits orders, checks status.
• Billing clerk: reviews charges, edits invoices, exports to accounting.
• Administrator: sets up clients, locations, users and rules.
• Client users: someone at the client who looks at stock and orders.

Your building may have fewer people than that, with one person wearing three hats. That is fine. The test is whether the system can still separate the powers, so that the day you hire a billing clerk you do not have to give them access to scanner settings.

What each role should be able to do

Use this as a starting grid. Mark each cell as see, change, approve or no access, then compare it with what the system offers.

The administrator is not in the table because that role can do everything, which is the reason to keep it to one or two people.

Seven things to check

1. Permissions by client, not only by function. Some staff may work on only some clients. A supervisor who runs the cold room should not need access to the apparel client's returns. Ask: can I limit a user to named clients?

2. Floor users cannot reach money. A picker should not see rate cards, invoices or margins. Ask the presenter to log in as a floor user and show you the menu. You should not be able to find a rate.

3. Client users see only their own data. This is the one that causes real damage. Ask to log in as a client user for Client A and try to open an order number from Client B. Try the same with a stock search and a download. All three should fail without leaking even an item name. The full list of what clients should see is a separate question, covered in how to choose 3PL software as one of the five decisions.

4. Adjustments need a reason, and big ones need a second person. Any change to stock should record who, when, how many and why. Decide a threshold, in units or in value, above which a supervisor approves. Ask: can I set that threshold per client? A client with expensive goods will want it lower than one with cheap ones.

5. Edits to completed work are limited. Once an order has shipped, who can change it? Once an invoice has gone out, who can change a charge? The honest answer in some systems is "anyone with the right screen." You want a locked period, or a credit note process, so history does not shift under you.

6. An audit trail you can read. Every permission is only as good as your ability to check it afterwards. Ask to see the log for one item over one month, with user names. If you cannot read it without exporting it to a spreadsheet, note that.

7. Leaving staff and temporary staff. Agency workers arrive for peak season. Ask how fast you can create a floor-only login, and how you switch it off on the last day. Shared logins on a scanner are common in warehouses and they destroy the audit trail. See what the system does about that, such as a quick scan-in badge or PIN.

Test it with two logins

You do not need a long demo for this. Ask for two test users and run these steps:

1. Log in as a floor user. Try to open the rate card. Try to change a completed pick.
2. Log in as a client user for Client A. Search for an item that exists only for Client B.
3. As a supervisor, approve an adjustment, then ask where it shows in the audit trail.
4. As the administrator, remove a user, then try their login again.

Mark each step S, D or N, using the same letters as the feature checklist: shown working, described only, or not available. Anything marked D should go into a written follow-up. A longer set of prompts is in questions to ask in a 3PL WMS demo.

Where small 3PLs go wrong

The usual mistake is to give everyone administrator rights during setup "to get going" and never take them back. Six months later nobody remembers who can change a rate. Set roles on day one, even if it means a supervisor has to ask the administrator for something now and then. The small delay is cheaper than a disputed invoice.

The second mistake is to treat client logins as a favour to the client and not as a security matter. Each client user is another person who can see your building's data. Give them the least access that answers their question, and remove people who leave the client company when the client tells you.

Before you decide

Write your own grid, using the table above, for your real jobs. Put it next to each option you are evaluating and fill in what the system actually allowed. The difference between "role-based access" on a feature list and your grid, filled in, is where most of the surprises sit.

Questions people ask

What user roles does a 3PL warehouse management system need?

At minimum: floor staff, supervisors, customer service, a billing clerk, an administrator and client users who see only their own data. Smaller teams can combine roles, but the system should let you separate them.

Why do 3PLs need permissions that a normal warehouse does not?

Because the stock belongs to other companies. A user in your building may be allowed to touch stock, but not every client's stock, and a client user must never see another client's records.

How do I test permissions in a WMS demo?

Ask the presenter to log in as a floor user and try to edit a rate, then log in as a client user and try to open another client's order. Both attempts should fail.

Should stock adjustments need approval?

For small changes, a reason code and a user name may be enough. For larger ones, set a threshold above which a supervisor has to approve before the count changes.