NetSuite Administrator Fundamentals: Roles, Permissions, Security Audits, and the Admin Toolkit

Access control

How NetSuite roles and permissions work

A role is a job profile for the system. It defines what a user can see and do and which center, or navigation layout, they get. One employee can hold several roles and switch between them.

The five permission levels

The layers that decide what a user can do

• Permissions

  Grouped as Transactions, Reports, Lists, Setup, and Custom Records. They control which record types and pages the role can reach, at each level above.

• Restrictions

  Narrow which records of a type the role can see, for example by subsidiary, department, class, or location, and by employee hierarchy through Employee Restrictions.

• Field-level access

  Custom fields can be hidden or made read-only for specific roles, independently of record access. Use this for cost, margin, or salary data.

• Forms

  Role-specific forms control which fields appear, which reduces errors and training time. A form is not a security control on its own.

• Global Permissions

  If the feature is enabled, permissions can be assigned directly to an employee, apply across all their roles, and win over role permissions when they conflict. Oracle notes this feature is not preferred.

If the Advanced Employee Permissions feature is enabled, employee data is split into separate permissions, such as Employee Public, Employee Confidential, and Employee Compensation, so you can expose a directory without exposing pay.

Source: Oracle NetSuite Help Center, NetSuite Permissions Overview and NetSuite Access Overview.

Best practices

NetSuite role design best practices

Most access problems come from roles that were built quickly at go-live and never revisited. This is the approach we use when redesigning roles.

1. Map job functions, not people

   List each function, such as AP clerk, AR specialist, buyer, warehouse lead, or controller, and document what each must create, view, approve, and never touch. Group similar functions so you are not maintaining a role per person.

2. Start from the closest standard role, then restrict

   Customize a standard role such as A/P Clerk or Accountant at Setup > Users/Roles > Manage Roles. Never copy the Administrator role and remove access; that is the most common source of over-permissioned roles.

3. Apply least privilege at every layer

   Grant the lowest level that does the job. Reserve Full for the few people who must delete, and keep Setup permissions out of everyday roles.

4. Restrict by subsidiary and segment

   In multi-subsidiary accounts, limit each role to the subsidiaries it works in, then by department, class, or location where needed, so users cannot post to the wrong entity.

5. Protect sensitive fields

   Use field-level access on custom fields for costs, margins, bank details, and compensation, and enable Advanced Employee Permissions if HR data lives in NetSuite.

6. Separate incompatible duties

   Do not let one role create a vendor and pay it, or post a journal entry and approve it. See the segregation of duties table below.

7. Require 2FA and avoid Global Permissions

   Set 2FA as required on privileged roles and keep access in roles, where it is visible and auditable, rather than on employee records.

8. Test in sandbox and document

   Log in with the new role in a sandbox and run its real tasks. Keep a role matrix: role, purpose, owner, key permissions, and last review date.

Controls

Segregation of duties in NetSuite: conflicts to avoid in one role

Where a small team cannot separate duties fully, add a compensating control, such as an approval workflow or a regular review of system notes. Our NetSuite workflow guide shows how to build approval routing.

Beyond access

The rest of the NetSuite administrator toolkit

Each of these areas has its own in-depth guide. Here is what every admin needs to know, and where to go next.