Menu access and View / Create / Edit / Delete at Settings → RBAC → Permissions.
Settings → RBAC → Permissions (/settings/rbac/permissions) is Role Permissions: what a role (or selected employees) can open and do.
Who can open it: users granted Permissions.
SUPERADMIN and CUSTOMER are hidden. Switching roles while you have unsaved ticks asks you to confirm.
Each module matches a sidebar root (Dashboard, Orders, Billing, …). Pages are the screens that role may open.
Columns are View / Create / Edit / Delete (not GET / GET ALL). Create / Edit / Delete also turn View on. Track, Generate DRS, and print are pages, not extra action columns.
Discard resets. View-only when the role is system-protected or you cannot update roles.
You can also pick employees instead of a role to give personal access. A Data scope block then sits above the modules (Same as role / All records / Own records). Mixed employee scopes show Mixed — keep as is.
Connect App (Orders, Smart Sheet, Pickups, Attendance) appears as grants for the mobile app. Ticking those does not add web pages.
The delivery-boy role shows Actions only (no panel Pages). Delivery staff do not log into this software.