Getting Started

Core Concepts

ConceptDescription
Organization (tenant)The account boundary. Every lead, invoice, product, and expense belongs to exactly one organization, and organizations never see each other’s data.
ModuleA product area — CRM, Billing, Inventory, or Expense Management — enabled per organization based on plan. Calling an endpoint or opening a page for a module your organization hasn’t enabled returns a module_not_subscribed error.
Permission profileWhat a team member is allowed to do. Every user has one profile (Owner, Admin, Manager, Member, Viewer, Billing User, or Expense Approver) that governs their access across every enabled module. See Team & Permissions.
Permission keyThe underlying module:resource:action triple every permission check resolves to — e.g. crm:lead:create, billing:invoice:export. You won’t usually need these directly; profiles bundle them for you.
PlanThe subscription tier (Free, Starter, Pro, Enterprise) that determines which modules are included and which are paid add-ons. See Plans & Modules.

How a request is authorized

Every action in Moyo Suite is checked in this order:

  1. Are you signed in? — a valid session (see Authentication).
  2. Which organization are you acting as? — resolved from your session.
  3. Is the module enabled for this organization? — e.g. is Expense Management on your plan.
  4. Does your permission profile allow this specific action? — e.g. can a Member delete a Deal.

A failure at step 3 looks different from a failure at step 4 — the former means “ask your admin to enable this module,” the latter means “ask your admin to change your permission profile.” See Errors for exactly what each response looks like.

Records and ownership

Within an enabled module, most records (leads, deals, expenses, invoices) carry an owner. Your permission profile determines whether you see only records you own, records shared with you, or every record in the organization — this is what separates, say, a Member from a Manager.