Permissions and Permission Sets

Dryad Receipting controls who can do what with permission sets that are installed with the package. This article explains what each permission set allows, which actions check for them, how receipt visibility works, and which combination to give each person. It is written for Salesforce administrators.

Permission Sets at a Glance

Permission set	Give it to
Receipt Admin	The people who run receipting and manage its setup: settings, field mappings, templates, scheduled jobs. Usually one or two people, often the Salesforce administrator.
Receipt User	Staff who create, email, print and void receipts day to day, and run Batch Receipts.
Receipt Editor	People who only design receipt templates.
Receipt User View All	Receipt Users who need to see and work on receipts created by other people. Add it on top of Receipt User.
Receipt User Lite	Users with very limited access, such as guest or community users, who only need to create receipts.
Email Guest User	Only if you use Dryad Mailer: the guest user of the Salesforce Site that receives email delivery events from Amazon.
AWS S3 User	Not needed. It belongs to the Amazon S3 file storage option, which is currently disabled.

The package also contains a permission set named SCRT2 Integration User. It is created by Salesforce for an internal integration user. Don't assign it to people.

What Each Permission Set Grants

Receipt Admin

• The Receipt Admin custom permission, which opens the Settings page and admin-only actions (see Custom Permissions below).
• The Dryad Receipting app and its tabs, including Settings (Receipt Settings) and Receipt Field Mappings.
• Full control of Receipt Templates, Field Mappings and Batch Receipt Logs, and visibility of all receipts.
• The template editor, image picker and label translation pages.
• These system permissions: Customize Application, View Setup and Configuration, Manage Custom Permissions, Manage Translation, Salesforce CRM Content Administrator, View All Custom Settings, View Roles, Send Email and Edit Tasks.

Receipt User

• The Receipt User custom permission, which allows all day-to-day receipting actions.
• The Dryad Receipting app with the Receipts, Batch Receipts, Batch Receipt Logs, Emails and Receipt Templates tabs. There is no Settings tab.
• Create and edit receipts, receipt items, batch logs and Dryad Mailer emails; read field mappings.
• Create, edit and delete Receipt Templates, and use the template editor.
• Send Email, Edit Tasks and View All Custom Settings.

Receipt Editor

• Create, edit and delete Receipt Templates, and use the template editor and image picker.
• Read receipts (only those they can see; see Record Visibility below).
• No custom permission, so it can't create, email or void receipts.

Receipt Editor includes powerful system permissions: Customize Application, View Setup and Configuration, Manage Custom Permissions, Manage Translation and Salesforce CRM Content Administrator. Only give it to people you would trust with that level of access in Salesforce.

Receipt User View All

Overrides the private sharing of receipts. It lets the user view, edit and delete every receipt in the org, whoever created it, and view every Batch Receipt Log. It doesn't include the app, tabs or actions, so assign it together with Receipt User.

Despite its name, this set also allows editing and deleting all receipts. Official receipts should normally be voided and replaced, not edited or deleted. If users only need to see other people's receipts, a sharing rule may be a better fit (see Record Visibility below).

Receipt User Lite

The Receipt User custom permission with minimal access: create and read receipts, receipt items and batch logs, and read templates and field mappings. Users can't edit receipts or send email records, and the set gives no access to Opportunities or Contacts. It is intended for guest and community users whose access is set up separately.

Email Guest User

Lets the Salesforce Site's guest user record email events (delivered, opened, bounced) sent back by Amazon for Dryad Mailer. It is assigned as part of the Dryad Mailer setup. Don't assign it to anyone else.

Object Access Compared

"Full" means Read, Create, Edit and Delete. "View All" means the user can see every record, not only their own. "Modify All" adds editing and deleting every record. A blank cell means no access from that permission set.

Object	Receipt Admin	Receipt User	Receipt Editor	Receipt User Lite	Receipt User View All
Receipt	Read, Create, Edit, View All	Read, Create, Edit	Read	Read, Create	Read, Edit, Delete, View All, Modify All
Receipt Item	Read, Create, Edit, View All	Read, Create, Edit	Read	Read, Create	From its receipt
Receipt Installment	Read, Create, View All	Read, Create, View All	Read, View All	Read, Create	From its receipt
Receipt Template	Full, View All, Modify All	Read, Create, Edit, Delete, View All	Read, Create, Edit, Delete, View All	Read
Receipt Field Mapping	Full, View All, Modify All	Read		Read
Batch Receipt Log	Full, View All, Modify All	Read, Create, Edit		Read, Create	Read, View All
Batch Receipt Log Segment	Full, View All, Modify All	Read, Create, Edit
Email, Email Recipient (Dryad Mailer)	Read, Create, Edit	Read, Create, Edit
Opportunity, Contact, Recurring Donation, GAU, GAU Allocation	Read	Read	Read (Opportunity only)

Receipt Settings are not a record you can grant access to. They are managed on the Settings page, which requires the Receipt Admin custom permission.

Custom Permissions

Dryad Receipting's actions and flows check for two custom permissions, which come with the permission sets above:

Custom permission	Included in	Allows
Receipt User	Receipt User, Receipt User Lite	Create Receipt (from an Opportunity, Payment, Recurring Donation, Contact or Opportunity list view) Batch Receipts Create PDF, Email Receipt, Set as Emailed, Set as Printed, Void Receipt Validate Email (on a Contact or Contact list view) Abort Job (on a Batch Receipt Log)
Receipt Admin	Receipt Admin	Everything Receipt User allows The Settings page: all settings, templates, field mappings, scheduled jobs and app utilities Set Receipt Details on a Receipting Account Updating receipts that the user can't otherwise see (see Record Visibility below)

Users without either custom permission see the message "You don't have permission to perform this action." when they open a receipting action.

Record Visibility

Receipts are private: by default, users see only the receipts they own (usually the ones they created) and those owned by people below them in the role hierarchy. Receipt Items and Installments follow their receipt. Batch Receipt Logs and Dryad Mailer Email records are private in the same way.

• Receipt Admins can see all receipts. When an action they run needs to update receipts, for example marking a replaced receipt, it does so regardless of who owns them.
• Receipt Users can only change receipts they can see. In a team where several people process receipts, someone may get an "Insufficient privileges" error when voiding, replacing or emailing a receipt created by a colleague.

To let a team work on each other's receipts, either:

• add a sharing rule on Receipt (Setup > Sharing Settings) that shares receipts with a public group or role, with Read/Write access, or
• assign Receipt User View All, keeping in mind that it also allows editing and deleting every receipt.

What the Permission Sets Don't Cover

• NPSP records. The permission sets give read access to Opportunities, Contacts and Recurring Donations so receipting can work. Creating or editing gifts, Accounts, Contacts, Payments and Recurring Donations comes from the user's profile or NPSP permission sets, as usual.
• Donor preferences. Changing a donor's Receipt Delivery, Occurrence, Language or Do Not Receipt needs edit access to Contacts and Accounts, from the user's profile.
• Your own custom fields. Fields you add (for example to show on receipts) aren't included in the package's permission sets, and packaged permission sets can't be edited. Grant access through a profile or a permission set of your own.

Typical Assignments

Role	Assign
Receipting manager or Salesforce administrator	Receipt Admin
Staff member working on their own receipts	Receipt User
Staff member in a team that shares the work	Receipt User, plus a sharing rule or Receipt User View All
Communications or design person who maintains templates	Receipt Editor
Guest or community user who creates receipts	Receipt User Lite, plus the object access their site needs
Dryad Mailer site guest user	Email Guest User

Assigning a Permission Set

1. Go to Setup > Users > Permission Sets and click the permission set.
2. Click Manage Assignments, then Add Assignment.
3. Select the users and click Assign.

Users may need to log out and back in, or refresh, before new tabs and actions appear.

Troubleshooting

Symptom	Check
"You don't have permission to perform this action."	The user has neither Receipt User nor Receipt Admin. Assign Receipt User (or Receipt Admin).
The user can't see the Settings tab or page	Settings need Receipt Admin.
"Insufficient privileges" when voiding, replacing or emailing a receipt	The receipt belongs to someone else and isn't shared with the user. Add a sharing rule or Receipt User View All, or have a Receipt Admin run the action.
A user can't find receipts created by colleagues	Receipts are private. See Record Visibility above.
A custom field is blank on receipts, or missing from the template editor	The user lacks field access to it. Grant it through a profile or your own permission set.