Welcome to the NZRT Wiki Podcast. Today we’re looking at Users & Groups.

In Dolibarr, the system NZRT uses to manage projects, invoices, and everything in between, user accounts are tied to fine-grained permissions. That means each user or agent only gets access to the specific modules and actions they actually need. NZRT takes this seriously — there are no shared accounts. Every agent has their own dedicated login.

When we say agents here, we mean NZRT’s virtual AI agent accounts. These are real Dolibarr user accounts, one per agent, set up so that each AI can interact with the system in a controlled and traceable way. They authenticate using individual API keys rather than a traditional username and password flow. The passwords do exist, but they’re randomly generated and stored securely in the Nextcloud shared credentials folder — not something you’d ever type in manually.

Let’s walk through the agent roster. There are nine accounts in total, and the table in the wiki gives you the agent code, their Dolibarr user ID, their login handle, display name, email address, the modules they can access, and their current status.

First up is xc, the admin account, with a Dolibarr ID of 2. This account displays as XC Admin and uses the admin email address. XC has access to all modules — it’s the top-level account.

Next is cas, ID 4, the Sales agent. CAS has access to Thirdparties, Proposals, and Orders — covering the client-facing sales pipeline.

Then there’s dai, ID 9, the Data agent. DAI has read access to exports plus access to accounting results. It’s a deliberately limited account — read-only on the export side.

DAN is ID 10, the DBA agent. Interestingly, DAN has no Dolibarr module permissions at all — DAN operates exclusively through Nextcloud. So this account exists in the system but is intentionally restricted on the Dolibarr side.

EMA is ID 8, the document and email management agent. EMA has access to ECM, which is the electronic content management module, plus Mass Emailing and Export.

FIN is ID 6, the Finance agent. FIN covers Invoices, Bank, and Accounting — the core financial stack.

HAN is ID 7, the HR agent. HAN covers the HRM module, Leave, and Expenses — everything to do with people management.

PAM is ID 3, the Products agent. PAM handles Products, Stock, and Manufacturing — the inventory and production side of the business.

Finally, SUN is ID 5, the Purchasing agent. SUN covers Suppliers, Purchase Orders, and Delivery.

So that’s nine accounts in total: xc, cas, dai, dan, ema, fin, han, pam, and sun.

All of these accounts were provisioned on the twenty-first of April 2026 using a script called create agents, which ran directly against the database. Then two days later, on the twenty-third of April, module permissions were applied using a script called set dolibarr permissions. That run set 58 individual permissions across seven of the agents — all done in a single automated pass.

On the topic of permissions, the wiki notes there are four levels to understand: Read, Write, Delete, and Admin. These are the four tiers that Dolibarr uses to control what any given user can actually do within each module. So an agent might have read access to a module but not write access — or write access but not the ability to delete records or change admin-level settings. The detail of exactly which agents hold which permission levels is covered in a separate Security and Permissions article, which is worth reading alongside this one.

One last thing worth noting is the API access model. When NZRT’s AI agents actually call Dolibarr to do work — creating tickets, updating projects, fetching data — they use the REST API directly, and each agent has its own API key configured for that purpose. The keys are set up separately from the account provisioning step, as part of the process of wiring each AI agent into the live system.

If you want to dig deeper, the related articles to check out are Security and Permissions for the full permission breakdown, and the Agent Account Setup guide for the step-by-step provisioning process. There’s also an Employees article if you’re looking at human user accounts rather than the virtual agent accounts covered here.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.