These two groups are the system's control room: security and users, workflows, tax, notifications, integrations, backups, and auditing.
| Subgroup | Pages |
|---|---|
| Users & Security | User List · Access Groups · User Sign-in Approval · API Keys · Tag Management |
| Process Configuration | Process Instances · Process Definitions |
| Tax Management | Configuration · Tax Operations Report |
| Notifications | SMS & Notification History · SMS Panel Management |
| Integrations | Payment Gateway Management · POS Device Management |
| System | General · Currency Settings · Theme & Appearance · Database Management · Data Migration from Pishro to Karitm · System Events |
Two naming notes: the menu item "Administration → Tax Management → Configuration" opens the "Tax Authority Portal" page — mention both names to the user. And the menu item is called "User List," but the tab title and the in-page title are simply "Users."
Users & Security
"User List"
Columns: # · checkbox · display name · national ID · mobile number · username · role · actions. The role column is shown as a chip. The actions column has three icons: permissions, reset password or key, delete. Two buttons at the top of the page: New User and User Sign-in Approval.
"Access Groups"
The heart of the system's security model. The system has hundreds of individual permissions; instead of assigning them one by one to each user, permissions are packaged into an access group, and the group is assigned to the user. If a person's job duties change, you just change their group, not dozens of permissions.
Columns: # · group name · description · permission count · user count · status · actions. Five actions in the actions column: delete · report · copy · members · edit.
"All" vs. "Own Ownership." Most permissions are defined in two scopes. The "All" scope means the user sees and changes all of the organization's records in that section; "Own Ownership" means only the records they created or that were assigned to them. For example, a sales rep may see only their own customers and invoices, while the sales manager sees the whole organization. When building each group, deliberately choose between these two modes for every section.
Not all system permissions are typically enabled even for the admin group; a few permissions remain reserved for the organization owner. So the correct answer to "does admin have access to everything?" is: almost everything, not exactly everything. The group copy feature is an important setup shortcut: copy a similar group and change a few permissions.
"User Sign-in Approval" is the queue for approving new sign-ins. A user is not activated until an administrator approves them — a control layer that complements the username and password.
"API Keys"
Subtitle: "Programming keys for connecting devices and services (such as a time-clock device) to the system." Informational banner on the page: "Each key is created with the access of your current profile. If device fingerprint validation is enabled, the key is locked to that same device on first use, and using another device requires a new key or key rotation."
- An API key inherits the permissions of the user who created it; so create it with a user who has limited access, not an admin user.
- Being locked to a device fingerprint means a stolen key does not work on another device.
- Switching devices requires key rotation.
"Tag Management" defines the organization's shared tags that are applied to records across various modules.
Process Configuration
"Process Definitions" is the system's workflow engine and one of the product's most advanced areas. Columns: # · name · entity type · status · version · actions.
| Column | Details |
|---|---|
| Name | Shown with a tree-structure icon; the default process for each entity gets a "Default ★" chip |
| Entity type | A chip showing the entity the process runs on: lead · service reception · activity · invoice |
| Status | Draft (gray) · Published (green) · Archived (red) |
| Version | Processes are versioned, and the version number is shown next to the name |
Row actions depend on status: view · edit · publish · upgrade version · copy · archive · process diagram. Two buttons at the top of the page: Create Process Definition and Create from Template.
Workflow versioning is an important point: when you change a process, in-progress instances of the previous version finish under the old rules, and only new instances run with the new version. This is exactly what auditors ask: "under which rules was this case approved?"
"Process Instances" lists the current and past runs of each process, with status and current stage. The workflow task inbox is found on the Task Inbox page.
Tax Management
The menu item "Configuration" opens the "Tax Authority Portal" page and has two main cards.
| Credential card element | Details |
|---|---|
| Three status chips | Credential is registered (green) · Private key is saved (green) · Token has expired (red) |
| Client ID | Required field |
| Private key | Multi-line field; if left empty, the current private key does not change |
| Four buttons | Save credential information · Validate · Refresh · Delete |
The "Tax Operations" card has a button to send invoices to the Tax Authority Portal, with the guidance: "You can send approved invoices to the Tax Authority Portal. Make sure the tax credential and the company's national ID are set." At the bottom of the page: "Recent Submissions" and a collapsible "Common Tax Authority Portal Errors" section.
The three status chips are the most important tax troubleshooting tool. If invoices are not being sent, check these three chips first: "Token has expired" is the most common cause, and it is refreshed with the Validate button.
"Tax Operations Report" is an overview report of the status of invoice submissions to the Tax Authority Portal — it complements the "Tax Status" column in the Sales Invoice List.
Notifications & Integrations
"SMS & Notification History" is the record of all sent SMS messages and notifications with delivery status. "SMS Panel Management" configures the SMS provider: credentials, sending line, message templates. These two pages underpin all of the system's automated notifications: invoice due-date reminders, storefront order status notifications, two-step sign-in codes, and loyalty-program SMS campaigns.
"Payment Gateway Management" defines online payment gateways for the storefront and payment links. "POS Device Management" defines connected card readers. Access to the device itself and access to its connection credentials are two separate permissions; that is, you can allow a user to see and select a device without them seeing the connection credential information. This is exactly what makes "recording a receipt with a direct card reader" in the Treasury wizard possible.
System
- "General" — the organization's base settings: name, logo, print letterhead, contact information, national ID, and the system's default behaviors (including the default "issue voucher" setting in the Treasury wizard).
- "Currency Settings" — defines currencies and rates. This page determines which unit amounts are displayed in; the difference in units between reports (Rial on the balance sheet, Toman on the sales report) is unified from here.
- "Theme & Appearance" — the system's theme, color scheme, and visual layout.
- "Data Migration from Pishro to Karitm" — the official migration tool from the product's previous generation ("Pishro") to Karitm.
"Database Management"
Subtitle: "Backup, restore, and viewing the database operations history."
| Section | Content |
|---|---|
| Backup space | Remaining space and used space; buttons to create a backup and request additional disk space |
| Automatic backup | The "Enable automatic backup — take automatic backups at regular intervals" toggle and a Save Settings button |
| Available backups | List of backup versions with restore capability |
| Database operations history | Log of backup and restore events |
Dedicated permissions: backup · restore · view backup list and size · operations history · view and manage automatic backup settings. This means you can allow a user to see backup status without allowing them to restore.
Practical administrator advice: turn on automatic backup once and save the settings, and also perform one test restore to make sure the backup can actually be restored. A backup that has never been tested is not really a backup.
"System Events"
The system's complete audit trail: every recorded operation on records is kept here. Columns: # · checkbox · date and time · operation type · entity type · user · changed fields · actions (view). The "Event Details" dialog has two tabs: event details and entity history.
| Field | Description |
|---|---|
| Date and time | The exact time the event occurred, in the Persian calendar |
| Entity | The type of record the event occurred on |
| IP address | The network address the operation was performed from |
| Device / browser | Full details of the user's device and browser |
| Operation type | View, create, edit, delete, etc. |
| Performed by | The user's name along with their role chip |
| Change reason · footer | The context in which the event was recorded · the event's correlation ID for detailed tracking |
The "Entity History" tab shows all changes to a specific record over time and has its own dedicated permission. This page is the standard answer to an auditor: "who changed what field, when, and from which device."
Sample Workflows
Security setup for a new organization
Access Groups → create a group for each job role → use group copy for similar groups → User List → create a user and assign a group → User Sign-in Approval → control the "All" vs. "Own Ownership" split.
Connecting a device to the system
Create a user with the minimum access required → sign in with that user → API Keys → create a new key → set the key on the device (it locks on first use) → to switch devices, rotate the key.
Setting up the Tax Authority Portal
System → General → register the national ID → Tax Management → Configuration → enter the client ID and private key → save → validate and check the three chips → send invoices → track in the Tax Operations Report.
Defining an approval workflow
Process Definitions → create from template → select entity type → design steps and conditions → save as draft → publish → if changed, upgrade the version → track in Process Instances and the Task Inbox.
Backup policy
Database Management → check space → turn on automatic backup → one manual backup → one test restore → check the result in the operations history.
Responding to an audit inquiry
System Events → filter by date, user, or entity type → the event details tab for "who, from where, when" → the entity history tab for the record's full change path.
Frequently Asked Questions
The menu item is "Configuration"; which page does it open?
The "Tax Authority Portal" page.
Invoices are not being sent to the Tax Authority Portal.
Check the three status chips on the credential page; "Token has expired" is the most common cause. Click the "Validate" button.
Does the admin group have access to all features?
Almost; a few permissions remain reserved for the organization owner and are not in the admin group.
What is the difference between "All" and "Own Ownership" in an access group?
"All" means the user sees all of the organization's records in that section; "Own Ownership" means only their own records.
With what access level should I create an API key?
With a user who has the minimum access required; the key inherits the permissions of its creator.
The API key does not work on a second device.
The key was locked to the device fingerprint on first use; create a new key or rotate the key.
I changed a process — what happens to in-progress cases?
If you upgrade the version, in-progress instances finish with the previous version.
How do I find out who changed this record?
System Events → the record's "Entity History" tab.
What happens to our data from the Pishro software?
The "Data Migration from Pishro to Karitm" tool in the System menu is for exactly this.