# Permission Sets Fours uses Salesforce Permission Sets to strictly control user access. These permission sets determine which Fours Tabs are visible to a user and which Action Buttons (e.g., Create Private Offer) appear on their record pages. For configurations related to the external Fours Integration platform (such as API credentials or mapping rules), please refer to [the Fours Integration Setup Guide](/integrations/salesforce/). :::note **Admin Privileges:** Fours Permission Sets **do not restrict** users with System Administrator privileges. Admins inherently possess full Read/Write access to all Fours features and Cloud Partners, regardless of the specific permission set assigned to them. ::: --- ## How to Access Permission Sets To view or assign these permissions in your Salesforce environment: 1. Click the **Gear Icon (⚙️)** in the top-right corner of the screen and select Setup. 1. In the **Quick Find** box on the left sidebar, type `Permission Sets`. 1. Select **Permission Sets** from the results to view the list of available Fours permissions. 1. All Fours-related permission sets begin with the prefix `Suger`. Assign the appropriate set based on the user's role in your sales cycle. Fours provides granular Permission Sets to control access based on Role (Admin vs. User), Module (Marketplace vs. Co-sell), and Cloud Partner (AWS, Azure, GCP). Use the tables below to assign the correct permissions to your users. --- ## Core Roles & Admin Permissions These permission sets provide high-level access control. | Permission Set Name | Description & Capabilities | | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Suger Approval Offer | Grants permission to **Approve** or **Reject** Marketplace **Offers** (via the `Approve_Offer` custom permission). The approval process can be enabled via Salesforce integration settings in the [Fours Console](https://console.suger.io). | | Suger Approval Cosell | Grants permission to **Approve** or **Reject** **Co-sell Referrals** (via the `Approve_Cosell` custom permission). Assign separately from Suger Approval Offer if a user should be able to approve referrals but not offers (or vice versa). | | Suger Integrator | **Integration User Only.** Grants full Read/Write access to all Fours objects, including the Settings page and configurations. Do not assign this to human users. | | Suger Integrator (Salesforce Integration License) | **API User Only.** Grants full system access specifically for users holding the Salesforce Integration License. Do not assign this to standard human users. | | Suger User | **Standard User.** Grants full Read/Write access to all Fours objects (Offers, Referrals, etc.) across all clouds. **Excludes** access to the Settings page. | | Suger User - Read Only | **Global View-Only.** Grants view-only access to all Fours data. Users cannot create or edit records. | | Suger User - Cosell | Grants Read/Write access specifically to **Co-sell Referrals** for _all_ cloud partners. | | Suger User - Marketplace | Grants Read/Write access to **Offers, Entitlements, Products, Buyers, and Companies** for all cloud partners (Excludes access to Co-sell Referrals). | --- ## Co-Sell Cloud-Specific Permissions Use these permissions to restrict a user's **Referral** access to a specific Cloud Provider. These permissions also affect the user's visibility into CoSell Insights, such as Engagement Score, Possible Sales Reps, and related metrics. These permissions **do not** grant access to Offers, Entitlements, Products, or Companies(Buyers). | Permission Set Name | Description | | -------------------------------- | ----------------------------------------------------------------- | | Suger Cosell (Read Only) | View-only access to Co-sell Referrals for **all** cloud partners. | | Suger Cosell - AWS | Read/Write access to Co-sell Referrals for **AWS** only. | | Suger Cosell - AWS (Read Only) | View-only access to Co-sell Referrals for **AWS** only. | | Suger Cosell - Azure | Read/Write access to Co-sell Referrals for **Azure** only. | | Suger Cosell - Azure (Read Only) | View-only access to Co-sell Referrals for **Azure** only. | | Suger Cosell - GCP | Read/Write access to Co-sell Referrals for **GCP** only. | | Suger Cosell - GCP (Read Only) | View-only access to Co-sell Referrals for **GCP** only. | --- ## Marketplace Cloud-Specific Permissions Use these permissions to restrict a user's **Offer & Entitlement** access to a specific Cloud Provider. These permissions **exclude** access to Referrals. :::note Assigning any of the permission sets below automatically grants access to shared Marketplace objects, including **Buyers**, **Companies**, and **Products**. The "Cloud-Specific" restriction only applies to Offers and Entitlements. ::: | Permission Set Name | Description | | ------------------------------------- | ----------------------------------------------------------------------- | | Suger Marketplace (Read Only) | View-only access to Offers and Entitlements for **all** cloud partners. | | Suger Marketplace - AWS | Read/Write access to **AWS** Offers and Entitlements. | | Suger Marketplace - AWS (Read Only) | View-only access to **AWS** Offers and Entitlements. | | Suger Marketplace - Azure | Read/Write access to **Azure** Offers and Entitlements. | | Suger Marketplace - Azure (Read Only) | View-only access to **Azure** Offers and Entitlements. | | Suger Marketplace - GCP | Read/Write access to **GCP** Offers and Entitlements. | | Suger Marketplace - GCP (Read Only) | View-only access to **GCP** Offers and Entitlements. | | Suger Marketplace - SNOWFLAKE | Read/Write access to **Snowflake** Offers and Entitlements. | | Suger Marketplace - SNOWFLAKE (Read Only) | View-only access to **Snowflake** Offers and Entitlements. | | Suger Marketplace - ORACLE | Read/Write access to **Oracle** Offers and Entitlements. | | Suger Marketplace - ORACLE (Read Only) | View-only access to **Oracle** Offers and Entitlements. | --- ## Lead Access [AWS co-sell leads](/salesforce-app/salesforce-app-leads/) are governed by the **AWS referral** permissions, not by a set of their own: reading the Leads tabs needs AWS referral read, and accepting, rejecting, qualifying, converting, or linking a lead needs AWS referral write. | Permission Set | Lead records | Leads tabs | | -------------- | ------------ | ---------- | | Suger Integrator, Suger Integrator (Salesforce Integration License) | Read/Write | Visible | | Suger User | Read/Write | Visible | | Suger User - Cosell | Read/Write | Visible | | Suger Cosell - AWS | Read/Write | Visible | | Suger User - Read Only, Suger Cosell (Read Only), Suger Cosell - AWS (Read Only) | View-only | Visible | | Suger Cosell - Azure, Suger Cosell - GCP (and their Read Only variants) | **No access** | Visible | :::warning The Azure and GCP co-sell sets make the **Leads V2 (Suger)** and **Lead Detail (Suger)** tabs visible **without** granting access to the Lead object, so a user holding only one of them opens the tab and sees nothing. Pair them with an AWS co-sell set, or assign **Suger User**, if that person is meant to work leads. Marketplace-only sets carry neither the object nor the tabs. ::: --- ## Funding Permissions Use these permissions to grant access to **AWS Funding** features (e.g., Fours Funding Request objects, funding approval workflows). These are typically assigned in addition to a marketplace permission set when a user needs to manage funding alongside their normal Offer/Entitlement work. | Permission Set Name | Description | | -------------------------- | ------------------------------------------------------------------------------------------ | | Suger Funding | Read/Write access to AWS Funding operations. | | Suger Funding (Read Only) | View-only access to AWS Funding operations. | Both sets make the **Funding V2 (Suger)** tab and the Funding object's own tab visible. Funding records are searchable in Salesforce global search — see [How Funding records open](/salesforce-app/salesforce-app-settings/#how-funding-records-open). --- ## Add-on Permissions These permission sets do not grant a baseline level of access on their own — they layer specific feature capabilities on top of a primary permission set. | Permission Set Name | Description | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Suger User Finance Operation | Grants access to **Finance Operation** features (Cancel / Billing Adjustment) on the Suger Entitlement record page via the `Finance_Operation` custom permission. Finance Operation access also requires AWS marketplace write access (the `Write_AWS_Offer` custom permission), so this add-on **must be combined** with a base permission set that grants it — `Suger User`, `Suger User - Marketplace`, or `Suger User - Marketplace - AWS`. | :::note **AWS EMEA SARL invoices cannot be adjusted through Fours.** AWS requires a KYC-verified user with MFA to adjust an invoice issued by its EMEA entity, and Fours submits adjustments through an integration role, which can never be one. In the **Billing Adjustment** modal those invoice rows keep a disabled checkbox and read *"Issued by AWS EMEA SARL — AWS requires a KYC-verified user to adjust it."*, followed by a **Must be adjusted in AWS ↗** link. When every invoice in the billing term is affected, the same note appears above the table with a **Complete adjustment in AWS Partner Central ↗** link. Both links open the AWS Marketplace agreements page, where you sign in as your own KYC-verified AWS user and make the adjustment. If AWS refuses an adjustment for this reason after it was submitted, its row in the entitlement's **Adjustment Requests** table carries the same **Must be adjusted in AWS ↗** link. This is an AWS restriction, not a permission you can grant. ::: --- ## Custom Permissions For detailed information about the custom permissions included in each permission set, see [Custom Permissions](/salesforce-app/salesforce-app-custom-permissions/).