Users

This page explains how to manage ToolBox users and their access levels. The ToolBox Users page controls who can use Erik's ToolBox features and what operations each user is allowed to perform. Understanding the user management system is essential for maintaining proper security and accountability in your environment.

User Management Overview

Erik's ToolBox includes a built-in user management system that operates alongside the standard Business Central permission model. While the Business Central SUPER role controls access to ToolBox pages, the ToolBox user system controls what operations each user can perform within those pages -- particularly around data modification.

The user management system is built on two key components:

ToolBox Users -- Stores user records and their assigned access levels.
ToolBox Users -- The page where administrators view and manage user entries.

Because the user table has the DataPerCompany = false property, user records are shared across all companies in the same Business Central environment. You configure users once per environment, and their access level applies to every company within that environment.

Access Levels

The ToolBox defines three access levels that control what a user can do when executing scripts and working with data. Each level builds upon the previous one, adding more capabilities.

Level	Description	Can Do	Cannot Do
ReadOnly	View-only access to ToolBox features	View code, view data, run queries, produce output	Edit data, insert or delete records, manage users
WriteNormalTables	Standard write access for everyday use	Everything ReadOnly can do, plus insert, modify, and delete records in normal (non-protected) tables	Edit protected or system tables, manage users
GodMode	Full administrative access with no restrictions	Everything, including modify protected and system tables, manage users, access all features	Nothing restricted

ReadOnly

ReadOnly is the most restrictive access level. When you have ReadOnly access:

You can run scripts that query data and produce output.
You can view table data through the Data Inspector.
You can use the Object Inspector to browse objects.
Any attempt to insert, modify, or delete records results in an error.
This is the default level assigned to new users when they are added to the ToolBox.

ReadOnly is appropriate for users who need to run reports, analyze data, or view system information without the risk of accidental changes. It is also the level enforced for all users when the ToolBox is not registered (no valid license) in a production or on-premises environment.

WriteNormalTables

WriteNormalTables provides standard write capabilities for everyday use. When you have WriteNormalTables access:

You have all ReadOnly capabilities.
You can run scripts that insert, modify, or delete records in standard Business Central tables.
You cannot modify protected system tables (such as certain ledger tables and setup tables that Business Central marks as protected).
This level is automatically assigned when a user accesses the Run Programs page and is not found in the ToolBox user list.

WriteNormalTables is appropriate for power users and consultants who need to run data processing scripts, bulk modifications, and other operational tasks without the risk of accidentally modifying critical system tables.

GodMode

GodMode provides unrestricted access to all ToolBox features and all tables. When you have GodMode access:

You have all WriteNormalTables capabilities.
You can read from and write to any table in the system, including protected and system tables.
You can add, modify, and remove other users from the ToolBox user list.
All operations on protected tables are logged in the audit trail.
When you modify a protected table for the first time in a session, a warning confirmation dialog is displayed.
You can restore the GodMode warning dialogs if they have been dismissed.

GodMode should be limited to system administrators who genuinely need unrestricted access. Because of the power this level provides, all GodMode operations on protected tables are recorded in the audit trail for accountability.

First User Initialization

When the ToolBox Users page is opened for the first time in a new environment, the system automatically creates the first user entry:

The system checks if the ToolBox Users table is empty.
If the table is empty, the current user is automatically added with the GodMode access level.
This ensures that the first administrator always has full control over user management from the very beginning.

This initialization happens in the OnOpenPage trigger of the ToolBox Users page. After the first user is created, all subsequent users must be added manually by a GodMode user.

Important: Plan your initial setup carefully. The first person to open the ToolBox Users page in a new environment becomes the first GodMode user. Ensure this is the intended administrator for your environment.

Managing Users

Accessing the User List

To access the ToolBox Users:

Open the ToolBox Setup page (requires SUPER role in Business Central).
Choose the Users action in the action bar.

The User List displays all registered ToolBox users and their access levels.

User List Fields

The ToolBox Users page displays the following columns for each user:

Field	Description
User Name	The Business Central login ID, automatically populated from the BC User table when the user is added.
Full Name	The display name from the Business Central User table. This field is populated automatically and cannot be edited directly in the ToolBox.
Access Level	The assigned access level: ReadOnly, WriteNormalTables, or GodMode. This is the field you modify to change a user's permissions.
Audit Trail	A FlowField that displays the count of audit trail entries for this user. You can click on this field to drill down and view the user's detailed audit trail history.

Adding a New User

To add a new user to the ToolBox:

Open the ToolBox Users page.
Choose the Add User action.
A lookup page showing all Business Central users appears.
Select the user you want to add and choose OK.
The user is added with the ReadOnly access level by default.
Change the Access Level field to the desired level if ReadOnly is not appropriate.

Note: You must have GodMode access to add users. If you do not have GodMode access, the error "You do not have permission to add users" is displayed.

Modifying a User's Access Level

To change an existing user's access level:

Open the ToolBox Users page.
Locate the user in the list.
Change the Access Level field to the desired value (ReadOnly, WriteNormalTables, or GodMode).

Note: Only GodMode users can modify other users' access levels. If you attempt to modify a user without GodMode access, the error "You do not have permission to modify users" is displayed.

Deleting a User

To remove a user from the ToolBox:

Open the ToolBox Users page.
Select the user in the list.
Press Delete or use the standard delete action.

Note: Only GodMode users can delete other users. Deleting a user from the ToolBox user list does not affect their Business Central user account. It only removes their access to ToolBox features.

Restoring GodMode Warnings

When a GodMode user accesses a protected table, a warning dialog appears the first time for each table during the session. After you acknowledge the warning, it does not appear again until the next session. The ToolBox Users page includes a Restore GodMode warnings action that resets these warnings, so they appear again on the next access. This is useful if you want to re-enable the safety prompts after dismissing them.

How Access Levels Affect Script Execution

When a script is executed in the ToolBox, the system checks the current user's access level and enforces restrictions on data operations:

Operation	ReadOnly	WriteNormalTables	GodMode
Read records (FindFirst, FindSet, Get, etc.)	Allowed	Allowed	Allowed
Insert records in normal tables	Blocked	Allowed	Allowed
Modify records in normal tables	Blocked	Allowed	Allowed
Delete records in normal tables	Blocked	Allowed	Allowed
Insert/Modify/Delete in protected tables	Blocked	Blocked	Allowed
Manage ToolBox users	Blocked	Blocked	Allowed

If a script attempts an operation that exceeds the user's access level, an error is raised and the operation is prevented. The script execution stops at the point of the unauthorized operation.

Access Level and the Run Programs Page

The Run Programs page has special handling for users who are not in the ToolBox user list. When a user who is not registered in the ToolBox user table opens the Run Programs page:

The system detects that the user is not in the ToolBox user list.
The user is automatically treated as having WriteNormalTables access for the duration of their Run Programs session.
This allows non-administrator users to execute pre-built scripts that have been assigned to them.

This automatic assignment only applies to the Run Programs page. For all other ToolBox features, the user must be explicitly added to the user list by a GodMode user.

Unregistered License Behavior

If the ToolBox is not registered (no valid license) and the environment is not a SaaS sandbox, the access level is automatically downgraded to ReadOnly regardless of the user's configured level. This means:

In a SaaS sandbox environment, the configured access level is always honored.
In a production or on-premises environment without a valid license, all users are restricted to read-only access.

This ensures that the full data modification capabilities of the ToolBox are only available in properly licensed environments.

Security Considerations

When managing ToolBox users, keep the following security guidelines in mind:

Limit GodMode users -- Only system administrators who need to modify protected tables or manage other users should have GodMode access. The fewer GodMode users you have, the smaller your risk surface.
Use ReadOnly as the default -- New users are added with ReadOnly access by default. Only upgrade to WriteNormalTables or GodMode when the user's role requires it.
SUPER role is separate -- The Business Central SUPER role and the ToolBox GodMode access level are independent. A user can be SUPER in Business Central but ReadOnly in the ToolBox, and vice versa. Both layers must be satisfied for a user to perform an action.
Audit trail accountability -- All user actions are logged in the audit trail. Review the audit trail regularly to monitor what operations are being performed and by whom.
Coordinate across companies -- Because user records are shared across all companies in the environment, a change to a user's access level affects every company. Ensure that access levels are appropriate for the user's role across all companies.

Tips and Best Practices

Keep the number of GodMode users to a minimum. Only system administrators who need unrestricted access should have this level.
Use ReadOnly for users who only need to run queries, generate reports, or view data.
Use WriteNormalTables for power users and consultants who need to modify data in standard tables.
Review the audit trail regularly to monitor GodMode operations, especially on protected tables.
When setting up a new environment, coordinate with your team to ensure the intended administrator is the first person to open the ToolBox Users page.
Document which users have been assigned to each access level and review this list periodically as part of your security governance process.
Remember that deleting a ToolBox user does not affect their Business Central account. If you need to revoke all access, you must address both the ToolBox user list and the Business Central user or permission setup.