---
title: "Page & Report Permissions"
space: "Frappe Framework"
url: "https://www.prilk.com/docs/frappe-framework/page-report-permissions"
updated: "2026-05-14"
---

## Page & Report Permissions

Standard Frappe permissions work at the **DocType** level. Pages (custom desk pages like the Setup Wizard) and Reports (Query Reports, Script Reports) have a separate authorization mechanism.

### Why pages and reports are different
A Page or Report isn't a DocType — it's a code asset shipped by an app. There's no row-by-row data to apply Role Permissions to. Instead, Frappe attaches a list of allowed roles directly to each Page or Report record.

### Configuring Page permissions
1. Open the **Page** record (search "Page" → click the page name)
2. In the **Roles** child table, add the roles allowed to access it
3. Users without any matching role get "Not Permitted" when they try to load the URL

Empty Roles list = accessible to **all logged-in users**.

### Configuring Report permissions
Same mechanism on the **Report** record:
1. Open the Report (search "Report" → click the report name)
2. **Roles** child table — add allowed roles
3. Empty list = visible to all logged-in users

For Query / Script Reports, you can also restrict at the DocType-permission level — if a user can't read the underlying DocType, they won't see the report's data either, regardless of the report's Roles.

### Custom Roles for shipped pages and reports
Standard pages and reports come with default Role lists baked in by their app. To customise without forking:
- Open the Page or Report record and edit the Roles child table directly
- Changes survive app upgrades since they live on the record, not in source code

### Restrict by Domain
Pages and Reports can also be filtered by **Domain** (Manufacturing, Education, etc.) — useful in multi-vertical ERPNext setups so the Manufacturing dashboard doesn't appear for a Services-only site.

### Permission Levels do NOT apply
Unlike DocType fields, Pages and Reports don't have permission levels. Access is binary — role match grants full access; no match denies entirely.

### Finding the record to edit
- For a Page, the **route** in the URL (`/app/<page-name>`) maps to the Page record name
- For a Report, search Awesome Bar for the exact report name to jump to its definition