How custom roles affect permissions
A custom role may look like a way to restrict purchase order access. In Ramp, it only adds to the permissions a user already has through their base role.
Ramp assigns a custom role alongside a base role. The user keeps the permissions from both. Removing a permission from the custom role does not remove it from the base role.
The base Employee role cannot be removed
Every standard Ramp user has one base role: Admin, Owner, Bookkeeper, or Employee. A user cannot be assigned only a custom role, and switching to a higher base role adds access.
If the Employee role grants an action, leaving that permission out of a custom role will not prevent the user from performing it.
NetSuite roles work differently. A NetSuite custom role defines its own permission set without a mandatory base role adding permissions. Review Ramp’s effective permissions when translating controls from NetSuite.
What base Employees can and can't do with POs
A base Employee does not have “Edit all procurement requests” by default. Without that permission, changes to primary fields on an approved PO, such as vendor, amount, line items, and delivery dates, must go through a Change Order and its approval workflow.
To verify this is the case for your users, confirm at the role level:
- Go to Company → People → (...) Customize Role Permissions and open the Employee role.
- Under Procurement, confirm Edit all procurement requests is not checked.
- Confirm no custom role assigned to those users grants it either.
- Check whether users have an Admin, Owner, or Bookkeeper base role. These roles can edit approved POs directly.
PO owners can still close or cancel their requests
Purchase order ownership grants some access independently of role settings.
A user can cancel or close a PO they submitted. Ramp ties this access to ownership of the request, and it cannot be removed through a role setting.
Use Change Orders for approved PO changes
When a user does not have “Edit all procurement requests,” primary fields on an approved PO must be changed through a Change Order. A Change Order:
- Can be submitted by the request owner, approvers, AP Clerks, and Admins
- Is only available when the PO is in Approved state, but not while it is still in the approval queue
- Triggers the same approval workflow as the original PO by default, or a separate change order workflow if one has been configured in the Spend Program
- Records changes, approvals, and rejections in the PO’s activity history
To set up a dedicated approval workflow for change orders, navigate to the relevant Spend Program and toggle off "Use the same approval workflow for change orders" to define a separate policy.
Requesting the ability to remove the Employee base role
Ramp requires a base role alongside any custom role. This limits the ability to create a procurement role that can submit a request but cannot close or cancel it, because ownership still grants those actions.
If this affects your controls, describe the requirement to Ramp support and request an enhancement. Ramp passes product feedback to its product team; its current process does not provide a tracking number or status updates.
Summary of available controls
| Scenario | Configurable in Ramp? |
|---|---|
| Prevent Employee from editing approved PO fields | Yes: ensure "Edit all procurement requests" is not granted |
| Require Change Order instead of direct edit | Yes: automatic when edit permission is absent |
| Separate approval workflow for Change Orders | Yes: configurable per Spend Program |
| Prevent submitter from closing/cancelling their own PO | No: tied to request ownership, not configurable |
| Assign a user only a custom role (no Employee base) | No: Employee base role is mandatory for all standard users |
| Custom role that subtracts Employee base permissions | No: custom roles are additive only |