Getting started

Permissions, roles, and Access Denied

Conterminal decides what you can open from four things: your workspace type, your role in that workspace, a per-feature capability, and per-record access. The Access Denied screen tells you none of them. This article maps each gate so you can name the one that stopped you and send support something they can act on.

7 minute read · Updated July 26, 2026

The denial screen deliberately says nothing about the reason.

Every blocked page lands on the same screen: a red shield, the heading Access Denied, and one sentence — “You do not have permission to view this page. Please contact your administrator if you believe this is an error.” It does not name the page, the missing permission, or your workspace. A screenshot of it carries no diagnostic information at all. The address bar does.

The four reasons a page is denied

Four independent checks stand between you and a page. Three of them produce the Access Denied screen; the fourth produces a plain not-found page instead, which is why “it says the container doesn't exist” and “it says access denied” are different problems with different fixes.

1. Workspace type: Carrier, Importer (BCO), Forwarder/Broker, Warehouse, or Personal tracking. Most pages name the types they admit outright. Dispatch and Timecards are carrier-only. Steamship Line Agreements is Importer-only. The Container Dashboard admits Forwarder, Carrier, and Warehouse but not Importer.
2. Role: tenant_admin, tenant_manager, tenant_user, or collaborator. Roles gate less than most people expect: Admin, Billing, Partner Access, Tracking Adapters, Network Companies, the driver roster, Integrations, and Quotes. Everything operational is open to every role in the workspace.
3. Capability: Each workspace carries a fixed set of capability switches — document review, on-water, dispatch, per-diem watch, managed tracking, spreadsheet import, and so on. They are recomputed from your workspace type and role on every page load, and they are not visible or editable anywhere in the app.
4. Per-record access: Whether this particular delivery order or operation job is visible to your organization. This is the only check that runs per row rather than per page, and it is the only one that produces a not-found page.

How to tell the failures apart

Access Denied, still inside the app. The header and rail are intact and the URL is /protected/unauthorized. Reasons 1, 2, and 3 all land here. Sometimes the URL carries a query parameter — ?reason=missing_portal_membership means the page admits only Importer, Forwarder, and Warehouse workspaces and your active workspace is a carrier workspace. The screen never displays that text. Read it out of the address bar and put it in your support message.
A plain not-found page. That is reason 4. A delivery order or operation job your organization is not party to is treated as nonexistent rather than forbidden, so you get a 404 rather than Access Denied. A malformed or truncated ID in the URL produces the same page, so check for a link that got cut in half by an email client before assuming a permission problem.
A sign-in error page instead. If you see the heading Unable to sign in with “Access denied. You are not authorized to access this application.” and a Try again button, this is not a page permission. Conterminal could not resolve any workspace for your account and signed you back out — usually no active organization membership. See Sign in and find your way around, then contact support.
Nothing happens at all. No error, no navigation, a menu item that stays greyed out, a button that was there last week. That is not a denial — see Why a control disappeared.

The Return to workspace button on the Access Denied screen sends you to /protected, which has no page of its own in the current build, so you land on a not-found page. Use /protected/home instead — it reads your workspace and forwards you to the correct landing screen. The Sign out button beside it works normally.

What each workspace type can and cannot reach

You do not pick your workspace and there is no workspace switcher. If your account belongs to more than one organization, Conterminal chooses: a carrier workspace outranks a forwarder workspace, which outranks Importer and Warehouse workspaces, which outrank personal tracking. Ties go to your oldest membership, then to your highest role. Organizations that are inactive or have been merged are skipped entirely. The name of the workspace you are actually in appears in small type under your name in the user menu — top right on wide screens, at the bottom of the rail on narrow ones. Check it first. If it is not the company you expected, nothing below will match what you see.

Carrier (trucking)

Signs you in at: Today, at /protected/operations/home.
Open to every role: Task Queue, Vessel Tracking, Container Dashboard, Shipment Status Reporting, Dispatch and Scheduling, Timecards, shipment detail and editing, Companies, the header container-tracking box, Settings.
Role-gated: Billing and Quotes need tenant_admin or tenant_manager. Admin, the driver roster, and Integrations need tenant_admin. Timecards are viewable by every role but only tenant_admin and tenant_manager can edit them, which is enforced when you save rather than when you open the page.
Not in this workspace type: Partner Access, Tracking Adapters, Steamship Line Agreements, spreadsheet upload and tracking imports, and the Entities pages. Carrier workspaces are also excluded from every page that checks portal membership — that is the source of ?reason=missing_portal_membership.

Forwarder / Broker

Signs you in at: Today, at /protected/operations/home.
Open to every role: Document Review, Shipment Status, Container Dashboard, Shipment Status Reporting, Vessel Tracking, spreadsheet upload and tracking imports, the container watchlist, per-diem watch, Companies, Settings.
Role-gated: Partner Access and Tracking Adapters need tenant_admin. Network Companies needs tenant_admin or tenant_manager.
Not in this workspace type: Billing is switched off for forwarder workspaces outright — no role and no per-user setting turns it on. Dispatch, Timecards, Admin, the driver roster, and Steamship Line Agreements are also unavailable.

Importer (BCO)

Signs you in at: Shipment Status, at /protected/operations.
Open to every role: Document Review, Shipment Status, Vessel Tracking, Delivery Appointments, Steamship Line Agreements, spreadsheet upload and tracking imports, Companies, Settings.
Role-gated: Partner Access and Tracking Adapters need tenant_admin. Network Companies needs tenant_admin or tenant_manager. Billing follows a per-user billing flag on your organization membership rather than your role, so two tenant_admins in the same Importer workspace can legitimately differ.
Not in this workspace type: The Container Dashboard and the Shipment Status Reporting grid are closed to Importer workspaces, and so is the container watchlist that lives inside them. The per-diem watch alert in the header is off. Dispatch, Timecards, and Admin are unavailable.

Warehouse

Signs you in at: The Container Dashboard, at /protected/operations/dashboard.
Open to every role: Container Dashboard, Shipment Status Reporting, Vessel Tracking, shipment detail pages, Companies, the header container-tracking box, Settings.
Role-gated: Nothing. Warehouse capabilities are identical for tenant_admin, tenant_manager, tenant_user, and collaborator. Promoting a warehouse user changes nothing about what they can open, so do not ask for a role change to fix a warehouse access problem.
Not in this workspace type: Document Review, Billing, Partner Access, Network Companies, Tracking Adapters, spreadsheet imports, per-diem watch, the container watchlist, and the Shipment Status nav entry.

A personal tracking workspace is narrower than all of them: one page, My Tracking, and nothing else. No left rail, no header tracking box, no operations pages, no Document Review. If you were expecting a company workspace and you see only My Tracking, your account is not attached to your organization yet. That is a support request, not a settings change.

What each role adds

Your role is derived from your organization membership, not set separately: an admin membership becomes tenant_admin, an editor becomes tenant_manager, and a viewer becomes tenant_user in a carrier workspace or collaborator in every other type. If you hold two memberships in the same organization, the higher of the two wins.

tenant_admin: The only role that opens Admin and the driver roster in a carrier workspace, Integrations, Partner Access, Tracking Adapters, and shipment-visibility management. In a carrier workspace it also carries Billing.
tenant_manager: Adds Billing and Quotes in a carrier workspace, and Network Companies in Importer and Forwarder workspaces. It does not open Admin, the driver roster, Integrations, Partner Access, or Tracking Adapters.
tenant_user: The standard carrier operator: the full Task Queue, dashboards, Dispatch, Timecards, and shipment detail, with no administrative pages and no Billing.
collaborator: The standard non-carrier viewer. Page-level access is identical to tenant_user; the real difference is per-record — a collaborator sees only the delivery orders shared with their organization.

Because tenant_user and collaborator resolve to the same page-level access, re-inviting someone at the same viewer level will never open a page. If a colleague is blocked, the fix is either a promotion to tenant_manager or tenant_admin, or a workspace-type question — and in a warehouse workspace it is never a role question.

Why a page can be missing from the rail but still reachable by URL

The left rail and the page rules are two separate lists, and the rail is the stricter of the two. A page absent from the rail is very often still yours to open. Four patterns account for nearly every report of a “hidden” page.

It is in the user menu, not the rail. This is the big one. In a carrier workspace, Dispatch, Scheduling, Billing, Admin, Network Companies, and Integrations never appear in the rail at all — they live under the Workspace heading inside the user menu. In Importer, Forwarder, and Warehouse workspaces the same menu carries Shipment Status or Container Dashboard, plus Partner Access, Network Companies, and Tracking Adapters when your role allows them. Open the menu before concluding a page is gone.
It is excluded from the rail on purpose. Shipment Status is flagged as not-in-primary-nav for Importer and Forwarder workspaces even though it is the Importer sign-in destination and /protected/operations opens normally. It is in the user menu instead.
It has no index screen anywhere. Terminal, steamship line, vessel, and company detail pages are reached by clicking a name inside a shipment, a report grid, or the Companies directory. There is no rail entry that lists them, and there never was.
Breadcrumbs drop what you cannot open. The breadcrumb trail is filtered through the same page rules, so a parent you have no access to is removed rather than rendered as a dead link. A trail that looks truncated is usually behaving correctly.

Why a control disappeared instead of erroring

Conterminal hides what you cannot use rather than showing it and failing on click. That is intended, and it is why two people describing the same screen can describe different buttons. Nothing here is a fault.

The whole left rail: Present for carrier workspaces and for Importer, Forwarder, and Warehouse workspaces. Personal tracking workspaces have no rail at all.
The header tracking box: Present in carrier, Importer, Forwarder, and Warehouse workspaces. A personal tracking workspace does not get it even though tracking is the only thing it does.
The per-diem watch alert: Carrier and Forwarder workspaces only, and only while the feature is switched on for the environment. Importer and Warehouse workspaces never show it.
The document-review rail: Carrier, Forwarder, and Importer workspaces. Warehouse workspaces do not get it, because Document Review is not part of that workspace type.
The Admin shortcut: Appears only when your workspace carries the admin capability — in practice a carrier tenant_admin. Otherwise a workspace-specific shortcut takes its place, or none at all.
Individual nav entries: Document Review, Billing, Delivery Appointments, Steamship Line Agreements, Partner Access, Network Companies, and Tracking Adapters each carry their own condition and disappear independently of each other.

Why counts and rows look stale

The list screens refresh themselves on a timer, and the timer is suppressed under a specific list of conditions. None of them are errors, and none of them are permission problems. If a colleague can see a container you cannot, work through this list before escalating.

Where auto-refresh runs

Only on the list screens: the Task Queue / Document Review inbox, Shipment Status, the Container Dashboard, and Shipment Status Reporting. It fires every 60 seconds, plus whenever the window regains focus and whenever the tab becomes visible again. A shipment detail page never auto-refreshes, and neither does the confirm or parse workflow — those are deliberately left alone so a record cannot change while you are typing into it.

What suppresses the refresh

The tab is not visible: A background tab or a minimized window never refreshes. The pending refresh fires the moment you come back to it.
A shipment is open: Opening a shipment from a list — as the side overlay or as its own page — stops the refresh for as long as it is open.
You touched the list in the last five seconds: Any filter, sort, or view change holds the refresh off briefly so your selection is not reverted mid-edit.
Your cursor is in a field: If focus sits in any text box, text area, dropdown, or editable cell, the refresh is skipped entirely. A search box you never clicked out of will hold a screen stale indefinitely.
A dialog is open: Any open modal blocks the refresh until it is dismissed.
It refreshed moments ago: Refreshes are spaced at least three seconds apart, so rapid focus changes do not stack up.

A refresh only re-reads what Conterminal has already stored. It does not reach out to a terminal, railroad, or steamship line. Container milestones change when LongShorty next signs in to those systems and updates the record; reloading the page faster does not make that happen sooner. See Find your containers on the Container Dashboard for where each column comes from.

Known limitations we are fixing

These are current defects rather than policy. Reporting them again does no harm, but knowing them will save you an afternoon.

The watchlist fails silently in Importer (BCO) workspaces

The Add to My Watchlist entry is rendered in the Actions menu on every shipment detail page, Importer workspaces included. The watchlist itself is served by the reporting layer, which admits only Forwarder, Carrier, and Warehouse workspaces. In an Importer workspace the lookup is rejected, the menu entry never leaves its loading state, and it sits there disabled reading “Loading My Watchlist...” with a spinner. It is not a slow network and clicking it does nothing. No error is shown, because the rejection is swallowed. There is no in-app workaround from an Importer workspace.

The wider consequence: in an Importer workspace the Container Dashboard and Shipment Status Reporting grid — the two screens that actually display a watchlist — are closed anyway, and the per-diem watch alert is off, so there is nowhere a saved container would have appeared. Do not spend time hunting for the list.

Delivery Appointments is nav-gated to Importer workspaces

The Delivery Appointments nav entry is shown only to Importer (BCO) workspaces. The page itself has no such restriction: it scopes to whichever organization is the receiving party on the delivery order, which in practice is very often the warehouse. So a warehouse team that is the receiver gets no link to the screen built for them, even though /protected/appointments loads and works if you type it in. Bookmark it until the nav entry is corrected, and see Propose, accept, and schedule delivery appointments.

The denial reason is computed and then thrown away

Some denials attach a reason to the URL — ?reason=missing_portal_membership is the common one — but the Access Denied screen ignores every query parameter and renders the same generic sentence regardless. Copy the full URL, reason included, into any support message. It is the single most useful thing you can send us.

Troubleshooting

A colleague can open the page and I cannot

Compare the workspace name under each of your names in the user menu first. Two people at the same company are often in different workspaces, and a Forwarder workspace and an Importer workspace behave very differently. If the workspace matches, compare roles: admin, editor, and viewer memberships resolve to different access.

A link from an email or a colleague gives Access Denied

That is a page your workspace type does not include, not a record you lack rights to — a record you cannot see gives a not-found page instead. Send the exact URL rather than a screenshot: the URL identifies the page and the denial screen does not.

Access Denied on the Container Dashboard

The Container Dashboard and the Shipment Status Reporting grid admit Forwarder, Carrier, and Warehouse workspaces only. Importer workspaces are excluded today; use Shipment Status at /protected/operations instead.

Return to workspace lands on a not-found page

That button targets /protected, which has no page in the current build. Open /protected/home instead and it will forward you to the correct landing screen for your workspace type.

I was promoted but nothing changed

Reload the page — your role is re-read on every page load, so no sign-out is needed. If it is still blocked, confirm the promotion was to tenant_manager or tenant_admin: viewer-level roles all resolve to the same access, so a re-invite at the same level changes nothing. In a warehouse workspace no role change alters access at all.

A number on the dashboard has not moved in an hour

Work the suppression list above: a cursor left in a filter box, an open dialog, an open shipment, or a background tab each stop the 60-second refresh. Click an empty part of the page and reload. If the underlying milestone genuinely has not changed, that is a tracking-source question rather than a refresh one.

Add to My Watchlist spins forever

You are in an Importer (BCO) workspace, where the watchlist lookup is rejected and the menu entry stays disabled on Loading My Watchlist. Known defect, no in-app workaround.

Unable to sign in — access denied, not authorized

That is the sign-in error page, not a page permission, and you have been signed back out. Your account resolved no active workspace at all, usually a missing, inactive, or merged organization membership. Contact support with the email address you used.