In short
- Roles exist to separate who enters a number from who is accountable for it.
- Give the auditor read-only access rather than a shared login and an email chain.
- Count your data owners before you count your licences. That is what drives the setup.
User roles in a carbon platform decide four things: who can enter data, who can change it after the fact, who can only look, and who closes a reporting period so it stops moving. They matter to anyone whose emissions data comes from more than one person, which in practice is any company with more than one site, more than one legal entity, or a facilities manager and a finance team who do not sit together. The first step is not to configure software. It is to write down every person who touches a number in your inventory and what each of them should be allowed to do to it.
Most companies skip that and hand everyone administrator rights, which works fine until the first time somebody asks why last year's figure changed.
What does a role actually control?
Four distinct powers, and good products separate them.
Entry. Uploading a fuel invoice, a meter read or a purchase export for one part of the business.
Edit and delete. Changing or removing something that is already in the inventory, including something entered by someone else.
Method. Choosing emission factors, setting the organisational boundary, deciding what counts as an entity. This is where a footprint is really made, and it is the power most often handed out by accident.
Close. Locking a period so that the number you reported in March is still the number in November.
A tool that bundles all four into a single administrator level is not offering you access control. It is offering you a shared drive with a nicer interface.
Who actually needs more than one login?
Three situations, and one of them applies to almost everyone reading this.
Data comes from several places. Fuel from the fleet office, electricity from facilities, purchase data from finance, travel from the office manager. Four people, four systems, one inventory. Emailing four spreadsheets to one coordinator is the alternative, and it is where most of the annual effort goes.
You have sites or entities. A depot manager should be able to enter their own consumption and not be able to touch another depot's, let alone the group total.
Someone external will check the work. An auditor, an assurance provider, a certification body or a demanding customer.
If none of the three apply, one login is genuinely enough and you should not pay for anything more complicated.
Which roles does a carbon inventory actually need?
Four, and a fifth if you are audited. The names differ between products, the functions do not.
| Role | What they do | What they must not be able to do | Usually who |
|---|---|---|---|
| Data owner | Enter and upload data for their own site, entity or category | Change the method or another unit's data | Depot, facility or department lead |
| Inventory manager | Set the boundary, choose factors, review and consolidate | Nothing, this is the accountable role | Sustainability or QHSE lead |
| Approver | Close a period and sign off the reported figure | Enter data they then approve themselves | Finance director or board sponsor |
| Read-only viewer | See numbers, export reports | Change anything at all | Sales, bid team, management |
| Auditor | Inspect data, entries and their evidence | Change anything at all | External assurance provider |
The separation that matters most is the last row of column three: the person who approves a figure should not be the same person who entered it. That is ordinary financial control applied to a non-financial number, and it is the thing that turns a footprint into something you can defend in a tender.
Why does an auditor need read-only access rather than a login you share?
Because a shared login destroys the audit trail you are paying to create, and because an audit conducted over email takes three times as long.
When an assurance provider works inside the system with their own account, they can trace an entry back to the file it came from and see who entered it and when. When they work from a PDF and a mailbox, every question becomes a request, and every request costs somebody a day.
There is a related question worth asking any vendor at demo stage: how much of the calculation can a reader actually see? One of our own customers raised exactly this on G2 in July 2026, a Mid-Market reviewer rating us 4 out of 5, who wanted visibility of the conversion factor applied when their input in USD became an entry in EUR, and of which calculator produced the distances in their distribution overview. That is the right question to ask every vendor on your list, because a number you cannot trace back to your own input is a number your auditor will ask about first.
What goes wrong when everyone is an administrator?
Three failures, in a predictable order.
Silent restatement. Somebody corrects a 2026 figure in 2027 for a good reason and tells nobody. The number in your published report and the number in the system no longer match, and neither is wrong exactly.
Method drift. Two people pick different factors for the same activity in different quarters. Your year-on-year trend now includes a change that never happened in the real world.
Nobody owns it. When everybody can edit everything, nobody is accountable for anything, and the annual cycle turns into an archaeology exercise.
None of these are software problems. They are governance problems that software either supports or does not.
What should you check before you buy?
Six questions, all answerable in a demo.
- Can a data owner be limited to one entity, one site or one category?
- Can I give read-only access, and is a read-only user billable as a full seat?
- Can an external auditor get their own account?
- Can a reporting period be locked, and who is allowed to unlock it?
- Is there a change log showing who changed what and when?
- Can a reader see the factor and the conversion behind an entry, not just the result?
The second one has a pricing consequence worth catching early. In some products every login costs the same regardless of what it can do, which changes how you should size a rollout across sites.
How does Hedgehog handle roles, and what are the limits?
The platform does entity management across locations and sites, with user roles for data owners, auditors and managers, which is the structure described above. An AI assistant guides GHG Protocol setup, inventory building, data upload and reporting, so a data owner who has never done this before is not left alone with a blank form. Pricing is on user seats and business entities, from EUR 1,200 a year for Pro, with a free account that needs no sales call.
Two honest limits.
Loading data is still the work. A Small-Business reviewer said on G2 in August 2026, while rating us 5 out of 5, that once the data is loaded everything works perfectly, and that getting it loaded is the challenging part. Roles spread that work across more shoulders, which helps, and they do not remove it.
No role produces a product footprint. Organisational footprints are the platform's job. LCA, EPD, ECI (MKI in Dutch) and PCF work is delivered as consultancy, not as something a data owner fills in on a form.
What should you do first?
List every person who will touch a number this year and put each one in exactly one of the five rows in the table above. Most companies find they need one manager, four to eight data owners, one approver and a handful of viewers, which is a different licence shape than they assumed.
Then check what that costs in your shortlist, because the answer varies more than the headline price does. We go through the rest of the selection criteria in choosing carbon accounting software for SMEs, and you can start a free account or book a meeting to walk through a structure with someone.
Sources: Hedgehog platform and Hedgehog on G2, both read on 27 August 2026. The two reviews quoted are the Mid-Market review of 1 July 2026 and the Small-Business review of 4 August 2026. Page verified 17 September 2026.
Facts on this page were last verified on 2026-09-17.
