Roles and permissions
Who can do what in HR: inbuilt and custom roles, permissions by module, scope by location and criteria, users, and what managers see of their team.
Setup › Roles & permissions decides who can do what in HR. It has four tabs: Roles, Users, Relationship roles and Designation defaults.
Roles
A role is a set of permissions. Permissions are grouped by module (People, Time & attendance, Leave, Approvals, Month close, Payroll, Tax, Expenses, Assets, Training, Performance, Wall, Helpdesk, Reports, Setup) and use the same verbs everywhere: view, download, add, update, delete, approve, manage, import, run, lock, release.
The list shows three kinds of role:
- Inbuilt roles are ready to use and cannot be edited: HR manager (with salary, bank and ID details), HR executive (without them), Payroll admin, Asset manager and Expense manager. You can give them to people and copy them.
- Default roles came with your company (HR admin, Finance, Outlet manager, Shift supervisor, Staff, Department manager) and stay editable.
- Custom roles are the ones you create or copy.
The Owner row at the top holds every permission. Owners are managed in HQ, not here.
View on any role opens its permissions with a search, an Allowed / Restricted filter and a count per module. Some permissions are marked Organisation only: they apply only when the role is given for the whole organisation. Some carry a warning, for example that a released payroll run is final; turning one on asks you to confirm.
Payroll is split so that no inbuilt role both prepares and approves a run.
Giving a role to people
Open a role and choose Manage users. People are added in scope blocks:
- Organisation: everything, everywhere;
- Criteria: chosen locations (or all locations), entities, departments, designations, employment types and pay groups. People get the role only for the employees who match.
Organisation-only permissions do not apply inside a criteria block; the block says how many permissions apply. Save shows what will change before it saves.
Blocks that come from designation defaults or department heads are shown read only, with where they come from.
Users
The Users tab lists everyone with HR access, their roles and how many permissions they have in total. Manage opens one person’s roles, where you can add or remove a role. You cannot change your own access.
Relationship roles
Managers see their team in My Team through relationships, not roles. The grid sets what each relationship can see: Reporting manager, L2+ manager (every level above the direct manager), Department head and Outlet manager. Who approves a request is set by each policy’s approval chain, not here.
Safeguards
- You can never give a permission or a scope wider than your own.
- You cannot change your own access, and only an owner can change another owner’s access.
- The last person who can manage roles cannot be removed.
- A person needs a login before they can be given access: invite them first.
- Every change is recorded: History on a role lists who changed what and when.
Importing role assignments
Setup › Data import › Roles › Role assignments gives many people their roles and scope from one spreadsheet. It only ever adds access. See Data import.