Roles and permissions

A role decides which pages each person sees and uses. Roles are managed in OrganizationStructureRoles, and each person has a role you can fine-tune on their profile.

Before you start

Everyone has base access even without a role: clocking in, seeing their profile and documents, completing their onboarding and signing what they’re asked to sign. The screen spells this out in What every employee can see by default. Permissions only add pages; they never take that minimum away.

Approving doesn’t depend on permissions alone: a person’s direct manager decides on their requests without holding any. The “Who approves what” section explains it.

The four factory roles

Every company starts with four roles. On screen they are called:

Role	Pages it adds
Admin	All of them. The only role that also decides on its own requests.
HR	Time tracking, Documents, Employees, Onboarding, Time-off control, Clock-in approvals, Expense management, Holidays and time off types. Decides on requests for the whole company. Doesn't include Salaries or billing.
Manager	Time tracking, Schedules, Performance (assigning goals and reviews) and viewing the team's time off. It doesn't open Documents: that page shows every folder in the company.
Employee	None: base access only.

You can change these roles’ permissions, but don’t rename them: the product recognizes them by name.

Who approves what

Time off, clock-in corrections and expenses follow a single rule:

• The direct manager (the Supervisor on the profile) decides on their team’s requests. No permission needed: being their manager is enough.
• Whoever holds the area’s permission (for example, Time-off control) decides on requests from the whole company, within their sub-companies if they’re limited to them.
• Nobody decides on their own requests, except the admin.

To let a manager approve their team, don’t give them the area’s permission: with it they would decide for the whole company. It’s enough for them to be set as their people’s Supervisor. Two exceptions: marking an expense as reimbursed requires the expenses permission, and changing schedules requires the Schedules permission and the person reporting to you.

Creating a role

Assigning a role and adjusting one person

When you add someone with New employee, you pick the Assigned role. Afterwards, on their profile, Role and permissions tab:

Value	What it does
Inherited	Follows whatever the role says
Enabled	Grants it even if the role doesn't include it
Disabled	Removes it even if the role includes it

Editing and deleting a role

The Roles table lists each Role with its Permissions, its Members and the edit and delete Actions. Editing opens the same form, as Edit role. A role with members can’t be deleted: reassign them first.

What happens next

Changes to a role affect everyone who has it. Individual adjustments only affect that person, and they override the role. If your plan includes the Audit log, creating, editing and deleting roles is recorded with author and date.

If something goes wrong

Someone can’t see a page they need. Their role doesn’t include it, or it’s set to Disabled on their profile. Add it to the role, or set it to Enabled for that person only.

I removed a permission from the role and the person still has it. It’s set to Enabled on their profile. Switch it to Inherited.

A manager can’t approve their team’s time off. They aren’t set as Supervisor on those people’s profiles. Set it on each person’s HR tab.

A manager approves requests from people outside their team. They hold the area’s permission, through their role or on their profile. Remove it if they should only decide for their team.

I can’t delete a role. It has Members. Give them another role from their profile and try again.