Roles & Permissions

How access is decided

Access is controlled by role-based permissions. A role grants a set of modules; assign it to someone and they get exactly that. Anything not granted is hidden from their menu and refused by the API — this is enforced on the server, not just in the interface.

Two axes, both must allow it

Access depends on both your subscription and the person's role:

• Your plan decides which modules exist in your workspace at all.
• Their role decides which of those modules that person may use.

A module your plan does not include stays unavailable even if a role grants it. Granting a module in a role can never exceed your plan.

Creating a role

1. Go to Settings → Roles & Permissions & Permissions and click New Role.
2. Name it for the job, not the person — IT Engineer, Finance, Viewer.
3. Grant the modules that job needs, and only those.
4. Save.

Assigning a role

Assign the role on the user in Settings → Users, or on the employee's access section in HCM → Employees. Only Admins and Super Admins can grant or change platform access; HR and management roles can edit employment details but not access.

Changing a role

Editing a role changes access for everyone assigned to it, immediately. Check who holds a role before you remove a module from it.

Leaving a role unset

A user with no role assigned falls back to the workspace default, which may be more or less than you intend. Assign roles explicitly rather than relying on the fallback.

Tip: Grant the minimum that lets someone do their job, then add on request. Starting broad and trimming later means nobody ever tells you what they did not need.