Permissions

In the Permissions tab, you can assign different permissions to each employee. These permissions determine the actions an employee can perform within the system. As an admin, you can also remove roles from employees, as soon as they are no longer relevant. Note, that the Manager role always supersedes the Viewer role. This hierarchy ensures that individuals with managerial responsibilities have broader access and control over system functionalities compared to those with viewing permissions only.

Below is a comprehensive list of the available roles and their descriptions:

• ROLE_ACCOUNTANCY_VIEWER: Allows viewing accountancy-related information.
• ROLE_ADMIN: Grants full administrative access to all system functionalities.
• ROLE_AGREEMENTS_MANAGER: Enables managing agreements, including creation and editing. Also required to read an agreement's pay terms wherever an agreement is shown, including alongside a person on the People list.
• ROLE_AGREEMENTS_UPLOADER: Permits uploading agreements.
• ROLE_BANKS_MANAGER: Allows managing bank details and related information.
• ROLE_BENEFITS_MANAGER: Enables management of employee benefits.
• ROLE_CANDIDATES_MANAGER: Allows managing candidate information.
• ROLE_CLIENTS_MANAGER: Grants access to manage client details.
• ROLE_COSTS_ANALYSER: Permits analysis of costs and expenditures.
• ROLE_COSTS_MANAGER: Allows managing costs within the system.
• ROLE_COUNTRIES_MANAGER: Enables management of country-related information.
• ROLE_CURRENCIES_MANAGER: Allows managing currencies and exchange rates.
• ROLE_DEBT_COLLECTIONS_MANAGER: Permits managing debt collections.
• ROLE_DOCUMENTS_MANAGER: Allows full management of documents.
• ROLE_DOCUMENTS_VIEWER: Permits viewing documents.
• ROLE_EMPLOYEES_MANAGER: Grants permissions to manage employee information.
• ROLE_EMPLOYEES_VIEWER: Allows viewing employee information, including each person's working-time terms. It does not include agreement pay terms.
• ROLE_HOLIDAYS_MANAGER: Enables management of holiday requests and approvals.
• ROLE_HOLIDAYS_VERIFICATOR: Permits verification of holiday requests.
• ROLE_HOLIDAYS_VIEWER: Shown as Time off viewer. Can see every employee's time off and time off requests, without approving or changing them. It opens the time off Requests, Time off history and Planner screens and the Time off requests card on the home page, all read-only.
• ROLE_HR_MANAGER: Grants access to human resources management functionalities.
• ROLE_INVOICES_MANAGER: Allows managing invoices and income-related information.
• ROLE_INVOICES_VIEWER: Permits viewing invoices and income-related information.
• ROLE_LOCATIONS_MANAGER: Grants permissions to manage location details.
• ROLE_ORGANIZATION_USERS_MANAGER: Allows managing organisational users.
• ROLE_PAYMENT_DUE_VIEWER: Permits viewing payment due details.
• ROLE_POSITIONS_MANAGER: Enables management of job positions.
• ROLE_PROFITABILITY_VIEWER: Permits viewing project profitability, including the Project financials tab of a project, without the right to edit projects. It can be granted on its own, directly or through a permission group.
• ROLE_PROJECTS_MANAGER: Grants permissions to manage projects.
• ROLE_PROPERTIES_MANAGER: Allows managing property-related information.
• ROLE_PROPERTY_BOOKINGS_MANAGER: Allows booking resources for other people, and managing every booking, including those held by projects.
• ROLE_RESOURCING_APPROVER: Permits confirming draft bookings into counted coverage, un-confirming them, and declaring what a role needs — in addition to everything a Resourcing manager can do.
• ROLE_RESOURCING_MANAGER: Allows planning in Resourcing — creating draft bookings from the bench, adjusting and deleting them, and importing allocations.
• ROLE_RESOURCING_VIEWER: Gives read-only access to Resourcing — the schedule on the Projects and People views, and the Requests tab with each request's history and decline reasons. Cannot plan, confirm or decline, and does not see the bench or Actuals (so no revenue, cost or margin figures). Granted person by person; it is not part of any default permission group.
• ROLE_RESPONSIBILITIES_MANAGER: Permits managing responsibilities within the system.
• ROLE_ROLES_MANAGER: Enables management of user roles and permissions.
• ROLE_TAXES_MANAGER: Allows managing tax-related information.
• ROLE_TAXES_VIEWER: Permits viewing tax-related information.
• ROLE_TRANSACTIONS_MANAGER: Grants permissions to manage financial transactions.
• ROLE_TRANSACTION_ATTACHMENT_UPLOADER: Allows uploading attachments to transactions.
• ROLE_WORKING_HOURS_MANAGER: Permits viewing working hours for all projects.
• ROLE_WORKING_HOURS_VIEWER: Permits viewing working hours for projects assigned to this user.

Who can see agreement pay terms

The People list and each employee's record show the person's active agreement. Two kinds of information sit there, and they follow different permissions:

• Working-time terms — the contract type and its period, the job size, the hours per week, and whether working time is fixed. These are visible to anyone who can view employee records, because planning and scheduling depend on them.
• Pay terms — the amount, whether that amount is net or gross, and the billing basis. These require ROLE_AGREEMENTS_MANAGER, the same permission the Agreements module itself demands. Someone who can view employee records but does not hold that permission sees the person and their working-time terms, without the pay terms.

Assigning Roles to Employees

To assign a role to an employee:

1. Navigate to the Team members item in the main menu.
2. Click on the "Edit" button to the employee you wish to assign a role to.
3. Click on the Permissions tab.
4. Choose the appropriate roles from the list based on the employee’s responsibilities.
5. Save the changes to apply the new permissions.

By assigning the appropriate roles, you ensure that employees have the necessary access to perform their duties efficiently while maintaining the security and integrity of the system.

Employees who belong to a permission group

Most people get their permissions from a permission group rather than one by one. The Permissions tab still works for them, and what it records is an exception for that one person:

• Ticking a permission the group does not include grants it to this employee alone.
• Unticking a permission the group does include withdraws it from this employee alone.

Neither changes the group, and neither affects anyone else assigned to it. The group remains the baseline, and the tab holds the differences from it — so a person can be moved between groups later without their exceptions having to be rebuilt from scratch.

Two things the tab tells you when a save does not do exactly what the screen showed:

• Permissions changed that the screen does not list. The tab shows the permissions it can present as checkboxes, which is not always every permission a group can carry. If a save affects one that is not on screen, it names it and points you at the person's permission groups rather than changing it silently.
• A save that did not take effect. If the permissions come back unchanged, the tab says so and tells you nothing was applied, instead of reporting success.

Example use cases

• Onboarding a new HR Manager who needs to manage employee details, benefits, and holiday requests.
• An employee transitions from a viewing role to a managerial role, requiring updated permissions to reflect their new responsibilities.
• Restricting a temporary contractor's access to only view specific project documents, without edit capabilities.
• Ensuring that a payroll specialist has comprehensive access to financial data while general employees only have viewing permissions for their own details.