App roles and permissions
An app role decides which modules and pages a person can open, and whether they can only view them or also make changes. Each user has one app role.
Create a role
- Go to Application roles and select Add role.
- Enter a unique Role name, a Role description, and leave Active on.
- Under Assign module permissions, choose the modules the role can use. For each page in a module, choose Read (view only) or Write (view and change). Use Select all modules or Select all pages to speed this up.
- Save.
Assign a role
- To an employee: set App role in their additional information.
- To any user: set App role in User role mapping.
Typical roles
| Role | Typical access |
|---|---|
| Employee | Own profile, attendance and leave requests, payslips and tax. |
| Manager | Employee pages plus approvals and team views. |
| HR admin | Employee, attendance, leave and configuration pages with Write. |
| Payroll admin | Payroll pages with Write. |
Good practice
- Give each person the smallest role that lets them do their job.
- To limit whose records an admin can see, use data access on the user. See Users and data access.
- A page that shows "Access denied" means the role has no permission for it.