# Roles and access

> The eight roles, the permissions each one holds, and how data scopes limit what a login can see.

Every login in a workspace has one **role**. The role decides which modules appear in the sidebar and what the person can change. A **data scope** can then narrow which branches, clients, sites or employees they see.

## Roles

| Role               | Typical person                  | Can do                                                                                                                                        |
| ------------------ | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| **Admin**          | Owner, head of operations       | Everything, including logins, roles, scopes, settings and software policy.                                                                    |
| **Ops Manager**    | Operations manager              | Employees, deployments, rosters, attendance, leave, billing, compliance, client service requests, master data (clients, sites, organization). |
| **HR Manager**     | HR team                         | Employees, onboarding, documents, consents, verifications, KYC, deployments, leave, payroll, compliance.                                      |
| **Supervisor**     | Site supervisor                 | Attendance and rosters, leave and compliance for their scoped site(s): run the muster, mark and correct attendance.                           |
| **Field Employee** | Guard, housekeeping, technician | Their own check-in and check-out on the phone; their own roster, attendance and leave.                                                        |
| **Client**         | The customer's facility manager | The Daily Report, Client Portal, read-only billing and invoices, and compliance items for their own sites, and their own customer group and contracts.                                    |
| **IT Admin**       | IT team                         | Logins, devices, activity tracking and software security.                                                                                     |
| **Viewer**         | Auditor, management             | Read-only access across the workspace.                                                                                                        |

## Permissions by role

These are the permission codes each role holds. A page or button that needs a permission is hidden or disabled without it.

| Permission                                        | Admin | Ops Manager | HR Manager | Supervisor | Client | IT Admin |
| ------------------------------------------------- | ----- | ----------- | ---------- | ---------- | ------ | -------- |
| tenant.manage (workspace settings, scopes)        | ✓     |             |            |            |        | ✓        |
| identity.manage (logins and members)              | ✓     | ✓           | ✓          |            |        | ✓        |
| audit.read (audit log)                            | ✓     | ✓           | ✓          |            |        | ✓        |
| master_data.manage (organization, customer groups, clients, contracts, sites) | ✓     | ✓           |            |            |        |          |
| employees.manage                                  | ✓     | ✓           | ✓          |            |        |          |
| onboarding.manage                                 | ✓     |             | ✓          |            |        |          |
| documents.manage                                  (incl. document rules and waivers) | ✓     |             | ✓          |            |        |          |
| consents.manage / verifications.manage            | ✓     |             | ✓          |            |        |          |
| kyc.manage                                        | ✓     |             | ✓          |            |        |          |
| onboarding.manage also covers HR approval (prepare, approve, collect signatures) | ✓ | | ✓ | | | |
| payroll.manage also covers the salary table | ✓ | | ✓ | | | |
| deployments.manage                                (incl. Approve & Deploy and client NDAs) | ✓     | ✓           | ✓          |            |        |          |
| rosters.manage                                    | ✓     | ✓           |            | ✓          |        |          |
| attendance.manage                                 | ✓     | ✓           |            | ✓          |        |          |
| leave.manage                                      | ✓     | ✓           | ✓          | ✓          |        |          |
| payroll.manage                                    | ✓     |             | ✓          |            |        |          |
| billing.manage                                    | ✓     | ✓           |            |            |        |          |
| billing.period.unlock                             | ✓     |             |            |            |        |          |
| billing.manual.review                             | ✓     | ✓           |            |            |        |          |
| compliance.manage                                 | ✓     | ✓           | ✓          | ✓          |        |          |
| service_requests.manage                           | ✓     | ✓           |            |            |        |          |
| software.manage (software security)               | ✓     |             |            |            |        | ✓        |

Field Employee and Viewer hold no manage permissions. A Field Employee can still read and act on their own records, such as their roster, their attendance and their check-ins. **Administration → Role Permissions** shows this list for your workspace.

## Data scopes

A scope limits one member to part of the workspace. Set it in **Administration → Data Scopes → Assign scope**: choose the **Member**, the **Scope type** and the **Scope target**, then press **Assign**.

| Scope type | The member sees                                     |
| ---------- | --------------------------------------------------- |
| all        | Everything (same as no scope)                       |
| branch     | Sites and people serviced by that branch            |
| client     | That customer's sites and the people deployed there |
| site       | One site                                            |
| employee   | One employee's records                              |

Always scope **Supervisors** (to their site or sites) and **Clients** (to their client). Without a scope, a role sees the whole workspace.

## Privacy defaults

- Aadhaar numbers are masked to the last four digits everywhere, including for admins.
- Every create, change and delete is written to the audit log (**Administration → Recent Audit Activity**).
- Customer logins don't see identity documents, bank details or police records.