Roles and access
The eight roles, the permissions each one holds, and how data scopes limit what a login can see.
Every login in a workspace has one role. The role decides which modules appear in the sidebar and what the person can change. A data scope can then narrow which branches, clients, sites or employees they see.
Roles
| Role | Typical person | Can do |
|---|---|---|
| Admin | Owner, head of operations | Everything, including logins, roles, scopes, settings and software policy. |
| Ops Manager | Operations manager | Employees, deployments, rosters, attendance, leave, billing, compliance, client service requests, master data (clients, sites, organization). |
| HR Manager | HR team | Employees, onboarding, documents, consents, verifications, KYC, deployments, leave, payroll, compliance. |
| Supervisor | Site supervisor | Attendance and rosters, leave and compliance for their scoped site(s): run the muster, mark and correct attendance. |
| Field Employee | Guard, housekeeping, technician | Their own check-in and check-out on the phone; their own roster, attendance and leave. |
| Client | The customer's facility manager | The Daily Report, Client Portal, read-only billing and invoices, and compliance items for their own sites, and their own customer group and contracts. |
| IT Admin | IT team | Logins, devices, activity tracking and software security. |
| Viewer | Auditor, management | Read-only access across the workspace. |
Permissions by role
These are the permission codes each role holds. A page or button that needs a permission is hidden or disabled without it.
| Permission | Admin | Ops Manager | HR Manager | Supervisor | Client | IT Admin |
|---|---|---|---|---|---|---|
| tenant.manage (workspace settings, scopes) | ✓ | ✓ | ||||
| identity.manage (logins and members) | ✓ | ✓ | ✓ | ✓ | ||
| audit.read (audit log) | ✓ | ✓ | ✓ | ✓ | ||
| master_data.manage (organization, customer groups, clients, contracts, sites) | ✓ | ✓ | ||||
| employees.manage | ✓ | ✓ | ✓ | |||
| onboarding.manage | ✓ | ✓ | ||||
| documents.manage (incl. document rules and waivers) | ✓ | ✓ | ||||
| consents.manage / verifications.manage | ✓ | ✓ | ||||
| kyc.manage | ✓ | ✓ | ||||
| onboarding.manage also covers HR approval (prepare, approve, collect signatures) | ✓ | ✓ | ||||
| payroll.manage also covers the salary table | ✓ | ✓ | ||||
| deployments.manage (incl. Approve & Deploy and client NDAs) | ✓ | ✓ | ✓ | |||
| rosters.manage | ✓ | ✓ | ✓ | |||
| attendance.manage | ✓ | ✓ | ✓ | |||
| leave.manage | ✓ | ✓ | ✓ | ✓ | ||
| payroll.manage | ✓ | ✓ | ||||
| billing.manage | ✓ | ✓ | ||||
| billing.period.unlock | ✓ | |||||
| billing.manual.review | ✓ | ✓ | ||||
| compliance.manage | ✓ | ✓ | ✓ | ✓ | ||
| service_requests.manage | ✓ | ✓ | ||||
| software.manage (software security) | ✓ | ✓ |
Field Employee and Viewer hold no manage permissions. A Field Employee can still read and act on their own records, such as their roster, their attendance and their check-ins. Administration → Role Permissions shows this list for your workspace.
Data scopes
A scope limits one member to part of the workspace. Set it in Administration → Data Scopes → Assign scope: choose the Member, the Scope type and the Scope target, then press Assign.
| Scope type | The member sees |
|---|---|
| all | Everything (same as no scope) |
| branch | Sites and people serviced by that branch |
| client | That customer's sites and the people deployed there |
| site | One site |
| employee | One employee's records |
Always scope Supervisors (to their site or sites) and Clients (to their client). Without a scope, a role sees the whole workspace.
Privacy defaults
- Aadhaar numbers are masked to the last four digits everywhere, including for admins.
- Every create, change and delete is written to the audit log (Administration → Recent Audit Activity).
- Customer logins don't see identity documents, bank details or police records.