Roles & permissions

Who can do what in Peoplance.

Who can use this page

Permission needed: Edit roles (change_role). By default that is the Workspace Administrator. The HR Manager can read roles (view_role) but not change them.

Superusers can always open it. Your administrator can also give the permission to a custom role.

You can’t change your own roles or direct permissions. You can see them, but another administrator has to change them.

Roles & permissions controls who can do what in Peoplance. Access is built from roles, each a bundle of permissions for one responsibility, and each given to a person for a scope.

How access works

• A role is a responsibility, not a job title. Someone can hold several, for example Employee Self Service plus HR Manager plus Payroll Manager. Give people the roles their work needs, with the narrowest scope that does the job.
• Everyone holds Employee Self Service for themselves. It covers your own profile, leave, attendance, standups, requests, payslips and documents. It gives no access to anyone else’s data.
• A scope says where a role applies. The choices are:
  • Entire organization
  • One department
  • Direct reports
  • Self only
  • Specific resource, where the role applies to one record such as a single project
• Direct permissions are individual exceptions outside a person’s roles. They are audited and can expire.
• CRM and blog access are ordinary roles too: CRM Viewer, CRM Member, CRM Administrator and Blog Reviewer. Give them like any other role.
• Superusers can do everything.

The app only shows pages and buttons a person is allowed to use, and the server checks every action again. Hiding a button is for convenience, not security.

The page

The page has three parts.

User roles

A list of the organization’s users. Search by name or email. Each row shows the person, their effective access (a few role chips, with the scope on hover) and a Manage access button.

Roles

A list of every role with its permissions, whether it is a System or Custom role, and Clone, Edit and Delete actions where you may use them.

• System roles are fixed. You can open one to read what it grants, and Clone it to make a version you can change.
• Custom roles are your own. You can edit and delete them.

Under the list, Hiring team roles shows the fixed roles that are given per job posting (assessment checker, interviewer) and what each allows. They are read-only here; you assign them on the posting.

Permission matrix

A read-only table of roles against resources. C is create, R is read, U is update and D is delete. Search by role or resource.

Create a role

1. Select New role, or Clone an existing one to start from what it grants.
2. Enter a Role name and a Description.
3. Set the Risk level: Low, Medium, High or Critical.
4. Tick the permissions the role should hold. Search by name or category. Permissions are grouped by resource, with Create, Read, Update and Delete boxes.
5. Select Create role.

Rules that apply:

• You can only hand out permissions you hold yourself. Creating a role can’t be used to gain extra access. Permissions you don’t hold are shown locked: “You do not hold this permission”.
• Reserved permissions can’t go into a custom role, even if you hold them. They stay with system roles: managing roles and access, changing salaries and bank details, paying out payroll and changing organization settings. They show as “Reserved for system roles”.
• Only permissions that at least one system role uses are offered, to keep the list free of noise.
• Each custom role is stored with an internal name; you only edit the display name.
• Every create, edit and delete is recorded in the audit trail.

Edit or delete a role

Select Edit on a custom role, change it and Save changes.

Delete removes a role, but only if nobody holds it. If it is still assigned, revoke it from those people first.

Give a person a role

On Manage access, the page has two tabs: Roles and Direct permissions, beside the access summary.

1. In User roles, select Manage access next to the person.
2. On the Roles tab, under Roles held, select Add a role. You can search the list of roles.
3. Pick the role, then choose its Access scope. For one department or a specific resource, choose which.
4. Optionally set Starts on and Expires on, for temporary access.
5. Review What changes. It shows how many permissions the role adds, how many the person already had, and warnings. For a scope smaller than the whole organization it says the permissions apply only inside that scope and nothing is added organization-wide.
6. Add a Reason. For Critical-risk roles a written justification is required, because they can change administrative or sensitive access.
7. Confirm. The access is active immediately and the grant records who gave it and why.

To add the same role for another scope, select Add another scope. To take a role away, select Revoke role and confirm.

Direct permissions

Use these only for exceptions. On Manage access, open the Direct permissions tab:

1. Search for the Permission by what it allows, such as “view invoices”.
2. Add a Justification. Every direct grant is audited.
3. Optionally set Expires on.
4. Grant it.

If the permission is already included in one of the person’s roles, the list says “Already included in …”. To remove one, select Revoke permission. If someone’s access comes entirely from roles, the section says so, which keeps access easy to review.

CRM and blog access

Access to Vector and to blog review is given with roles, like everything else, so it shows in the access summary, can have a scope, a start and an end date, and is audited:

• CRM Viewer: see the CRM, read only.
• CRM Member: see and work in the CRM. No pipeline administration, deletes or ownership changes.
• CRM Administrator: everything in the CRM, including pipelines, deletes and ownership.
• Blog Reviewer: can be assigned blog posts to review, and approve or send back the ones assigned to them. See Blog.

The access summary

At the top of Manage access, a summary shows the number of roles, the number of direct permissions and the highest risk the person holds. Changes take effect immediately.

Good practice

• Use the organization scope only for genuinely organization-wide work. Use a department or specific resource where possible.
• Keep submitting and approving separate. For example, data-erasure requests are submitted by HR and approved by the Privacy Administrator.
• Give temporary access an expiry date.
• Review Critical-risk roles regularly.

The default roles

Role	What it is for
Employee Self Service	Your own profile, documents, requests and payslips. Everyone has it.
Workspace Administrator	Users, roles, departments and organization settings. No HR, payroll or finance data.
HR Manager	HR policy, sensitive people records, HR approvals, leave, attendance, WFH and standup administration. Payroll is read-only.
HR Associate	Day-to-day profiles, jobs, contacts, education and onboarding.
People Manager	Direct reports’ people, leave, attendance and WFH workflows.
Document Administrator	Company documents and electronic-signature requests.
Payroll Manager	Payroll configuration, runs and approval, payslips, salaries and bank details.
Finance Manager	Clients, invoices, payroll disbursement, salaries and bank details.
Procurement Manager	Suppliers and purchase orders.
Content Manager	Announcements and blog creation, review, approval and removal.
Recruitment Manager	Job postings, candidates, interviews and hiring assessments.
CRM Viewer	Seeing Vector, read only.
CRM Member	Seeing and working in Vector, without pipeline administration or deletes.
CRM Administrator	Administering Vector: pipelines, deletes and ownership.
Blog Reviewer	Reviewing blog posts assigned to them.
Project Administrator	Project setup and membership.
IT Asset Manager	The full IT asset lifecycle.
IT Asset Technician	Maintaining assets and issuing and returning them.
Integration Administrator	Slack and other workspace integrations.
Privacy Administrator	Reviewing data-erasure requests.