Assign roles and scopes
Understand the four roles, choose the right scope for each grant, and know exactly what a person can do after you assign one.
Before you start
- Only people with the Admin role can manage users and their roles.
- Two of the four roles are never assigned by hand:
- Employee is automatic — every person in your organization can act on their own requests without any assignment.
- Manager is derived from reporting lines — whoever is set as an employee’s manager can act on that employee’s requests. Reporting lines may cross branches.
Roles and what they can do
| Admin | HR | Manager | Employee | |
|---|---|---|---|---|
| View requests | in scope | in scope | direct reports | own |
| Approve requests | in scope | in scope | direct reports | — |
| Edit requests | in scope | in scope | — | own |
| Cancel requests | in scope | in scope | — | own |
| Record absences for others | in scope | in scope | direct reports | — |
| View calendars (presence) | in scope | in scope | everyone | everyone |
| See absence types | in scope | in scope | direct reports | own |
| Manage leave policies | in scope | in scope | — | — |
| Manage users and roles | in scope | — | — | — |
“In scope” means: inside the scope the grant was made for (see below). Everyone sees that colleagues are absent on calendars and in the directory; what kind of absence it is stays limited — see Control who sees absence details.
Scopes
Every Admin or HR grant carries a scope that limits its reach:
- Company — the whole organization.
- Branch — one branch and its teams.
- Team — a single team.
A person can hold several grants (for example HR for two branches), and scopes never widen each other — each grant reaches exactly its own scope. The same person can also be a manager through reporting lines at the same time; each grant or reporting line contributes its own reach.
Rules that always hold
- Nobody ever approves their own request, whatever their roles.
- Roles grant actions. Who sees absence details on calendars and in the directory is configured separately and never grants actions.
- Every approval, edit, and recording made under a role lands in the audit trail under the acting person’s name.