Access and security
Who can see what in HR
The four HR roles against every action, what a line manager gets that no role grants, and the two rules that hold even against an administrator.
HR authority comes from the HR role and nothing else. An organisation role grants none of it — a project administrator has no business reading salaries. See Roles and access for why the ladders are separate, and Who can do what in work management for the other one.
| None | Manager | Viewer | Admin | |
|---|---|---|---|---|
| See their own record | Yes | Yes | Yes | Yes |
| Book their own leave | Yes | Yes | Yes | Yes |
| See the staff directory | Yes | Yes | Yes | Yes |
| See workforce reports | — | Yes | Yes | Yes |
| Approve leave | — | Yes | — | Yes |
| See everybody's full record | — | — | Yes | Yes |
| See documents | — | — | Yes | Yes |
| Edit people and engagements | — | — | — | Yes |
| See and edit pay | — | — | — | Yes |
| Upload and verify documents | — | — | — | Yes |
| Administer the leave ledger | — | — | — | Yes |
| Configure policy | — | — | — | Yes |
None is not nothing
Everybody with a login sees their own record, books their own leave and can look somebody up in the directory. That is the baseline rather than an HR grant — a company where finding a colleague's job title requires a role is a company with a spreadsheet going round instead.
What a line manager gets, that no role grants
Being somebody's manager is a relationship, not a role, and it grants exactly one thing: the ability to see and approve their own reports' leave. It does not grant their personal data and it does not grant their pay.
Approving an absence needs a date, not a passport scan
A manager plans around who is away. Nothing about that requires their address, their visa, their driving licence number or what they earn — so the manager relationship moves the leave class and nothing else.
A manager on either reporting line of somebody holding two engagements is a real manager, and reporting lines cross legal entities routinely — the engineering lead in one country managing people engaged by four others is the ordinary case, not the exception.
Two rules that hold even against an administrator
- Nobody decides their own pay
- The subject is refused before anything else is checked, HR administrator or not — and the panel is absent on your own record rather than present and refusing. Approving a rise is also separate from applying it, because an approval in March for a rise in July must not become somebody's salary in March. See Compensation.
- Anonymous feedback stays anonymous
- Including when the subject is an HR administrator. The author's name is removed when the feedback is read, not hidden in the interface — anonymity that depends on a component not rendering a field ends the first time somebody opens the network tab. HR can see the author only so that abuse can be investigated. See Performance.
Nobody approves their own request, with one exception
The subject is removed from every approval step before anything else is decided, so self-approval cannot fall out of somebody happening to be their own manager or the only administrator on a step. But a managing director or a sole owner has no manager, and told they may not approve their own leave they do not escalate to nobody — they stop recording leave at all, and the absence figures become least reliable for exactly the people whose absence matters most.
So self-approval is permitted narrowly: only where the chain resolves to nobody else, only where policy allows it, and always recorded as a self-approval so an audit can tell it from an ordinary decision. Somebody who has a manager never self-approves, whatever the policy says. See Approvals and delegation.
Files are never public
Every document and every avatar is fetched through an authorised redirect to a short-lived link, checked at the moment it is issued. A passport scan on a guessable path is a breach whether or not anybody guesses it. See Documents.