Permissions and reporting lines
Access levels answer what can this person do? Management scope answers whose records can they use? Both checks apply, including on the server.
Built-in levels
Section titled “Built-in levels”| Level | Intended responsibility |
|---|---|
| Owner | Full access, including ownership and management scopes |
| Administrator | Broad administration, excluding access-level management |
| People manager | People, onboarding and related approvals |
| Rota coordinator | Rotas, assignments and attendance |
| Safeguarding lead | DBS, references and training |
| Expenses approver | Review expense claims |
| Finance | Record payments, manage pay rates and export relevant records |
| Team leader | View the rota and record attendance |
| Viewer | Read-only management views |
These are templates, not an exhaustive list of permissions. Use Settings → Access to compare the actual permissions. Duplicate a built-in level to create a custom one; built-in templates cannot be edited.
Multiple levels combine permissions. A restrictive level does not remove permission granted by another level. Owner includes the other permissions and is held on its own. Only owners can grant Owner, and the last owner cannot be removed.
Management scope
Section titled “Management scope”- Own records and reporting chain covers the person and their reports through the management tree.
- Company area widens the scope to the selected area.
- Whole organisation widens it across the organisation.
Blank scope means reporting chain. Owners always have organisation-wide scope. Only an owner can change scope. Rota teams describe operational assignments; belonging to a team does not grant HR access.
A manager needs both the relevant permission and an appropriate scope. Approval cover follows its own eligibility checks and does not grant general access to someone’s records.