What's covered in this guide?:
This guide explains how to manage roles and permission levels using Advanced Permissions.
What are permission levels?
A permission level (also referred to as a role) defines what actions a user can perform across the platform, such as viewing data, editing records, approving requests, or publishing rotas.
Users can hold more than one permission level simultaneously — for example, a General Manager who also manages a specific team may hold both the General Manager and Manager permission levels, or a Manager who also works shifts will hold both Manager and Employee.
About Advanced Permissions
Advanced Permissions allow you to customise or create permission levels when the default roles do not meet your organisation’s requirements.
Using Advanced Permissions, you can:
Fine-tune what actions a role can perform
Create custom roles (for example, Assistant Manager or Supervisor)
Control access without giving full Admin permissions
How to access Advanced Permissions
To access Advanced Permissions:
Settings > All Settings > Permissions > Advanced Permissions > Show Advanced Settings > Customise access & roles
Default permission levels
Workforce includes a set of default permission levels. Each permission level, whether default or custom, is based on an underlying role type. The role type defines the scope of access, while permissions control specific actions.
You can see the underlying role type in the role’s description.
Default permission levels
Permission level | Underlying role type | Can it be customised? |
Admin | Admin | No |
Manager | Manager | Yes |
Employee | Employee | Yes |
General Manager | Admin | Yes |
Payroll Officer | Admin | Yes |
Important things to know
Default permission levels cannot be deleted
The default Admin role cannot be customised
All other default roles can be customised
General Manager and Payroll Officer are turned off by default — to make them available, edit the role and tick Role can be applied to staff
Customise a permission level
You can customise any permission level except the default Admin role.
To customise a permission level:
Go to Settings > Permissions > Advanced Permissions > Customise access & roles
Select View next to the permission level you want to edit
Use the toggles to enable or disable specific permissions
Save your changes
Restore default settings
If changes are made unintentionally, select Apply defaults to restore the role to its original configuration.
Example: Allow managers to view employee start dates
By default, the Manager role cannot view certain employee details (such as start dates), as these are treated as sensitive data.
To allow managers to view start dates:
Open Advanced Permissions
Select the Manager permission level (or your custom manager role)
Enable View sensitive data
Save your changes
Things to note
This permission controls visibility only
Editing employee details may require additional permissions
General Managers can view start dates by default due to the broader access their role type provides
Create a new permission level
You can create custom permission levels to better reflect your organisation’s structure.
To create a new permission level:
Select + New role
Enter:
Name
Description
Sort order
Choose an underlying role type
Tick Role can be applied to staff if the role should be assignable
Save the role
Delete or disable a permission level
Only custom permission levels can be deleted
Default permission levels cannot be deleted
To delete a custom permission level:
Open the role
Select Edit role
Choose Delete
To stop a role being assigned without deleting it:
Untick Role can be applied to staff
This keeps the role available for reference but prevents it being used.
Understand underlying role types
Each permission level is based on one of five role types. The role type defines the scope of access, while the permissions within each role control the specific actions available.
Admin (default Admin role)
Full access to all settings and data
Full visibility of pay and organisation information
Ability to manage roles and permissions, including assigning Admin access to other users
Can impersonate other users via 'See Workforce as'
The default Admin role cannot be customised or deleted
General Manager
Org-wide operational access — can manage rosters, timesheets, wages, locations, department groups, and contracts across the entire organisation
Can lock rosters and export timesheets
Cannot manage permissions, payroll groups, ATS, organisation settings, or position templates
Cannot impersonate other users
Can be customised
Payroll Officer
Access to payroll-related functions including exporting timesheets and managing pay-related data
Cannot access organisation settings or assign permissions to others
Can be customised
Manager
Team-based management: creating and managing rotas, approving timesheets and leave for managed staff
Access is limited to managed teams
Organisation-wide settings remain restricted to Admin-based roles
Can be customised
Employee
Clocking in and out
Viewing rotas
Requesting leave
Using employee self-service features
Cannot approve timesheets or leave
Cannot access management or administrative settings
Can be customised
Important things to know about permission levels
Users can hold multiple permission levels simultaneously (e.g. Manager + Employee, or General Manager + Manager)
Permission levels define what actions a role can perform
Viewing, editing, approving, and publishing are controlled separately
Permissions for your own data and other users' data may differ
Changes apply immediately once saved