Documentation
Home › HR & Payroll › HR Payroll Access Policies

HR Payroll Access Policies

Set up role-based access control for payroll functions with six dedicated permissions.

How to Configure

  1. Go to Access Policies (in Account & Security or Facility Settings)
  2. Select the user or role you want to configure
  3. Enable or disable the HR & Payroll permissions below

Available Permissions

  • hr-payroll-setup — Full access to Payroll Setup, Grade Structure, and Salary Profiles. Can create/edit grades, configure salary profiles, and modify payroll settings.
  • hr-run-payroll — Can generate payroll runs and submit them for approval. Cannot approve or mark as paid.
  • hr-payroll-approve — Can approve or reject payroll, mark individual staff as paid, and mark entire batches as paid. This is the finance/management permission.
  • hr-payroll-view — Read-only access to payroll history, reports, and dashboard. Can view all staff salary data.
  • hr-leave-approval — Can approve or reject leave requests from staff. Sees leave balances and pending requests.
  • hr-payslip-view — Allows a staff member to view their own payslip in the Employee Hub. Does NOT grant access to other staff payslips.

Recommended Role Setup

  • HR Manager: hr-payroll-setup + hr-run-payroll + hr-leave-approval
  • Finance/Accountant: hr-payroll-approve + hr-payroll-view
  • Department Head: hr-payroll-view + hr-leave-approval
  • All Staff: hr-payslip-view (view own payslip only)
Security Note: Users with hr-payroll-view can see all salary data. Only assign this to trusted finance/HR roles.