Default roles

Every workspace (the tenant — one company) is provisioned with the same six default roles. They are created when the workspace is set up: automatically during SaaS sign-up registration, or by the reference seeder for a self-hosted install. Each workspace gets its own private copy — roles are scoped by companyId, so one workspace's roles never affect another's.

The six roles are marked is_system = true. Unlike the custom roles you create yourself, system roles cannot be edited or deleted through the admin panel or API (see System role protection below).

note

These are workspace roles — they govern what a user can do inside one company's data. They are separate from the platform operator (the SaaS owner), who signs in to a distinct /operator console and is not one of the roles on this page. See Multi-tenancy.

Role summary

Permission grants below are exactly what the seeder assigns; because system roles are immutable, every workspace carries these same counts. The numbers are out of the full permission catalog (roughly 110 permissions today, and growing as new modules ship). See the Permission matrix for the per-permission breakdown.

Role	Internal name	Permissions	Typical user
Super Admin	super_admin	All	Workspace owner, IT administrator
HR Manager	hr_manager	92	HR department head, senior HR
HR Officer	hr_officer	50	Junior HR staff, HR assistants
Accountant	accountant	50	Finance / payroll team
Department Head	department_head	33	Team leads, line managers
Employee	employee	23	All regular employees

Role details

Super Admin

The Super Admin is granted every permission in the catalog — full control over the workspace, including the ones no other default role gets: managing roles and users, impersonating another user, locking payroll, hard-deleting payroll adjustments, configuring recruitment, managing email templates, and running system backups.

By default, only the Super Admin holds roles.manage and users.manage, so only this role can administer other roles and user accounts.

caution

Assign Super Admin sparingly — usually just one or two users. For day-to-day HR work, HR Manager is the better fit. A workspace must always keep at least one active Super Admin; the system refuses to remove or deactivate the last one.

HR Manager

Broad access across the whole HR and employee surface, but stops short of workspace-owner powers.

Key capabilities:

• Full employee lifecycle — create, update, delete, import, transfer, confirm after probation
• Documents and contracts management
• Attendance marking (including bulk), regularization and overtime approvals, and leave approval + policy configuration
• Payroll processing and approval, salary structure assignment, salary-slip generation and emailing
• Tax configuration and certificates, loan approval and configuration
• Holidays, announcements, HR letters (and letter requests), biometric devices, SMS providers, mobile verification
• Appraisals end-to-end (configure, roll out, review, finalise)
• Assets (full CRUD, issue/return), onboarding and offboarding management
• Expense claims — final HR approval plus category configuration
• Performance module configuration and team review
• View audit logs; manage user accounts (users.manage)
• Reports viewing and export

Cannot (by default):

• Manage roles (roles.manage) or impersonate users
• Update core company settings beyond company.settings
• Lock payroll or hard-delete payroll adjustments — that sits with the Accountant
• Manage cheques, email templates, recruitment, or system backups

HR Officer

A lighter HR role — read-heavy, with create/update but not delete or approval powers.

Key capabilities:

• View all employees, attendance, leave, and documents; create and update employees
• Mark attendance and raise regularization requests
• Manage holidays and announcements; handle HR letter requests
• Assets — full management (issue/return); onboarding management; mobile verification
• Apply for leave and submit own expense claims; view all expense claims and performance scores
• Basic reports (department and own)

Cannot:

• Delete records, or process/approve payroll
• Approve leave, regularization, or overtime (view only)
• Manage contracts beyond viewing/creating, or manage tax and loans

Accountant

Focused on financial operations — payroll, salary disbursement, tax, cheques, and loans.

Key capabilities:

• Read-only employee records; view all attendance
• Full payroll: view, process, assign salaries, manage and lock the run, generate and email salary slips
• Cheques — create and print
• Tax configuration and certificates; loan approval
• Expense claims — final approval and viewing all claims
• Reports (all, department, own) and print (salary slips, payroll sheet, cheques, tax certificates)

Cannot:

• Create or manage employees, attendance marking, or leave approval
• Post announcements or manage HR letters
• Manage roles, users, or workspace settings

tip

Accountant and HR Manager are designed to be complementary. In a smaller team, one person can hold both roles and get the union of their permissions.

Department Head

Team-scoped access for line managers over their own department.

Key capabilities:

• View team members and their attendance
• Approve regularization and overtime for the team; view and approve/reject the team's leave
• Submit manager reviews during appraisal cycles; assign and grade performance tasks for direct reports only (server-enforced — other teams' tasks are unreachable, and recurring task schedules require HR-level rights)
• Approve the team's expense claims
• Read-only view of all workspace assets
• Own self-service: own profile, attendance, salary slip, tax, loans, HR letters, holidays, announcements
• Department-level reports

Cannot:

• Create or modify employee records, or process payroll
• Access data outside their own team
• Manage workspace settings, roles, or users

Employee

Self-service only — an employee sees and acts on their own data.

Key capabilities:

• View own profile and employment details; upload own documents
• View own attendance and raise regularization requests
• Apply for leave and view balances
• View own salary slips (and print them), own tax and loan details
• Apply for loans, submit own expense claims, request HR letters
• View announcements and the holiday calendar
• View own appraisals and performance, submit self-reviews during active cycles

Cannot:

• View other employees' data
• Approve or reject any request
• Access any administrative feature

How roles combine

A user can hold multiple roles at once. Their effective access is the union of every permission across all their roles — permission checks pass if any assigned role grants the required permission. So giving someone both Accountant and Department Head lets them do everything either role can do.

System role protection

Because the six defaults are marked is_system = true, the API enforces:

• They cannot be deleted — deleteRole rejects system roles.
• They cannot be edited — updateRole rejects any change to a system role's name, description, or permission grants (System roles cannot be modified).
• Every new workspace is provisioned with a fresh copy of all six, with these exact default grants.

To tailor access for your organization, create a custom role with just the permissions you need rather than trying to reshape a system role. Role and user administration lives in the workspace's Access Control area and requires the roles.manage / users.manage permissions.

What's next

• Permission matrix — exactly which permissions each role holds
• Custom roles — build additional roles for your workspace