Permission matrix

This page lists every permission seeded into a workspace and shows which of the six default roles holds it. Use it as the reference when configuring custom roles or auditing access.

How the matrix is enforced

• Workspace-scoped. Roles and their permission grants live per workspace (per companyId). Every seeded workspace gets its own copy of the six default roles, and every tenant query is scoped to the workspace by a tenant guard, so a permission grant in one workspace never leaks into another. The platform operator manages workspaces from a separate /operator console that does not use this matrix at all.
• Grants, not hard-coding. A user's effective permissions are the union of the grants on every role assigned to them. Endpoints are protected with a permissions decorator, and the guard checks that the caller actually holds the required permission — there is no implicit Super Admin bypass. Super Admin can do everything only because it is seeded with the full permission set.
• Editable. The matrix below is the seeded default. Admins with roles.manage can add or remove any grant on any role (system roles included) from the access-control screen, so a live workspace may differ from what is shown here.

Country packs affect which permissions matter

Payroll, tax, and statutory rules follow the workspace's country pack, so some financial permissions only do something under certain packs. For example tax.configure / tax.certificates drive income-tax handling for a pack that has income tax (such as the Pakistan pack), but carry no tax logic under a pack with no income tax (such as the UAE pack). The permission still exists everywhere; the behaviour behind it is pack-dependent.

Legend: SA = Super Admin, HRM = HR Manager, HRO = HR Officer, ACC = Accountant, DH = Department Head, EMP = Employee.

Company

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
company.view	View company profile and settings	✅	✅	✅	✅	❌	❌
company.update	Update company profile	✅	❌	❌	❌	❌	❌
company.settings	Manage workspace settings (also gates badge evaluation, manual awards, and address-verification admin actions)	✅	✅	❌	❌	❌	❌

Employees

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
employees.view_all	View all employee records	✅	✅	✅	✅	❌	❌
employees.view_team	View team (department) employees	✅	✅	✅	✅	✅	❌
employees.view_own	View own employee profile	✅	✅	✅	✅	✅	✅
employees.create	Create new employees, and rehire former ones	✅	✅	✅	❌	❌	❌
employees.update	Update employee records	✅	✅	✅	❌	❌	❌
employees.delete	Delete employees	✅	✅	❌	❌	❌	❌
employees.import	Bulk-import employees	✅	✅	❌	❌	❌	❌
employees.confirm	Confirm an employee after probation (auto-issues confirmation letter + sends the confirmed email)	✅	✅	❌	❌	❌	❌

Documents

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
documents.view_all	View all employee documents	✅	✅	✅	❌	❌	❌
documents.view_own	View own documents	✅	✅	✅	❌	❌	✅
documents.upload	Upload documents	✅	✅	✅	❌	❌	✅
documents.verify	Verify documents	✅	✅	✅	❌	❌	❌

Contracts

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
contracts.view	View employment contracts	✅	✅	✅	✅	❌	❌
contracts.create	Create employment contracts	✅	✅	✅	❌	❌	❌
contracts.update	Update contracts (witness data, signed-copy upload)	✅	✅	❌	❌	❌	❌

Employee agreement portal bypasses the matrix

The employment-agreement portal endpoints (GET /api/contracts/portal/my-contract and POST /api/contracts/portal/my-contract/accept) do not require any of the permissions above. They authorize solely on the authenticated user being linked to an employee record, so an employee can only ever read or accept their own contract regardless of role.

Attendance

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
attendance.view_all	View all attendance records	✅	✅	✅	✅	❌	❌
attendance.view_team	View team (department) attendance	✅	✅	✅	✅	✅	❌
attendance.view_own	View own attendance	✅	✅	✅	✅	✅	✅
attendance.mark	Mark or edit attendance	✅	✅	✅	❌	❌	❌
attendance.bulk_mark	Bulk-mark attendance	✅	✅	❌	❌	❌	❌
attendance.regularize_approve	Approve regularization requests	✅	✅	❌	❌	✅	❌
attendance.regularize_request	Request regularization	✅	✅	✅	✅	✅	✅
attendance.overtime_approve	Approve overtime	✅	✅	❌	❌	✅	❌
attendance.manage	Manage attendance settings and shifts	✅	❌	❌	❌	❌	❌
attendance.geo_manage	Manage geo attendance locations and assignments	✅	✅	❌	❌	❌	❌

Field Visits

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
field_visits.view	View field visits, the map, clients and settings	✅	✅	✅	❌	❌	❌
field_visits.manage	Manage clients and pins, enrol field staff, settings, close/cancel visits	✅	✅	❌	❌	❌	❌

Leave

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
leave.view_all	View all leave applications	✅	✅	✅	❌	❌	❌
leave.view_team	View team (department) leave records	✅	✅	✅	❌	✅	❌
leave.view_own	View own leave balance and history	✅	✅	✅	✅	✅	✅
leave.apply	Apply for leave	✅	✅	✅	✅	✅	✅
leave.approve	Approve or reject leave applications	✅	✅	❌	❌	✅	❌
leave.configure	Configure leave policies	✅	✅	❌	❌	❌	❌
leave.allocate	Allocate leave balances	✅	❌	❌	❌	❌	❌

Payroll

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
payroll.view	View payroll runs and entries	✅	✅	❌	✅	❌	❌
payroll.process	Process monthly payroll	✅	✅	❌	✅	❌	❌
payroll.approve	Approve a payroll run	✅	✅	❌	❌	❌	❌
payroll.lock	Lock (finalize) a payroll run	✅	❌	❌	✅	❌	❌
payroll.salary_view_all	View all employees' salaries, the PF ledger and contribution funds	✅	✅	❌	✅	❌	❌
payroll.salary_view_own	View own salary	✅	✅	✅	✅	✅	✅
payroll.salary_assign	Assign salaries / structures, adjustments, increments	✅	✅	❌	✅	❌	❌
payroll.configure	Configure payroll (components, structures)	✅	✅	❌	❌	❌	❌
payroll.manage	Disburse, finalize, mark-paid, salary-history import, set up contribution funds, record their entries, and share fund profit with members (or undo a share)	✅	❌	❌	✅	❌	❌
payroll.adjustment_delete	Hard-delete a payroll adjustment (irreversible)	✅	❌	❌	❌	❌	❌

Salary slips

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
salary_slips.generate	Generate salary slips for a payroll run	✅	✅	❌	✅	❌	❌
salary_slips.view_all	View all employees' salary slips	✅	✅	❌	✅	❌	❌
salary_slips.view_own	View own salary slips	✅	✅	✅	✅	✅	✅
salary_slips.email	Email salary slips	✅	✅	❌	✅	❌	❌

Cheques

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
cheques.manage	Open the cheque register and mark cheques cleared; with payroll.manage, also issue, bounce and cancel them	✅	❌	❌	✅	❌	❌
cheques.print	Print and reprint cheques for a locked payroll run	✅	❌	❌	✅	❌	❌

Tax

Tax handling is driven by the workspace's country pack (see the note at the top).

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
tax.configure	Configure tax (slabs / rates for the active pack)	✅	✅	❌	✅	❌	❌
tax.certificates	Manage and generate tax certificates	✅	✅	❌	✅	❌	❌
tax.view_own	View own tax details and certificate	✅	✅	✅	✅	✅	✅

Loans

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
loans.view_all	View all loan records	✅	✅	❌	✅	❌	❌
loans.view_own	View own loans and installment schedule	✅	✅	✅	✅	✅	✅
loans.apply	Apply for a loan	✅	✅	✅	✅	✅	✅
loans.approve	Approve or reject loan applications	✅	✅	❌	✅	❌	❌
loans.configure	Configure loan types	✅	✅	❌	❌	❌	❌

Holidays

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
holidays.manage	Create and delete holidays	✅	✅	✅	❌	❌	❌
holidays.view	View the holiday calendar	✅	✅	✅	✅	✅	✅

Announcements

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
announcements.manage	Create, update, and delete announcements	✅	✅	✅	❌	❌	❌
announcements.view	View announcements	✅	✅	✅	✅	✅	✅

Dashboard

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
dashboard.admin	Admin dashboard	✅	❌	❌	❌	❌	❌
dashboard.personal	Personal dashboard	✅	❌	❌	❌	❌	❌

Reports

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
reports.all	View all reports	✅	✅	❌	✅	❌	❌
reports.department	View department reports	✅	✅	✅	✅	✅	❌
reports.own	View own reports	✅	✅	✅	✅	✅	✅

Audit

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
audit.view	View audit logs	✅	✅	❌	❌	❌	❌

Roles & users

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
roles.manage	Create, update, and delete roles and their permissions	✅	❌	❌	❌	❌	❌
users.manage	Create, update, and deactivate user accounts and role assignments	✅	✅	❌	❌	❌	❌
users.impersonate	Sign in as another user	✅	❌	❌	❌	❌	❌
users.manage_2fa	Reset a member's two-factor authentication	✅	❌	❌	❌	❌	❌

HR letters

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
hr_letters.manage	Generate, manage, and delete HR letters	✅	✅	❌	❌	❌	❌
hr_letters.view_own	View own HR letters	✅	✅	✅	❌	✅	✅
hr_letters.manage_requests	Handle employee letter requests	✅	✅	✅	❌	❌	❌
hr_letters.request	Request an HR letter	✅	✅	✅	❌	✅	✅

Email templates

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
email_templates.manage	Manage email templates	✅	❌	❌	❌	❌	❌

Print

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
print.salary_slips	Print / download salary slip PDFs	✅	✅	❌	✅	❌	✅
print.attendance	Print attendance	✅	✅	✅	✅	✅	✅
print.payroll_sheet	Print the payroll sheet	✅	✅	❌	✅	❌	❌
print.cheques	Print cheques	✅	❌	❌	✅	❌	❌
print.tax_certificates	Print tax certificates	✅	✅	❌	✅	❌	❌
print.reports	Print reports	✅	✅	✅	✅	✅	❌
print.contracts	Print contracts	✅	✅	❌	❌	❌	❌

Biometric devices

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
biometric.view	View devices, users, punches, sync history, command log	✅	✅	✅	❌	❌	❌
biometric.manage	Register devices, sync, bind users, push time, restart, rotate comm key	✅	✅	❌	❌	❌	❌

System backups

Backups cover the database and uploaded assets and are not workspace-scoped, so the grant is seeded to Super Admin only.

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
system_backup.view	View system backups	✅	❌	❌	❌	❌	❌
system_backup.manage	Create, restore, and manage system backups	✅	❌	❌	❌	❌	❌

SMS & mobile verification

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
sms.manage	Manage SMS providers	✅	✅	❌	❌	❌	❌
mobile_verification.manage	Manage mobile-number verifications	✅	✅	✅	❌	❌	❌

Appraisals

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
appraisals.configure	Manage appraisal settings (cadence, scale, toggles, auto-flow gate)	✅	✅	❌	❌	❌	❌
appraisals.manage	Build templates, run cycles, roll out, finalise, download PDFs, view all	✅	✅	❌	❌	❌	❌
appraisals.review	Access the manager review queue and submit reviews for direct reports	✅	✅	❌	❌	✅	❌
appraisals.view_own	View own appraisals and submit own self review	✅	✅	✅	❌	✅	✅

Assets

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
assets.manage	Full CRUD on assets and categories; issue and return assets	✅	✅	✅	❌	❌	❌
assets.view_all	Read all workspace assets and assignment history	✅	✅	✅	✅	✅	❌
assets.view_own	View own assigned assets and personal history	✅	✅	✅	✅	✅	✅

Offboarding

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
offboarding.manage	Initiate separations, manage clearance, run final settlement	✅	✅	❌	❌	❌	❌
offboarding.view	Read separations, settlement preview, refresh live clearance	✅	✅	✅	✅	❌	❌

Onboarding

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
onboarding.manage	Edit pipelines and tasks, assign owners, run system actions	✅	✅	✅	❌	❌	❌
onboarding.view	Read pipelines and tasks	✅	✅	✅	✅	✅	✅

Expense claims

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
expenses.submit_own	Create and edit own claims, upload receipts, track status	✅	✅	✅	✅	✅	✅
expenses.approve_team	Manager queue — approve / reject direct reports' claims	✅	✅	❌	❌	✅	❌
expenses.manage	Configure categories and HR/finance final-approve any claim	✅	✅	❌	✅	❌	❌
expenses.view_all	Read all claims across the workspace	✅	✅	✅	✅	❌	❌

Recruitment / ATS

Recruitment permissions are seeded to Super Admin only by default. Grant them to HR roles (or a custom role) from the access-control screen when you roll the module out.

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
recruitment.manage	Manage jobs, postings, candidates, applications, interviews, offers, convert to employee	✅	❌	❌	❌	❌	❌
recruitment.interview	Submit interview feedback (participant gate enforced in the service)	✅	❌	❌	❌	❌	❌
recruitment.view	Read openings, candidates, applications (no edits)	✅	❌	❌	❌	❌	❌

Performance tracking

Permission	Description	SA	HRM	HRO	ACC	DH	EMP
performance.manage	Configure the performance module (settings, scorecard profiles, any task); override daily-report AI verdicts; triage AI-flagged reviews and void scores; link integration identities	✅	✅	❌	❌	❌	❌
performance.review	Assign and grade tasks. Team-scoped on its own: reaches only the holder's direct reports; combined with performance.manage or performance.view_all it becomes company-wide. Recurring task schedules always require the company-wide combination	✅	✅	❌	❌	✅	❌
performance.view_all	View all employees' performance scores	✅	✅	✅	❌	❌	❌
performance.view_own	View own tasks and score, submit daily reports	✅	✅	✅	✅	✅	✅

Performance integrations (GitHub / WHMCS)

The /admin/integrations surface is plan-gated on the performance feature. Connection plumbing and merit governance are split:

Action	Permission	SA	HRM	HRO	ACC	DH	EMP
Connections: save credentials, choose repos, test, poll, AI-provider CRUD	company.settings	✅	✅	❌	❌	❌	❌
Merit governance: identities list/link/unlink, flagged-review triage, score void	performance.manage	✅	✅	❌	❌	❌	❌

Self-service (view_own / *_own) endpoints

The employee portal reads a user's own data through the view_own / *_own permissions (for example employees.view_own, attendance.view_own, leave.view_own, payroll.salary_view_own, salary_slips.view_own, loans.view_own, hr_letters.view_own, assets.view_own, expenses.submit_own, performance.view_own). These are granted to every default role, and the endpoints resolve the employee from the JWT — so a user can only ever reach their own records. The employment-agreement portal endpoints (see the Contracts note above) bypass the matrix entirely and authorize on the linked employee record.

---

Summary by role

The six default roles are seeded per workspace with these grant counts (out of 112 total permissions). Super Admin holds all of them.

Role	Default permissions
Super Admin	112
HR Manager	92
Accountant	50
HR Officer	50
Department Head	33
Employee	23

info

This matrix reflects the default grants at workspace creation. Admins with roles.manage can change any role's permissions at any time; users must re-login to pick up a changed grant. See Custom roles and Default roles for more.