Roles & Permissions
Roles and permissions decide what every person in your BusinessHRM company can see and do. A role is a named bundle of permissions (for example employee or a custom HR Manager role). Each employee is assigned one role, and you can additionally fine-tune permissions for an individual person. This article explains how roles work, the default roles, how to create your own, and how per-employee custom permissions behave.
Where to find it
- Roles (company-wide): Settings → Roles & Permissions (
/settings/role-permissions). - Per-employee permissions: open an employee's profile → Permissions tab (only visible if you can Manage Role & Permission).
How roles and permissions work
Every feature module (Employees, Projects, Tasks, Attendance, Leaves, Time Logs, Documents, Tickets, and so on) exposes up to four core permissions, shown as columns in the permission matrix:
- Add
- View
- Update
- Delete
Each permission is set to one of five levels that control scope:
| Level | Meaning |
|---|---|
| None | Cannot perform this action at all. |
| Added | Only on records this person added. |
| Owned | Only on records assigned to / owned by this person. |
| Both | Records they added or own. |
| All | Every record in the company. |
Some modules have extra, finer-grained permissions beyond Add/View/Update/Delete; click the More expander on a module row to reveal these custom permissions. Modules that are disabled for your company appear greyed out and are labelled "Module disabled".
Default roles
BusinessHRM ships with three built-in roles that cannot be deleted:
- admin — full access to everything. Admin permissions cannot be edited or reduced.
- employee — the standard role automatically assigned to new hires.
- contact — used for external contacts; only contact-relevant modules are shown for this role.
The employee and contact roles each have a Reset Permissions button that restores their factory defaults if you've changed them.
Creating a custom role
How to create a role
- Go to Settings → Roles & Permissions.
- Click Add Role.
- Enter a Role Name (required).
- Optionally choose Import From Role to copy another role's permissions as a starting point. If you leave this empty, the new role starts with all permissions granted, which you can then tighten.
- Save. The role now appears in the list.
How to edit a role's permissions
- On the Roles & Permissions page, select the role.
- In the permission matrix, change the Add / View / Update / Delete dropdowns (and any More custom permissions) to the levels you want.
- Changes save as you make them.
Important: When you change a role's permissions, the new levels are automatically pushed to every employee in that role who has not customised their own permissions. Employees who have personal overrides are left untouched.
Renaming or deleting a role
- Rename: click the role's display name in the list to edit it inline.
- Delete: only custom roles can be deleted (the built-in admin, employee and contact roles cannot). The list also shows an "unsynced users" badge where applicable.
Per-employee custom permissions
Sometimes one person needs slightly different access from the rest of their role. You can override permissions for an individual without creating a whole new role.
How to set custom permissions for an employee
- Open the employee's profile and select the Permissions tab.
- Adjust the Add / View / Update / Delete dropdowns (and More custom permissions) per module.
- Changes save automatically.
As soon as you change anything here, the employee is flagged as having customised permissions and a warning banner appears noting that they now differ from their role. Because of this flag, future changes to the role's permissions will not overwrite this employee's settings.
Resetting an employee back to their role
Click Reset Permissions on the Permissions tab. This removes the personal overrides and restores the employee to exactly what their role grants.
Admins
If the employee is an admin, the Permissions tab shows a notice instead of an editable matrix — admin permissions cannot be changed.
Tips
- Prefer custom roles when several people need the same special access; use per-employee overrides only for genuine one-offs.
- Use Import From Role to clone a close-enough role, then tweak — it's faster than starting from a blank slate.
- Remember the difference between Owned, Added, Both and All — choosing All gives company-wide visibility, which you usually want only for managers and admins.
- If a teammate says a menu or button is missing, check their role's permission for that module first.