This is the definitive reference for how access control works in BusinessHRM. It explains the default roles, custom roles, every permission level, the per-module Add / View / Update / Delete matrix, the finer-grained "More" permissions, how per-employee overrides work, and how permissions stay in sync across your company.
For a shorter, task-focused walkthrough see the companion article Roles & Permissions. This article goes deeper.
Where to find itRoles (company-wide): Settings›Roles & Permissions
Per-employee permissions: open an employee's profile›Permissions tab
Permission: You can only open these screens if your own role grants Manage Role & Permission at the All level. App Administrators always have it.
The model in one picture
BusinessHRM access control has three layers, applied in this order:
Role — a named bundle of permissions assigned to people (for example Employee or a custom HR Manager).
Role permissions — for every feature module, the role says what its members may do.
Per-employee overrides — an individual can have permissions that differ from their role.
Behind the scenes, when you set a role's permissions, BusinessHRM copies those settings down onto each member as that member's own effective permissions. This is what makes the app fast (it reads one person's permissions, not the whole role chain) and it's why overrides and sync behave the way they do, explained later.
Default roles
Every company starts with built-in roles that cannot be deleted:
Role
Internal name
Purpose
App Administrator
admin
Full, unrestricted access to everything. Admin permissions cannot be edited or reduced.
Employee
employee
The standard role assigned to staff/team members.
Contact
contact
External contacts. Only contact-relevant modules are shown for this role.
Notes:
On the Roles & Permissions page the admin role shows "Admin permissions can't be changed" instead of an editable matrix — there is nothing to configure because admins already have everything.
The Employee and Contact roles each have a Reset Permissions button that restores their factory defaults (see Permission sync & reset).
The member count shown next to Employee excludes people who also hold another (custom or admin) role, so the numbers add up correctly across roles.
Custom roles
When several people need the same special access, create a custom role rather than overriding each person individually.
Create a role
Go to Settings → Roles & Permissions.
Click Add Role.
Enter a Role Name (required).
Optionally choose Import From Role to copy another role's permissions as a starting point.
If you import, the new role begins as an exact copy of the chosen role's permissions.
If you leave it empty, the new role starts with all permissions granted, which you then tighten.
Click Save.
Note: The Contact role is not offered as an import source, because its module set is different from internal roles.
Rename a role
On the Add Role dialog the role list is inline-editable: click a role's display name, change it, and click away to save. (The internal name stays the same; only the label changes.)
Delete a role
Only custom roles can be deleted. The built-in admin, employee and contact roles show "Default role can't be deleted" instead of a delete button.
The dialog also shows an unsynced users badge per role — the number of members whose stored permissions haven't yet caught up with the role (see Permission sync & reset).
Permission levels (the heart of it)
Each permission is not a simple on/off switch — it is set to one of five levels that control which records the action applies to. The levels, exactly as stored in BusinessHRM, are:
Level
Internal id
Meaning
None
5
Cannot perform this action at all. The default for anything not explicitly granted.
Added by me
1
Only on records this person created.
Owned
2
Only on records assigned to / owned by this person.
Both
3
Records the person created OR owns.
All
4
Every record in the company, regardless of who created or owns it.
Important: "None" is the safe default. If a permission has never been set for a role or person, BusinessHRM treats it as None.
Worked examples
Tasks → View = Owned: the user sees only tasks assigned to them, not the whole company's tasks.
Tasks → View = Added by me: the user sees only tasks they created themselves.
Tasks → View = Both: the user sees tasks they created and tasks assigned to them.
Projects → Update = All: a project manager can edit any project in the company.
Invoices → Delete = None: the user can never delete an invoice, even ones they created.
Tip: Use All sparingly — it grants company-wide visibility and is normally reserved for managers and admins. For most staff, Owned or Both is the right level.
Not every level is offered for every permission. Some permissions (especially the finer-grained "More" ones) only make sense as All / None, so the dropdown shows just the applicable choices.
The Add / View / Update / Delete matrix
When you open a role (click Permissions next to it) you get a table with one row per feature module and up to four columns:
Column
What it governs
Add
Creating new records in this module.
View
Seeing records in this module.
Update
Editing existing records.
Delete
Removing records.
Each cell is a dropdown set to one of the levels above. Changes save the moment you pick a value — there is no separate Save button on the matrix.
Modules with fewer than four core actions show -- in the unused columns.
A module that is disabled for your company appears greyed out with an info icon reading "Module disabled"; you can't grant permissions for a feature that's switched off.
The Messages module is intentionally excluded from the matrix.
The "More" (custom) permissions
Many modules have extra, finer-grained permissions beyond Add/View/Update/Delete. Where these exist, a More ▾ link appears at the end of the module's row. Click it to expand a sub-table of those custom permissions, each with its own level dropdown.
Examples of custom permissions include things like View employee menu (gives access to the Employees section in the sidebar) and other module-specific abilities. As with the main matrix, custom-permission changes save instantly.
Permission areas (modules)
Permissions are organised by module. The exact list a role sees depends on which modules are enabled for your company and whether the role is internal or a Contact. The full set of permission areas in BusinessHRM is:
Area
Area
Area
Contacts
Contact Company
Leads
Deals
Projects
Tasks
Time Logs
Proposals
Estimates
Invoices
Payments
Orders
Expenses
Products
Purchase
Contracts
Bank Account
Payroll
Employees
Attendance
Leaves
Holidays
Shift Roster (Breaks)
Performance
Recruit
Onboarding
Emergency Contact
Tickets
Events
Notice Board / Notices
Notes
Knowledge Base
Manage Article Category
Letter
Policy Center
Assets
Reports
Dashboards
Settings
Messages / Chat
Group Message
SMS
AI Tools
Webhooks
RestAPI
Zoom
GitLab
Custom Domain
QR Code
Biolinks
Cyber Security
Biometric
Monitor
Activity Tracker
Note: Your company won't show every area at once — disabled modules are hidden or greyed out, and the Contact role only shows the contact-facing modules. Treat the table above as the master list, not a checklist you must see in full.
Contact role specifics
When you edit the Contact role, BusinessHRM shows only the modules marked as contact-facing (and hides Messages). This keeps external contacts from ever being offered access to internal-only features.
Per-employee custom permissions
Sometimes one person needs slightly different access from the rest of their role — without you creating a whole new role for one exception.
Where: open the employee's profile → Permissions tab.
How overrides work
Open the employee's Permissions tab. You'll see the same Add/View/Update/Delete matrix (plus More custom permissions), pre-filled with the levels the person currently has.
Change any dropdown. The change saves immediately for that person only.
The moment you change anything, the employee is flagged with the customised permissions marker, and a yellow warning banner appears on the tab noting that their permissions now differ from their role.
Important: Once an employee is flagged as customised, future changes to their role's permissions will not overwrite their personal settings. This is deliberate — it protects your hand-tuned exceptions. The trade-off is that this person stops automatically inheriting role updates until you reset them.
Admins have no editable matrix
If the employee is an admin, the Permissions tab shows a red notice instead of a matrix, because admin access is total and can't be reduced.
Reset an employee to their role
Click Reset Permissions on the employee's Permissions tab. This:
Re-copies the employee's role permissions onto them, discarding every personal override.
Clears the customised permissions flag, so the person resumes inheriting future role changes automatically.
Tip: Reach for per-employee overrides only for genuine one-offs. If you find yourself making the same override for several people, create a custom role instead — it's easier to maintain.
Permission sync & reset
Because each person stores their own effective permissions (copied down from their role), BusinessHRM has to keep those copies up to date. That's "sync".
What happens when you change a role's permissions
When you change a level in a role's matrix, BusinessHRM immediately pushes the new level to every member of that role who has not customised their own permissions. Members with personal overrides are skipped (their customised flag protects them). Cached menus are refreshed so the change shows up right away.
Unsynced users
The Add Role dialog shows an unsynced users count per role — members whose stored permissions are not yet aligned with the role. Newly added permissions and certain bulk operations can briefly leave members "unsynced" until the next sync runs.
Reset a role to defaults
The Employee and Contact roles have a Reset Permissions button. Clicking it (and confirming) wipes that role's current permissions and rebuilds them from BusinessHRM's factory defaults for that role, then re-pushes them to the role's members.
Important: Reset to defaults is available for the Employee and Contact roles only. Custom roles don't have a factory default to reset to — adjust them manually, or recreate them via Import From Role.
When admins get new permissions automatically
Whenever BusinessHRM adds a brand-new module or permission (for example after an update), the admin role is automatically granted it at the All level, and all other roles get it at None. This guarantees admins never lose access to new features, while everyone else stays locked down until you choose to grant it.
Troubleshooting
Symptom
Likely cause / fix
A teammate can't see a menu or page.
Their role (or personal override) has View = None for that module, or the module is disabled for your company.
Someone sees only their own records, not everyone's.
Their level is Owned, Added by me, or Both — set the relevant column to All for company-wide visibility.
Changing a role didn't affect one person.
That person has customised permissions. Either edit them directly on their Permissions tab, or Reset Permissions to re-inherit the role.
The Employees menu is missing for a manager.
Grant the View employee menu custom permission (under the Employees module's More ▾).
You can't open Roles & Permissions at all.
You need Manage Role & Permission at the All level — ask an App Administrator.
A module row is greyed out.
The module is disabled for your company. Enable it in Settings → Module Settings first.
Related
Roles & Permissions — the shorter, task-focused companion to this reference.
Employees — where the per-employee Permissions tab lives.