Roles & Permissions

Roles & Permissions is where you decide what each kind of user can see and do inside BusinessHRM. Instead of setting access one person at a time, you group people into roles (such as Admin or Employee), and then control what each role is allowed to do for every module in the system. When you change a role's permissions, everyone who has that role inherits the change automatically.

The page lists every role in your company. Each role shows its name, how many members it has, and a Permissions button to open its access grid. The built-in Admin role shows a note instead of a button, because its permissions are always full and cannot be changed.

Understanding roles

A role is a named set of permissions. BusinessHRM ships with default roles and lets you add your own.

The default roles are:

You can also create your own custom roles (for example "Manager", "Accountant", or "Team Lead") and give each one exactly the access it needs.

Permission types (what the access levels mean)

For most modules, each action (Add, View, Update, Delete) has a dropdown where you choose how much access the role gets. The available choices depend on the module, but the meanings are always the same:

Not every module offers all five levels. Simpler modules may only offer None and All. The dropdown only shows the levels that apply to that module.

Creating a custom role

1. On the Roles & Permission page, click Add Role.
2. A window opens listing the existing roles, with a count of unsynced members next to each. Use this list to rename existing roles or delete custom ones (see below).
3. In the Role Name field, type a name for the new role.
4. Optionally, in the Import From Role dropdown, choose an existing role to copy its permissions as a starting point. The Contact role cannot be used as a source.
5. Click Save. The page reloads and the new role appears in the list.

Editing a role's permissions

1. On the Roles & Permission page, find the role and click Permissions.
2. A permission grid opens showing every module on its own row, with columns for Add, View, Update, and Delete.
3. For each module and action, choose the access level you want from the dropdown (None, Added, Owned, Both, or All — only the levels that apply will appear).
4. Each change saves automatically the moment you pick a value. There is no separate Save button on this grid.

Notes about the grid:

• If a module is greyed out and shows an information icon, that module is currently switched off for this kind of user in Module Settings, so its permissions cannot be changed until the module is enabled.
• The Messages module is intentionally not shown in this grid.
• The Settings and Dashboard areas are always available to the role type and are not disabled here.

Extra (custom) permissions for a module

Some modules have additional fine-grained permissions beyond the basic Add/View/Update/Delete. When a module has these, a "More" link with a chevron appears at the end of its row.

1. Click More on the module's row.
2. A sub-table opens listing each extra permission with its own access dropdown.
3. Set each one the same way as the main grid; changes save automatically.
4. Click More again to collapse the section.

One common extra permission is "View Employee Menu", which controls whether the role sees the employee directory area. A help icon next to such permissions explains what they do.

Resetting permissions to default

For the Employee and Contact roles you can restore the original BusinessHRM permission set if you have changed too much.

1. Click Add Role to open the roles window.
2. Find the Employee or Contact row and click Reset Permissions.
3. Confirm the prompt.
4. The role's permissions are wiped and rebuilt from the BusinessHRM defaults, and the page reloads.

Resetting also marks the role's members so their individual permissions are re-synced from the role.

The Admin role has no reset option because it always has full access. Custom roles do not have a reset option, since they have no built-in default to restore.

Renaming a role

1. Click Add Role to open the roles window.
2. In the table, click on the role's name (it becomes editable).
3. Type the new name and click away from the field.
4. The new display name saves automatically.

Renaming changes only the label shown in BusinessHRM; it does not change the role's permissions or members.

Deleting a role

1. Click Add Role to open the roles window.
2. Find the custom role you want to remove and click Delete.
3. Confirm the prompt.

You can only delete custom roles you created. The Admin, Employee, and Contact roles cannot be deleted and show a note saying so instead of a Delete button.

Assigning members to a role

You do not assign people to roles from this page. A user's role is chosen on their own profile (when you add or edit an employee or a contact). This Roles & Permissions page defines what each role can do; the member's profile decides which role they have.

When you change a role's permissions here, BusinessHRM pushes the change to every member of that role automatically — unless that member has had their permissions individually customised. The member counter on each role row, and the "unsynced members" count in the Add Role window, help you see who is in each role and whether everyone is up to date.

Per-person overrides

It is possible for an individual to have permissions that differ from their role (set on their own profile). When that happens, role-level changes no longer overwrite that person's settings. You can return such a person to the standard role permissions by resetting their individual permissions from their profile, after which they follow the role again.

Permission

Access to this page is controlled by the Manage Role Permission Setting permission (manage_role_permission_setting). A user must have this set to "All" to open Roles & Permission, create or edit roles, change permissions, or reset and delete roles. Without it, the page is blocked.

Tips

• Start a new role with Import From Role and then trim it down. It is faster than building access module by module from scratch.
• Use Added, Owned, or Both to give staff control of their own work without exposing everyone else's records. Reserve All for trusted supervisors and admins.
• If a module is missing from a role's grid or appears greyed out, check Module Settings first — the module may be switched off for that user type.
• After a big permission change, the member counts and the unsynced count tell you whether the change has reached everyone.
• Keep the number of people with the Admin role small. Admin access cannot be limited, so it should go only to those who genuinely run the account.
• If one person needs slightly different access from the rest of their role, customise their permissions on their profile rather than creating a whole new role for one exception.