Roles and permissions

Everyone has one of three roles. Access is decided by the server on every request; hiding a menu item is never the only protection.

The three roles

• Administrator: manages people, settings, payroll and monitoring. Administrators always keep access to every module.
• Manager: runs a team: tasks, leave approvals and extra hours, recruitment, and the company dashboard.
• Employee: sees their own work, attendance, tasks and chats.

Beyond the role

Some modules have their own, finer permissions that an administrator gives to individual people:

• My Drive is available only to people an administrator has given access to.
• PIY CRM has its own roles and teams, with own-records, team or all-records access.
• pGmail, DevOps, Credential Manager and Remote Access each have their own access settings, so that being a manager does not automatically mean being able to connect mail, deploy or reveal passwords.

An administrator can also switch a whole module off for a role, or make an exception for one person, under Configuration > Navigation & modules. See Configuration and administration.

What you will notice

• A module you cannot use does not appear in the sidebar.
• If you open its address anyway, you see a message that it is not available to you.
• If an administrator changes your access while you are signed in, the sidebar updates within about a minute, and the server refuses the module immediately.

You cannot give yourself more access. Only administrators can change who has what, and those changes are recorded.