# Roles and permissions BlueOneHR does not have a fixed list of roles like "HR Manager" or "Payroll Officer" built in. Instead, access is built from two things: **user groups**, and **employee permissions** assigned directly to a person. Both live under **Settings → General**.

Who can see and change what: roles and permissions

## User groups A user group is a named bundle of permissions — for example, everything a payroll administrator needs, or everything a line manager needs to approve their team's requests. Create the group once under **Settings → General → User Group**, then add employees to it. Group membership is the normal way to manage access for more than a handful of people: change what the group can do, and everyone in it changes with it. ## Direct employee permissions **Settings → General → Employee Permission** grants or removes an individual permission for one specific employee, outside of any group. Use this for an exception — one person who needs a single extra permission — rather than as the everyday way of managing access. A permission granted this way does not appear anywhere in the group list, so it is easy to forget it is there; prefer a group for anything more than a temporary exception. ## What a permission actually covers Permissions are scoped to a module and an action — for instance, the ability to view the payroll register is separate from the ability to approve a payroll run, and both are separate from being able to see attendance records. Assign the narrowest set that lets someone do their job: a manager who should approve leave for their own team does not need the permission that lets them view payroll for the whole company. ## Screenshot ![Settings → General → User Group, listing the configured groups and their permission counts](https://docs.blueonehr.com/uploads/images/gallery/2026-10/zmmemployees-roles-permissions-user-group.png) ## Related - [The employee directory](https://docs.blueonehr.com/books/employees/page/the-employee-directory) - [General settings](https://docs.blueonehr.com/books/company-settings/page/general-settings)