Roles and permissions

BlueOneHR does not have a fixed list of roles like "HR Manager" or "Payroll Officer" built in.
Instead, access is built from two things: user groups, and employee permissions assigned
directly to a person. Both live under Settings → General.
Who can see and change what: roles and permissions
User groups
A user group is a named bundle of permissions — for example, everything a payroll administrator
needs, or everything a line manager needs to approve their team's requests. Create the group once
under Settings → General → User Group, then add employees to it.
Group membership is the normal way to manage access for more than a handful of people: change what
the group can do, and everyone in it changes with it.
Direct employee permissions
Settings → General → Employee Permission grants or removes an individual permission for one
specific employee, outside of any group. Use this for an exception — one person who needs a single
extra permission — rather than as the everyday way of managing access. A permission granted this way
does not appear anywhere in the group list, so it is easy to forget it is there; prefer a group for
anything more than a temporary exception.
What a permission actually covers
Permissions are scoped to a module and an action — for instance, the ability to view the payroll
register is separate from the ability to approve a payroll run, and both are separate from being able
to see attendance records. Assign the narrowest set that lets someone do their job: a manager who
should approve leave for their own team does not need the permission that lets them view payroll for
the whole company.
Screenshot
Related
The employee directory
General settings