Roles & Permissions

Roles and permissions control who can see what and who can do what within Udyamo HRMS. A well-designed role structure protects sensitive data such as salary information, limits accidental changes, and ensures that approval workflows function correctly. This chapter covers default roles, custom role creation, permission categories, and best practices for access control.

What You Will Learn

• How the role and permission system works in Udyamo HRMS
• What default roles are available and what each can do
• How to create custom roles with specific permissions
• How to assign roles to employees
• How to design a permission matrix for your organization
• Best practices for role management and the principle of least privilege

Prerequisites

Required: You must be logged in with an Administrator role to create, edit, or assign roles.

Required: Complete Chapter 6: Departments & Designations and Chapter 7: Offices & Locations before configuring roles. Understanding your organizational structure helps you design appropriate access levels.

How Roles and Permissions Work

Udyamo HRMS uses a Role-Based Access Control (RBAC) model. Here is how the components relate:

An employee can be assigned one or more roles. The effective permissions are the union of all permissions from all assigned roles.

Navigating to Roles

1. Log in to Udyamo HRMS.
2. Click Settings in the navigation sidebar.
3. Click Roles.

The Roles page displays a list of all roles in your organization, both default and custom.

Default Roles

Udyamo HRMS ships with four default roles that cover the most common organizational structures. These roles are pre-configured with sensible permissions.

Admin

The Admin role provides unrestricted access to all features and settings.

Warning: The Admin role should be assigned sparingly. Only organization owners and senior IT/HR personnel should have Admin access. Every additional admin increases the risk of accidental misconfiguration.

HR

The HR role provides broad access to employee management and HR operations, but excludes system configuration that belongs to administrators.

Manager

The Manager role provides access to team-level data. Managers can view and approve requests from their direct reports but cannot access data from other teams.

Employee

The Employee role is the default self-service role with access only to the user's own data.

Permission Categories

Permissions in Udyamo HRMS are organized by module. Within each module, permissions are broken down by action type.

Module-Based Permission Categories

Action-Based Permissions

Within each module, the following action types are available:

Creating a Custom Role

When the default roles do not match your organization's needs, create custom roles.

Step-by-Step: Create a Custom Role

1. Navigate to Settings > Roles.
2. Click the Add Role button.
3. Enter a Role Name (e.g., "Finance Manager", "Shift Supervisor", "Department Head").
4. In the permissions section, you will see a matrix of modules and actions.
5. Check or uncheck each permission as needed.
6. Click Save or Create.

Role Name Guidelines

Example Custom Roles

Here are common custom roles that organizations create.

Finance Manager

Access to payroll and financial reports, but not employee personal data.

Shift Supervisor

Manages attendance for a team but has no access to leave, payroll, or employee management.

Department Head

Extended manager permissions with access to department-level reports.

Recruiter

Access to add new employees and send invitations, but no access to payroll or attendance.

Editing a Role

1. Navigate to Settings > Roles.
2. Find the role you want to edit in the list.
3. Click the Edit button (pencil icon).
4. Modify the role name or adjust permissions.
5. Click Save or Update.

Warning: Editing a role's permissions affects all employees currently assigned to that role. The changes take effect immediately. Review the employee list for the role before making changes.

Note: Default roles (Admin, HR, Manager, Employee) may have restrictions on editing. Some core permissions on default roles cannot be removed to ensure system stability.

Deleting a Role

1. Navigate to Settings > Roles.
2. Find the role you want to delete.
3. Click the Delete button (trash icon).
4. Confirm the deletion.

Warning: You cannot delete a role that has employees assigned to it. Reassign those employees to a different role first.

Warning: Default roles cannot be deleted. Only custom roles can be removed.

Assigning Roles to Employees

Roles are assigned to employees through the employee profile. This creates an EmployeeRole record linking the employee to the role.

Assigning a Role During Employee Creation

1. Navigate to Employees > Add Employee.
2. In the employee form, locate the Role field.
3. Select the appropriate role from the dropdown.
4. Complete the rest of the form and click Save.

Changing an Employee's Role

1. Navigate to Employees and find the employee.
2. Click on the employee's name to open their profile.
3. Click Edit on the role or access section.
4. Change the Role dropdown selection.
5. Click Save or Update.

Assigning Multiple Roles

An employee can hold multiple roles simultaneously. The effective permissions are the combination (union) of all assigned roles.

Tip: Use multiple roles when an employee's responsibilities span two distinct areas. This is cleaner than creating a new combined role for every unique combination.

Warning: Be careful when assigning multiple roles. Permissions are additive — there is no way to explicitly deny a permission through a second role. If one role grants "View all employee salaries" and another grants limited access, the broader permission takes effect.

Permission Matrix

The following table shows a typical permission matrix for default roles. Use this as a starting point and adjust for your organization.

Employee Management Permissions

Attendance Permissions

Leave Permissions

Payroll Permissions

Settings Permissions

Designing Roles for Your Organization

The Principle of Least Privilege

Grant each role only the permissions it needs to perform its function. No more, no less.

Separation of Duties Examples

Role Design Process

1. List all job functions in your organization that interact with HRMS.
2. Map each function to required permissions (what does this person need to see and do?).
3. Check if a default role matches. If yes, use the default role.
4. Create custom roles for functions that do not match any default role.
5. Assign roles to employees based on their job function, not their seniority.
6. Test each role by logging in as an employee with that role and verifying access.

Auditing Role Assignments

Periodically review who has which roles to ensure the access structure remains correct.

When to Audit

Audit Checklist

Troubleshooting Permission Issues

Tips & Best Practices

Tip: Start with the default roles and customize only when necessary. The four default roles cover the needs of most small and medium organizations.

Tip: Name custom roles after job functions, not people. "Payroll Manager" is better than "Priya's Role" because the role persists even if the person changes.

Warning: Avoid creating an excessive number of custom roles. Each additional role increases administrative complexity. If you find yourself creating more than 8-10 roles, consider whether some can be consolidated.

Tip: Test custom roles before assigning them to employees in production. Log in as a user with the new role (or use a test account) and verify that the permissions work as expected.

Warning: Never grant Admin access as a quick fix for a permission issue. Instead, identify the specific permission the user needs and add it to their role.

Tip: Document your role structure — which roles exist, what each is for, and who holds each role. Store this documentation outside of Udyamo HRMS (e.g., in a shared internal document) so it is accessible even if HRMS access is disrupted.

Tip: When an employee changes departments or positions, review their role assignment. A developer promoted to engineering manager may need the Manager role in addition to (or instead of) the Employee role.

Quick Reference