Roles and permissions

A person’s access combines their active roles and each role’s department coverage. Give each person the responsibilities they need, then check their access to positions, employees, budgets, compensation, downloads, and access administration separately.

On User access, each role shows where it applies and What this role allows. Some permissions include related actions: for example, Manage positions also allows View positions in the same departments. The page shows both in one list, with each permission listed once. An expired or revoked assignment no longer grants access.

For example, a reviewer might have a role covering positions in the clinic department without access to employee compensation. Their role describes the permitted actions; its department coverage describes where those actions apply. Adding another role can add responsibilities or coverage, so review the person’s combined access rather than relying on a role name alone.

First access to an organization

Creating an account does not grant access to another organization. When you create a new organization, setup assigns three roles automatically:

Together, these let the creator manage every work area available to the organization. Subscription features, approval requirements, record availability, and sign-in checks still apply.

An invited person receives only the roles reviewed for that invitation. Company sign-in verifies identity; it does not automatically assign roles. A new one-person organization starts with the No independent review configured approval policy. Configure team review when needed. Adding a member does not change that policy automatically.

Organization administrators

An Organization administrator is explicitly appointed. A custom role with the same name or all available permissions does not create that appointment. There is no separate owner privilege reserved for the creator. You can appoint another active member as an equal administrator and hand over responsibility.

The administrator role grants authority to assign access; it does not itself show workforce or pay records. An administrator can deliberately grant themselves access to position, budget, or pay records, with recent MFA verification and a recorded reason. Treat this role as highly trusted. Administrator appointments and revocations also require verification and a reason, and the organization must retain a usable administrator.

Permissions for access administration

An organization administrator must approve which roles a limited access administrator can assign, to whom, and for which departments. The limited access administrator does not need permission to view those records. They cannot grant themselves access. Changes to the reviewed role or coverage require another review before that assignment authority can be used.

Allow another person to assign roles

Use this setup when someone will manage other people’s access without becoming an organization administrator. Giving a person a workforce or financial role lets them do that work; it does not let them give the role to someone else. Assign access enables access administration, and assignment limits specify the roles and coverage that person may grant. Organization administrators can already assign all customer roles and do not need these limits.

For example, Alex can be allowed to assign Viewer within West without being allowed to assign Full workforce and financial access. Alex does not receive Viewer access just because they can assign it.

As an organization administrator:

1. Open Settings > Users and access, select an active member, and choose Edit user access.
2. Under Access roles, select Access administrator, or another role that includes Assign access. Review its permissions if the role has been customized.
3. Under Set up assignment limits, select the roles this person may assign. These selections give them assignment authority, not the selected roles’ data access.
4. Choose Maximum department coverage for any selected department roles. The same limit applies to each selected department role; organization roles do not use department coverage.
5. Choose an Eligible recipient, or leave it empty to allow other active members. The person can never use this authority to grant themselves access.
6. Set an optional expiration date and enter the reason for these assignment limits.
7. Choose Save changes. The person’s access roles and assignment limits are saved together. If a choice fails review, none of those changes are saved.
8. Open the person’s Access roles tab and check Roles this person can assign. Confirm an allowed assignment and a role or department they should be unable to assign.

Leave the assignment-limit selections empty when changing only the person’s own roles or profile. Existing limits remain unchanged. For different limits on different roles, save one group, then add the next group. New limits add to existing authority.

Selecting the same role, coverage, and recipient renews that limit and keeps the previous grant in history. To remove or narrow existing authority, use Revoke on the old limit; adding a narrower limit alone does not remove a broader one.

If the table shows Review required, check the role’s current permissions and maximum coverage, then select and save that limit again. An expired limit needs a new future expiration date or an intentional choice of no expiration. Revoking or expiring assignment authority stops future assignments; it does not remove roles already assigned to other people. Removing Assign access prevents the person from using saved assignment limits; revoke those limits too when the responsibility ends.

For a new invitee, complete this setup after they accept and become an active member. After reactivation, review and grant any needed assignment limits again. You can also review Who can assign this role on an individual role’s details page, with a link to grant authority for that one role.

Starter roles

Starter roles are editable organization copies. Existing organizations keep their saved role names and permissions when a starter role is renamed. Review a role’s permissions before assigning it. Their permissions do not expand automatically when FTE Tree adds a feature. Organization administrator is the protected exception: its permissions cannot be edited or disabled.

The three creator roles are also available for intentional broad assignments. Choose narrower roles for later members. Approval coordination, request overrides, imports, moderation, and downloads are separate responsibilities; ordinary management access does not imply them.

Permission catalog

Management includes the matching viewing permission for positions, employees, workforce rules, budgets, compensation, integrations, and billing. Other permissions remain separate. An export needs viewing access and export access for every included kind of information and department.

Department coverage

A department role contains only permissions that use department coverage. An organization role contains only organization-wide permissions. Assign multiple roles when a person needs both kinds of responsibility.

Choose All departments when access should include both existing and future departments. Otherwise, select the departments and decide whether to include the departments beneath them. These selections follow the department structure for the date you are reviewing.

Permission to give other people access is checked separately. A person allowed to assign roles in selected departments can use only the departments an administrator has reviewed for that responsibility. If a department moves out of that selection, the person can no longer assign access to it. A newly included department needs an administrator’s review first. Someone explicitly allowed to assign roles in All departments can include future departments.

For example, a manager’s viewing role can include a new department beneath Operations. Their separate permission to assign roles does not automatically expand to that new department. Review both kinds of access after a reorganization.

Permission to view a department does not automatically allow changes there. Someone who can view every department but submit requests only for West cannot submit an East request. A request that moves a position needs the required access to both the original and proposed departments on the applicable dates.

Create and assign a role

1. Open Settings > Access roles and choose Create access role.
2. Give it a responsibility-based name and select the permissions needed. Keep organization-wide and department permissions in separate roles.
3. Review the role’s permissions and reporting access.
4. Assign it to an active member and choose the departments it covers, where required.
5. Have the person try an allowed task and a task that should be denied, including a different department and a protected download.

Use Settings > Department scopes to save a group of departments for access assignments. Check the people using that group before changing it. A limited access administrator cannot change their own department access or the maximum departments where they may assign access.

Review and remove access

Review the person’s roles, included departments, expiration dates, and permission to give others access. Removing one role may leave access supplied by another.

The built-in administrator role and built-in All departments selection have protections against being disabled or changed in ways that would remove their purpose.

Use Revoke on a role assignment to remove that access. Revoke authority to assign roles separately when an access administrator no longer needs it. Access review pages and reports retain expired and revoked assignments with their status and dates.

Declared permissions are the permissions listed on the role. Effective permissions are the permissions the person can use through that assignment now, including the viewing permission that comes with management access. Expired or revoked assignments do not grant access.

Deactivating a member also removes their permission to assign roles. Reactivating them does not restore their previous roles or permission to give others access. Review and assign the access they now need.

Protected information and activity

Position access does not include employee details, budgets, or employee pay. Budget access does not include actual compensation. Permission to manage organization settings does not grant access to those records either.

Participate in conversations and Moderate conversations are shared across positions and approval requests. Each uses department coverage and requires access to the underlying record; granting a conversation permission alone does not make a record available. The conversation creator can resolve it while they still have permission to post, and authorized moderators can resolve other people’s conversations. See Conversation permissions for the record access required in each area.

The organization activity overview shows what happened, when, and who did it. You need the appropriate access to read protected notes and record details.

Form choices

Use this reference to choose form values. Available choices depend on the task, selected date, and your access.

Department coverage

Choose the departments covered when this selection is used for access.

Include lower-level departments also includes the departments beneath each one you select. For example, selecting Operations with this option also covers departments below Operations. Review every person using a saved selection before changing it. Organization-wide permissions do not automatically expand access to department-based workforce or financial information.

Include lower-level departments

Include the departments below each selected starting department as well as the starting department itself.

Leave this off when access should apply only to the selected department records. Hierarchy changes can affect the departments included by a selection that follows lower-level departments, so review saved coverage when reorganizing the tree.

Access role

Choose a role whose permissions match the person’s responsibilities, then check any required department coverage.

A person’s effective access combines their active roles. Removing one role may leave the same permission available through another. Review position, employee, budget, and compensation access separately; a role name alone is not a complete description of access.

Permissions

Select the permissions needed for the role. Each offered permission includes its own description on the form.

Department permissions use the department coverage chosen when the role is assigned. Organization-wide permissions apply to shared organization tasks without expanding department-based data access. Use the permission catalog for the full descriptions and review sensitive financial access separately.

Optional practice: practice with a limited account

For exercises that change records, use a separate practice organization and complete the preparation below.

Practice steps and checks

Give a requester the Position manager role for West. Verify that they can submit valid West work, cannot submit East work, cannot see employee pay, and cannot download staffing data without export permission. Then review the exact roles that produced those results.