Roles and permissions

MusterHR decides what you can see and do from the roles on your sign-in. This chapter explains the six roles, gives a full capability matrix for every task area, describes how "team only" and "own only" scoping works, and shows how a Super Admin grants or removes roles in People → User accounts. It is written for whoever administers the portal, but anyone wondering why a page is missing from their sidebar will find the answer here.

The six roles

Each role has a fixed name in the app. You will see your own roles as badges beside your name in the top bar and on the Dashboard.

What each role is for

Super Admin holds every permission in the product, including the two nobody else has: changing roles on an account, and opening Company settings (your logo and brand colour). Keep at least two Super Admins so nobody is locked out — MusterHR will refuse to remove the role from, or block, the last one.

HR / Ops is the people-operations role. It covers the employee register, onboarding and offers, document verification, the holiday calendar, leave and attendance administration, policies, probation decisions, performance-review cycles, the asset register and exits. It deliberately does not include salary structures, payroll runs or the payroll report — money sits with Finance.

Manager is scoped by your reporting line, not by seniority. It gives you your direct reports' attendance, their leave and attendance-correction approvals, their performance reviews and probation recommendations, and the ability to sign off exit clearance. Being someone's manager in MusterHR means being named in Reporting manager on their employee record, which HR sets — the note there reads "Their manager approves their leave and attendance corrections, and sees them under My team." Without that link, the Manager role shows you empty queues.

Finance covers salary structures, payroll runs, payslips and the payroll summary report, plus read access to the asset register (including purchase cost) and exit clearance sign-off. Finance cannot open employee records, so it never sees bank or identity numbers.

Employee is self-service only: your own profile, attendance, leave, payslips, documents, assets and reviews, plus the company directory, holidays, announcements and policies.

Reporting views and exports reports and reads announcements — nothing else. On its own it does not include self-service, so a Reporting-only account has no My space section at all. If the person is also a colleague, grant them Employee as well.

How permission actually works

Three rules explain almost everything you will run into.

1. Permissions are enforced on the server. The interface only hides what the server already refuses. A page you may not open is left out of the sidebar and out of the ⌘K (Ctrl+K) command palette, and typing its address directly lands you on an Access denied page that reads: "This page is limited to certain roles, and yours does not include it. Nothing is broken — if you need access, ask your HR team to review your role." If you reach a button you are not entitled to press, the action comes back with a short refusal such as "Not permitted." rather than doing anything.

2. A permission grants the ability; a subject check narrows the rows. This is the difference between ✓ and "team only" in the tables below. The Manager role carries the same approve leave ability that HR carries, but when the page loads, the server filters the list to people with a reporting link to you. Passing someone else's identifier in the address bar is ignored, not honoured. Two consequences worth knowing:

• A manager can never decide their own leave request. It goes to HR or a Super Admin.
• HR and Super Admins may decide any request in the company, including their own — they are the approving authority of last resort.

3. Several roles combine into a union. A user can hold more than one role, and gets every permission from every role held. Rohan in HR who also manages a team would hold HR / Ops and Manager; because HR / Ops already sees everyone, the wider scope wins and his approval queues show the whole company. Role changes take effect the next time the person loads a page — they do not need to sign out and back in.

Super Admin holds every permission, so no permission check ever blocks it. Rows marked "Own only" below are personal by nature — clocking in, applying for leave, acknowledging a policy — and stay personal for every role, Super Admin included.

Capability matrix

✓ means everyone in the company, "Team only" means your direct reports, "Own only" means your own records, and ✗ means the feature is not available to that role.

Self-service rows assume your sign-in is linked to an employee record. If it is not, the page says "No employee record linked" and there is nothing to show — ask HR to link the two on your employee record.

Employees

Bank and identity numbers are always masked on screen (for example XXXX9012, with a Reveal button). Revealing one is written to the audit log, and the page says so.

Attendance

On My team, HR and Super Admins get a Whose team picker with an Everyone in the company option; a manager sees their own direct reports and no picker. See Attendance.

Leave

Comp-off claims sit in the same queue as leave requests and follow the same scoping. See Leave.

Payroll

HR / Ops sees salary on the employee record but has no access to Payroll at all — no runs, no payslip generation and no payroll report. See Payroll.

Documents

A manager cannot see their reports' documents. See Documents.

Policies and announcements

A manager may post only to a department where they are recorded as the department head; anything else returns "You can't post to that department." See Policies.

Assets

Finance reads the register and the cost column but gets no action buttons. See Assets.

Reviews and probation

The Probation screen states the split on the page itself: a manager sees "Recommend an outcome for your reports on probation. HR makes the final decision", with Recommend confirming and Recommend extending; HR sees Confirm employment, Extend and End employment. See Performance reviews.

Offboarding

Clearance is not split by area in practice: anyone holding clearance sign-off sees all six items (IT accounts, IT devices, Finance dues, Manager handover, HR exit interview, Admin assets) and may clear any of them. Managers and Finance see every open case, not only their own people. See Offboarding.

Reports

Reports are company-wide for everyone who can open them — a manager's Reports page is not filtered to their team, and says so: "People analytics across the company, on screen." The Payroll summary needs both report access and salary access, so HR / Ops and Reporting do not see it in the list at all. See Reports.

Settings

See Company settings.

What each role sees in the sidebar

Granting and removing roles

Roles live on the sign-in account, not the employee record. Everything happens in People → User accounts.

Opening the list needs the same access as the employee register, so HR / Ops can reach it — but only a Super Admin can change roles. HR sees the roles listed read-only with the note "Only a Super Admin can change the roles on an account."

Find an account

1. Go to People → User accounts. The heading counts the accounts, for example "9 accounts".
2. Type a name or email into Search, or narrow by Status (Any status, Active, Invited, Suspended, Deactivated) and Role.
3. Click Apply. The list shows 25 accounts per page, with the user, status, roles and last sign-in.
4. Click Manage → on the row you want.

Change someone's roles

1. Open the account and find the Roles & access card.
2. Tick a role to grant it, untick to revoke it. Each row spells out what it opens up — for example, Finance reads "Salary, payslips, payroll runs and the payroll report."
3. Wait for the tick to settle. The change is saved as you click; there is no separate save button, and it takes effect the next time that person loads a page.

A revoked role can be granted again, so this is reversible — but the person loses access immediately, mid-session. Two guards apply:

• You cannot untick Super Admin on the only Super Admin: "This is the last Super Admin. Grant the role to someone else before removing it here."
• HR / Ops cannot administer an account that holds Super Admin at all: "Only a Super Admin can manage another Super Admin."

Roles and their permissions are fixed in the product. You cannot invent a new role or change which permissions a role carries, and the set is the same for every company on MusterHR.

Reset a password for someone

Both options are on the Password reset card, and both show the credential exactly once.

1. Click Generate reset link to create a link valid for one hour. It is emailed if email is configured, and shown on the page so you can hand it over directly. Use Copy — once you leave the page the link is not shown again.
2. Or type a password into the box and click Set password to set one now. Leave the box blank and one is generated for you; a password you type needs 10 characters or more, with upper and lower case, a number and a symbol.

Setting a temporary password signs the person out of every device and makes them change it at their next sign-in.

Block or restore access

The Account card carries the destructive controls, in a Blocking access box. Each of them signs the person out of every device.

Neither suspending nor deactivating touches the employee record — leave history, payslips and documents stay exactly as they are. Each of these asks you to confirm first.

Three things MusterHR will not let you do:

• Suspend or deactivate your own account, or sign yourself out everywhere from this screen. The page says "This is your own account."
• Block the last active Super Admin: "This is the last active Super Admin. Give someone else the Super Admin role before blocking this account."
• Administer a Super Admin's account when you are HR / Ops rather than a Super Admin.

Account statuses

The Last sign-in column reads "Never signed in" for an account nobody has used yet.

Giving an existing employee a login

An employee record can exist with nobody able to sign in to it. Open the person in People → Employees and use the User account card: it either shows "Signs in as …" with a Manage account → link, or offers Send invite and Or set a temporary password. Creating an account this way links it to the existing record rather than creating a second employee, and it starts with the Employee role only. Add any further roles from People → User accounts afterwards.

Worth knowing

• Sign-out is blocked during a forced password change. After you set a temporary password, that person sees nothing but the change-password screen at their next sign-in — no navigation and no Sign out. On a shared machine they have to complete the change before anyone else can use the browser.
• Email verification links cannot be re-issued. Resend invite works for an account still on Invited, but there is no control anywhere that re-sends an email-verification message.
• The Payroll summary report always uses today's salaries. It sums the salary structures in force now, whatever period is on the heading, and the page says so. Treat it as a current-cost view, not a record of a past month.
• Assets marked In repair cannot go back to Available. The only way out of that state is to retire the asset, so think before you use it.
• An employee added through Add employee can stick on "Onboarding". Inviting the person from People → Onboarding is the route that runs end to end; see Employees.
• Sign-in activity on an account shows up to the 25 most recent events, newest first, with the device, IP address and IST timestamp — including failed attempts. Your own is at My space → Sign-in activity.

If you cannot find a page this chapter says you should have, check the badges next to your name on the Dashboard first: they list exactly the roles you hold. If the role you expect is missing, ask a Super Admin to add it in People → User accounts.