Contents of this article are applicable to the following users

Tier: ESSENTIAL, GROWTH, SCALE

Platform: Web

Use Permission Groups to allow or restrict specific functions for the default StaffAny access levels to suit your organizational structure better.

You can use permission groups to set custom-defined permissions for different groups of users.
Users in those permission groups will now have the new permissions as per defined in the permission group.

For example, suppose a group of your staff should be allowed to do everything within the default manager access level besides approving leave and approving unscheduled shifts. In that case, you can create and tag those staff to a custom-defined permission group to achieve this.

Refer here to learn more about our default access levels.

This guide will cover the following:

Setting up Permission Groups for your team
Creating and Assigning staff to Teams
Seeing Permission Groups for your staff
Permission Group Templates
FAQs

Setting up Permission Groups for your team

If you don’t see it in the Settings, reach out to the StaffAny Support Team to unlock this, and set this up for your organization!

Creating Permission Groups

Go to Setting and select Permission Groups.
Click on Add Permission Group.
You will be directed to a new page. Fill in:
1. Group Name
  You can customize the name of the permission group according to your preference. We recommend using clear and explanatory names, such as "Owner access to block managing payroll for other owners."
2. Base Access Level
  The base access level is the default permission inherited if no specific permission is set to the permission group.
3. Permission Target
  Allows you to specify which group of staff, sections, or teams that the permission group will be able to view and manage.
  1. All Staff
    Example: Scheduling manager not allowed to see payroll data of all staff.
  2. Assigned Section
    Example: HR with owner access level not allowed to see payroll data of staff in the same section.
  3. Assigned Teams
    Example: HR with owner access level not allowed to see fellow HR salaries.
  4. Selected Teams
    Example: HR with owner access level not allowed to see boss and fellow HR/managers salaries.
If you want to make that group as the default permission group for new staff with same access level, you can tick the Assign New Users at This Access Level to This Permission Group checkbox.
Click on the Next button to proceed.
In this page, you can change the permissions on the Custom Permission column to:
1. Allow
2. Deny
3. Not Set - This will fall back to the default access level setting. To learn more about access level permissions, refer to this article.
Refer to the Result column for the newest permissions.
After you finish, click on the Add Permission Group button at the bottom.

❗Note: Once you create a permission group for a specific access level, ensure that everyone in that access level has a permission group. Without permission groups, all permissions will be set to deny for that access level.

List of customizable permissions

Permission name	Description	Applicable to the permission target?	Default Permission - Manager	Default Permission - Owner
Add and edit permission group on settings	To view, create, and edit the permission group settings.	No	Deny	Allow
Add staff for own sections	To add and invite staff to the assigned sections of the organisation.	No	Allow	Allow
Deactivate and reactivate staff	To deactivate and reactivate staff from the organisation	No	Allow	Allow
View staff profile	To view the staff on the list of My Team page and view the profile details. *) The staff hidden from My Team, will also be hidden in mass edit details export.	Yes	Allow for own sections only	Allow for all staff
View & edit payroll details	To view and edit specific information related to the: current wages setup additional pay items statutory & payment identification information. *) If it is hidden on the staff details, it will also be hidden in mass edit details export.	Yes	Deny for all staff	Allow for all staff
Manage staff permission group on employee profile	To assign a team and permission group to the staff.	Yes	Deny for all staff	Allow for all staff
Add leave type	To create a new leave type in the settings.	No	Deny	Allow
Edit leave type	To edit the existing leave type settings.	No	Deny	Allow
Edit leave hours	To edit the default leave hours on the staff profile details.	No	Allow	Allow
Approve leave based on routing settings	If the user is within the leave routing, denying the permission allows the staff to receive the incoming leave application but can’t click the approve button.	No	Allow	Allow
Reject leave based on routing settings	If the user is within the leave routing, denying the permission allows the staff to receive the incoming leave application but can’t click the reject button.	No	Allow	Allow
Approve unscheduled clock request	Managers/owners within the assigned section by default receive notification of unscheduled shifts/clock requests. Denying this, prevents them from approving the request.	No	Allow	Allow
Reject unscheduled clock request	Managers/owners within the assigned section by default receive notification of unscheduled shifts/clock requests. Denying this, prevents them from rejecting the request.	No	Allow	Allow
Manage staff timesheets & work more approval	To perform the following actions towards everyone’s timesheets: Editing the timesheets Approving/rejecting unscheduled clock requests. Approving/rejecting work more requests.	Yes	Allow for own sections only	Allow for all staff
Manage timesheets & work more approval (for manager & owner access level)	To perform the following actions towards managers and owners timesheets: Editing the timesheets Approving/rejecting unscheduled clock requests. Approving/rejecting work more requests.	Yes	Allow for own sections only	Allow for all staff
Edit actual sales for own sections	To edit the actual sales in the web app or mobile app.	No	Allow	Allow
Run payroll	To access payroll functionalities, view and create payroll for the staff.	Yes	Deny for all staff	Allow for all staff
View section labour cost report	To view and download section labour cost reports	No	Deny	Allow
Create announcement for own sections	To send announcements for the staff within the selected sections.	No	Alow	Allow

Assign or tag staff to permission group

There are 2 ways to assign staff to permission group:

A. Mass assign permission group with Mass Edit Staff

Go to My Team and click on Mass Add/Edit. Then select CSV - Edit Staff Details.
Choose between:
1. Mass Edit All tab: If you want to update all staff data
2. Select Staff tab: If you want to update several staff data
Download the template and make changes to the Permission Group column. Make sure that you fill in the correct name.
Save or download the updated file as .CSV (Comma Separated Values) and Upload the file.
Click Submit.

B. Mass assign permission group on web app

Go to My Team and select a staff account. Then click on the Permission Groups at Work Information card on the right.
Click on Permission Group dropdown and select to assign permission groups to staff.

Note:
- Staff can only be assigned to permission groups with the same access level. For example, managers can only be tagged to any manager-based permission groups.
- You cannot create a permission group here. If you need a new permission group, please go to the permission group settings and follow steps mentioned above.
Click on Save to apply the changes.

Creating and Assigning staff to Teams

Teams is a department/team where staff work (e.g. C-Suite, Management, HQ, etc) and will be used as a target group of the permission group.

For example, X is a HR with owner access level and not allowed to see payroll data of fellow owners in HQ team. X will be tagged to the “HQ” team along with other owners. X also tagged to a permission group that blocks the HQ team from seeing each other's salaries.

Create Teams

To create teams for example above:

Go to My Team and select a staff account. Then click on the Work Information card on the right.
Click on Teams dropdown and select to assign a team to staff.
If you haven’t created any team or don’t find a team suitable for the staff, you can type a new team name and click on Create Team.
Click on Save to apply the changes.

Assign Teams with Mass Edit Staff

Go to My Team and click on Mass Add/Edit. Then select CSV - Edit Staff Details.
Choose between:
1. Mass Edit All tab: If you want to update all staff data
2. Select Staff tab: If you want to update several staff
Download the template and make changes to the Teams column. Make sure that you fill in the correct name.
Save or download the updated file as .CSV (Comma Separated Values) and Upload the file.
Click Submit.

Seeing Permission Groups for your staff

To check if the Permission Groups are correctly assigned to the relevant staffs:

Go to My Team, click on the staff’s name.
Under the staff’s work information, view the Permission Groups tagged to him under the Permission Group’s tab as shown in the picture below.

Permission Group Templates

Owner access level with all access to the app

Group name: Owner access all
Note: You can customize the group name based on your preference.
Base access level: Owner
Target Group: All Staff
(optional) check Assign New Users at This Access Level to This Permission Group checkbox if you want a newly onboarded owner account to automatically be tagged to this permission group.
Custom permissions: Allow for all permissions

Owner access level not allowed to manage permission group

Group name: Owner block manage permission group
Note: You can customize the group name based on your preference.
Base access level: Owner
Target Group: All Staff
(optional) check Assign New Users at This Access Level to This Permission Group checkbox if you want a newly onboarded owner account to automatically be tagged to this permission group.
Custom permissions:

Permission Name	Custom Permission
Add and edit permission group on settings	Deny
Manage staff permission group on employee profile	Deny
Other permissions	Not Set

Default Manager Staff View

Group name: Default manager staff view
Note: You can customize the group name based on your preference.
Base access level: Manager
Target Group: All Staff
Check the “Assign New Users at This Access Level to This Permission Group” checkbox
Custom permissions:

Permission Name	Custom Permission
Add staff for own sections	Allow
View staff profile	Allow
Edit leave hours	Allow
Approve leave based on routing settings	Allow
Reject leave based on routing settings	Allow
Manage timesheets & work more approval for own sections	Allow
Manage timesheets & work more approval (for manager & owner access level) for own sections	Allow* If manager not allowed to edit their own, fellow managers, and owners’ timesheet, set this permission to Deny*
Edit actual sales for own sections	Allow
Create announcement for own sections	Allow
Other permissions	Not Set

Manager with Owner access level is not allowed to see all owners salary

Before creating a permission group, you have to create teams for all owners. As an example, the team will be called “Owners”.
Tag all staff with owner access level to “Owners” team.
Then create a permission group with following settings:
1. Group name: Owner block see owner wages
  Note: You can customize the group name based on your preference.
2. Base access level: Owner
3. Target Group: Assigned Teams
4. (optional) check Assign New Users at This Access Level to This Permission Group checkbox if you want a newly onboarded owner account to automatically be tagged to this permission group.
5. Custom permissions:

Permission Name	Custom Permission
View & edit payroll details	Deny
Run payroll	Deny
Other permissions	Not Set

Manager with Owner access level is allowed to manage payroll for all staff under them (same section)

Group name: Owner allow manage payroll on same sections
Note: You can customize the group name based on your preference.
Base access level: Owner
Target Group: Assigned Sections
(optional) check Assign New Users at This Access Level to This Permission Group checkbox if you want a newly onboarded owner account to automatically be tagged to this permission group.
Custom permissions:

Permission Name	Custom Permission
View staff profile	Allow
View & edit payroll details	Allow
Run payroll	Allow
Other permissions	Not Set

Supervisor with Manager access level is not allowed to edit their own, fellow manager level, and owner’s timesheets

Group name: Manager block edit timesheet
Note: You can customize the group name based on your preference.
Base access level: Manager
Target Group: All Staff
(optional) check Assign New Users at This Access Level to This Permission Group checkbox if you want a newly onboarded owner account to automatically be tagged to this permission group.
Custom permissions:

Permission Name	Custom Permission
Manage timesheets & work more approval (for manager & owner access level)	Deny
Other permissions	Not Set

Prevent Supervisor access level from sales data input

Group name: Prevent Supervisor from sales data input
Note: You can customize the group name based on your preference.
Base access level: Supervisor
Target Group: All Staff
(optional) check Assign New Users at This Access Level to This Permission Group checkbox if you want a newly onboarded owner account to automatically be tagged to this permission group.
Custom permissions:

Permission Name	Custom Permission
Edit actual sales for own sections	Deny
Other permissions	Not Set

Frequently Asked Questions

Q: Why can't I add a new permission group? Why is the button gray or disabled?

A: When creating a new permission group, there should be at least one permission that is set to allow or deny instead of not set

Q: What happens if one staff has 2 or more permission groups assigned?

A: Both permission groups would be effective. But if some permissions have different allow/deny settings, it will take the priority as follows:

Deny
Allow
Unset – equal to the base access level.

Q: Can one staff be in multiple permission groups, and each permission group has a different permission target?

A: Yes. Example:

HR is assigned to the “Allow to manage payroll except HQ” permission group which allows HR to run payroll for all assigned teams except HQ.
HR is also assigned to “Allow edit payroll details” of “Assigned sections” that allows HR to see and edit anyone’s payroll data who are in the same sections as HR.
Result: HR would be able to view and edit payroll details of assigned sections, and they’re able to run payroll for all staff except for HQ team.

Q: All managers are able to do payroll for each section but StaffAny manager access levels are not allowed to access payroll. However, I don’t want them to have same access as owner. What should I do?

A: Unfortunately manager access level can’t access any payroll feature in web app. If you want your manager to be able to run and access payroll for staff under them, you can change their access level to “Owner” and tag them to “Owner block see owner wages” and “Owner allow manage payroll on same sections”.

Q: If I set Run Payroll permission to "Allow" for "All Staff" and "Deny" for "Selected Teams". Will I be able to see the payroll report for all of the staff except those ones that belongs on the team or i shouldn't be able to see for everyone?

A: You will be able to see all of the staff payroll report expect the ones that's tagged into that specific team that you set before.