Roles and permissions

What each role can do on each entity. Rows marked "only own" or "scope" are filtered by the core on every list, read, update and delete.

Roles

Role	Description
hrms:admin	HR administrator: employees, departments, designations, holidays, leave types, policies, devices, approvals and reports
hrms:payroll	Payroll officer: salary structures, monthly payroll runs, payslips, bank account approval, loan/advance/reimbursement payouts
hrms:manager	Reporting manager: approves leave, attendance corrections, reimbursements and resignations of their team
hrms:employee	Staff member: marks attendance, applies for leave, claims reimbursements, views own payslips and documents

Access by entity

Entity	hrms:admin	hrms:payroll	hrms:manager	hrms:employee
Event / Announcement	read, create, update, delete	read	read	read
Attendance	read, create, update, delete	read	read, update	read, create, update — only own rows (via employee)
Bank Account	read	read, update		read, create — only own rows (via employee)
Biometric Device	read, create, update, delete
Department	read, create, update, delete	read	read	read
Designation	read, create, update, delete	read	read	read
Employee	read, create, update, delete	read, update	read	read, update — only own rows (via user)
Employee Document	read, create, update, delete			read, create, delete — only own rows (via employee)
Holiday	read, create, update, delete	read	read	read
Leave Balance	read, create, update, delete	read	read	read — only own rows (via employee)
Leave Application	read, create, update, delete	read	read, update	read, create, update — only own rows (via employee)
Leave Day	read, create, update, delete	read	read, update
Leave Type	read, create, update, delete	read	read	read
Letter Template	read, create, update, delete
Employee Loan	read, update	read, update		read, create, delete — only own rows (via employee)
Payroll Run	read	read, create, update, delete
Payslip	read	read, create, update, delete		read — only own rows (via employee)
Payslip Line	read	read, create, update, delete
Payslip Request	read	read, update		read, create — only own rows (via employee)
HR Policy	read, create, update, delete	read	read	read
Reimbursement Claim	read, update	read, update	read, update	read, create, delete — only own rows (via employee)
Resignation	read, update		read, update	read, create — only own rows (via employee)
Salary Advance	read, update	read, update		read, create, delete — only own rows (via employee)
Salary Component	read, create, update, delete	read, create, update		read
Salary Structure	read	read, create, update, delete		read — only own rows (via employee)
Attendance Star Reward	read, update		read, update	read — only own rows (via employee)