What this article is for
Use this reference to answer: “Which permission does this person need?” It explains the 52 individual permissions shown in the Roubler permission-selection screen, their limits and when they need to be used together.
These are Roubler workforce-management permissions, not restricted-user permissions in the separate Pay Engine.
Reading the permission options
Each permission chip represents a capability. A preset adds a collection of capabilities, so check the individual permissions rather than relying on the preset name alone. When a task needs several permissions, they can normally sit in the same custom group.
The screen below shows the individual options covered by this reference:
In this annotated example, the arrows distinguish the Manager preset from an individual permission chip. The pictured combination is an example, not a recommended minimum-access configuration.
How to read the combination notes
Required together: the permission reference explicitly identifies a prerequisite.
For this workflow: the combination supports separate steps in a task; it is not necessarily a technical dependency.
Check before granting: a version, integration or screen-specific limitation needs checking.
A permission beginning with “View” is not always read-only. For example, View Messages includes comments and reactions, and View Onboarding Statuses includes resending/deleting invitations. Read the capability and limit columns before selecting it.
The descriptions and prerequisites below follow the Roubler permission labels. Historical implementation notes and unverified dependencies remain clearly marked. Do not assume Roubler automatically adds missing prerequisites.
1. Employee self-service permissions
These permissions relate to the user’s own profile and records, not general management access to other employees.
Permission |
What it does |
When another permission is needed / important limit |
|---|---|---|
View Own Employee Profile |
Shows My Profile in the account menu and dashboard. Allows access to, and permitted updates within, the user’s own profile. |
Recommended for custom groups. This is a prerequisite for the own-profile tabs below; it is not unrestricted editing of every personal or payroll field. |
View Own Employee Roster |
Shows the Schedule tab in the user’s profile. |
Requires View Own Employee Profile. If the company option allowing employees to see full rosters is enabled, visibility can extend to other staff at accessible locations. |
View Own Employee Shift Requests |
Shows the user’s own Shift Request tab. |
Requires View Own Employee Profile. Does not provide manager access to other employees’ requests. |
View Own Employee Leave |
Shows Leave & Unavailability and allows adding, editing and deleting the user’s own leave requests within the permitted workflow. |
Requires View Own Employee Profile. It is not permission to approve other employees’ leave. |
View Own Employee Expenses |
Shows the Expenses tab on the user’s own profile. |
Requires View Own Employee Profile. Does not provide manager approval rights. |
View Own Time And Attendance In Employee Portal |
Shows Time & Attendance in the user’s profile. |
Requires View Own Employee Profile. Viewing is separate from entering timesheets. |
Create And Update Own Timesheet Entry Through The Employee Portal Or Mobile App |
Allows employees to enter their own timesheets through employee self-service. |
For a usable portal workflow, include the own-profile and own-Time & Attendance viewing permissions. This does not grant approval or other employees’ timesheet-management rights. |
Example: employees need to enter their own timesheets
Use these together for the self-service workflow:
View Own Employee Profile.
View Own Time And Attendance In Employee Portal.
Create And Update Own Timesheet Entry Through The Employee Portal Or Mobile App.
Do not give general Create And Update Timesheets merely because employees need to enter their own time. The latter is a management permission.
2. Leave requests and balances
Permission |
What it does |
When another permission is needed / important limit |
|---|---|---|
View Leave Requests |
Controls visibility of the Leave tile in the mobile app, according to the permission reference. |
Do not describe this as the Pay Engine’s read-only access to all leave requests. It does not, by itself, establish access to the web management leave screen or an approved-only view. |
Approve Leave Requests |
Enables Leave navigation/the dashboard Leave tile and allows approving or declining requests. |
Add Create And Update Leave Requests if the user must also enter or change requests. Add View Leave Balances if balances are needed during entry/editing. |
Create And Update Leave Requests |
Allows adding and updating leave requests. |
For adding/updating requests through another employee’s profile, the reference also requires View Full Employees Information and Create And Update Employees. |
View Leave Balances |
Shows leave balances when adding or editing requests. |
Requires Approve Leave Requests. This is a specific documented dependency; the balance permission is not a standalone leave-management role. |
Example: a manager must approve leave and check the balance
Required together:
Approve Leave Requests.
View Leave Balances.
If that manager must create or amend requests as well, add Create And Update Leave Requests. If they do this through the employee profile, include the employee-profile permissions listed above.
Do not promise approved-only leave access from these permission names. Test the screen, statuses and employee scope separately.
3. Rosters, templates and costs
Permission |
What it does |
When another permission is needed / important limit |
|---|---|---|
View Roster |
Shows the Roster screen and shift schedule. |
Does not grant shift creation, editing or publishing. |
Update And Publish Roster |
Allows adding/editing shifts and publishing/unpublishing them. |
Requires View Roster. Editing and publishing are bundled in this permission; do not promise draft-editing-only access from this combination. |
View Templates |
Allows viewing roster/shift templates. |
Does not allow creating, changing, deleting or applying templates under the documented template-management permission. |
Create, Update And Delete Template |
Allows adding, editing, deleting and applying shift templates. |
Requires View Templates. Also retain the roster permissions needed for the surrounding roster workflow. |
View Roster And Timesheet Costings |
Shows costs in the roster and Time & Attendance screens. |
Roster costs require View Roster; timesheet costs require View Time And Attendance. Include both viewing permissions where costs are needed on both screens. |
Example: view the roster without changing it
Start with View Roster and the intended Location Access. Do not add Update And Publish Roster unless changes and publication are authorised.
Example: create shifts, publish them and see costs
For this workflow, use:
View Roster.
Update And Publish Roster.
View Roster And Timesheet Costings.
If employee names are missing from selection lists, check View Basic Employees Information, which populates employee dropdowns. Do not immediately grant View Full Employees Information or Administrator access.
4. Time & Attendance and timesheet approvals
Permission |
What it does |
When another permission is needed / important limit |
|---|---|---|
View Time And Attendance |
Shows the Time/Timesheet screen and employee timesheets. |
Viewing is separate from editing, approving, authorising and submitting to payroll. |
Create And Update Timesheets |
Allows adding/editing timesheets and rejecting them. |
Retain View Time And Attendance for screen access. Also required to unapprove timesheets and, under Roubler’s dependency guidance, to authorise them for payroll. |
Approve Timesheets |
Allows approving timesheets. |
Unapproving also requires Create And Update Timesheets. Approval alone is not general editing or payroll submission. |
Approve Own Timesheets |
Allows the user to approve their own timesheets. |
Separate from approving other employees’ timesheets. Grant only where self-approval is authorised; retain the viewing/workflow permissions needed to reach the record. |
Authorise Timesheets For Payroll |
Allows authorising timesheets for payroll. |
Requires Create And Update Timesheets under Roubler’s dependency guidance. Unauthorising also requires Approve Timesheets. Committing/submitting requires the payroll-management permission as well. |
Approval, authorisation and submission are different steps
Approve: confirms the timesheet through the approval stage.
Authorise: progresses the timesheet to payroll authorisation.
Commit/submit: sends the authorised timesheet through the payroll workflow.
Do not add payroll-management access merely to solve an approval problem.
Example: a manager needs to approve and later correct a timesheet
For this workflow, include:
View Time And Attendance.
Approve Timesheets.
Create And Update Timesheets.
The third permission is required for unapproving and for editing. This does not mean processed or locked payroll records can always be changed; follow the record’s permitted workflow.
Example: timesheets must be authorised but not submitted by the manager
Include the viewing, creation/update and authorisation permissions required for that role. Add Approve Timesheets if the user also needs approval or unauthorisation duties. Do not grant Basic Payroll Management solely for authorising.
Important version note: the Modify action
Roubler v25.4.1 removed the Basic Payroll Management requirement from Modify on Manage Time. Create And Update Timesheets is the relevant permission. Do not use the older workaround of adding payroll access simply to enable Modify.
Related guidance: Roubler v25.4.1 release notes.
5. Employee information, records and qualifications
Permission |
What it does |
When another permission is needed / important limit |
|---|---|---|
View Basic Employees Information |
Shows Employees under Management and populates employee selection lists on other screens. |
A smaller starting point for employee selection; it is not a promise of access to every profile tab. |
View Full Employees Information |
Allows viewing employee profiles and most profile tabs. |
Does not automatically grant profile editing or access to every payroll-related tab. Broader personal information may be exposed; do not add it just to populate a dropdown. |
Create And Update Employees |
Allows adding employees and editing information on available employee-profile tabs. |
Requires either View Basic Employees Information or View Full Employees Information. Some specialist tabs still require their own permissions. |
Archive Employees |
Hides employees from front-end views and reports. |
Not a permission to run the entire termination process or permanently delete a record. Treat archiving as a controlled HR/payroll action. |
View And Manage Non-Payrolled Employees |
Allows access to non-payrolled employee records. |
Viewing requires Basic or Full employee-information permission. Updating also requires Create And Update Employees. |
View Employees Licences And Training |
Gives read-only access to employee Requirements and Qualifications. |
Separate from permission to create or update those records. |
Create And Update Employees Licences And Training |
Allows creating/updating requirements and qualifications against employees. |
Requires View Employees Licences And Training. |
View And Upload Sensitive Employee Documents |
Gives access to sensitive documents stored against employees. |
Grant only where the role needs sensitive records. Ordinary Document Library access is not a substitute. Also review employee-edit rights: the reference notes sensitive-document capability under Create And Update Employees. |
Example: edit employee information without adding payroll processing
Required together:
Create And Update Employees.
Either View Basic Employees Information or View Full Employees Information, according to the screen needed.
Do not add Basic Payroll Management or Manage Pay Runs unless the job also requires those capabilities. If the task is to edit payroll-related profile tabs, see the payroll section below.
What different employee-profile access can look like
These examples show the profile navigation available to different default permission groups. Use them to recognise the screens being discussed, not as a complete or guaranteed list of tabs for a custom group.
Manager example:
Manager with Payroll example:
What to check: if the required tab is missing, review the relevant employee-information and payroll permissions. If the tab opens but a field cannot be changed, check the editing permission separately. Do not add payroll access just to make the navigation match the second example.
Example: update a qualification
Required together:
View Employees Licences And Training.
Create And Update Employees Licences And Training.
Also check access to the employee record and relevant location. A qualification permission cannot fix missing employee scope.
6. Expense requests
Permission |
What it does |
When another permission is needed / important limit |
|---|---|---|
View Expense Requests |
Gives read-only expense-request access and access to the Manage Expenses tile in the mobile app. |
Does not grant creating, editing, approving or declining. |
Create And Update Expense Requests |
Allows creating/updating expense requests. |
Use when entering claims for staff or when required by the approval workflow. Do not confuse this with View Own Employee Expenses. |
Approve Expense Requests |
Allows approving or declining expense requests. |
The published permission reference lists Create And Update Expense Requests as a prerequisite. Profile-based approval also requires Full employee-profile access, employee-editing rights and payroll-management access. |
Example: approve expenses from the employee profile
The reference lists these capabilities together:
Approve Expense Requests.
Create And Update Expense Requests.
View Full Employees Information.
Create And Update Employees.
Payroll management capability, labelled Basic Payroll Management in the supplied screen.
This is broader than read-only access to expense requests. Assess the exact screen the user needs before granting profile and payroll permissions.
Documentation caution
The public permission list contains apparently duplicated leave-balance wording under Create And Update Expense Requests and the Document Library write permission. This guide does not treat that copied wording as a genuine leave-permission dependency. The expense-approval dependency above is explicitly stated under Approve Expense Requests; Roubler’s separate dependency guide describes it in the payroll-bundle context. For an approval-only custom group, validate the target screen in your Roubler version rather than assuming a universal minimum from the preset name.
7. Documents and learning
Permission |
What it does |
When another permission is needed / important limit |
|---|---|---|
View Document Library |
Shows Documents under Management/on the dashboard and allows viewing shared documents. |
Does not replace sensitive employee-document access. |
Create And Update Documents In The Document Library |
Provides the Document Library creation/update capability. |
For the read-and-maintain workflow, retain View Document Library as well. A separate hard prerequisite is not reliably established by the public reference because its description is duplicated incorrectly. |
Allow Access To Learning Portal |
Shows the Learning Academy link under Management. |
Depends on the business’s learning/Go1 integration being configured. A permission alone does not configure the integration. |
Use Document Library access for shared business documents. Assess employee-record and sensitive-document permissions separately for private employee files.
8. Onboarding
Permission |
What it does |
When another permission is needed / important limit |
|---|---|---|
View Onboarding Statuses |
Enables the invite button on Employees and allows resending/deleting onboarding invitations. |
Despite “View” in the name, this is not completely read-only. |
Create Onboarding Invites |
Allows sending onboarding invitations to employees. |
Requires View Permission Groups to select the relevant group. For the Employees-screen invite workflow, also check View Onboarding Statuses and employee-list access. |
Example: a user needs to send and manage invitations
For this workflow, check:
View Basic Employees Information or the appropriate employee-list access.
View Onboarding Statuses.
Create Onboarding Invites.
View Permission Groups.
View Permission Groups is an explicit prerequisite for sending invitations. If a group is missing from the selection list, check the inviter’s permitted groups and the target location/position rather than granting Administrator access by default.
9. Reporting, analytics, business intelligence and payroll
Permission |
What it does |
When another permission is needed / important limit |
|---|---|---|
View Reporting |
Shows Reporting under Management and makes Employee and Time & Attendance reporting available. |
Does not independently enable Payroll or Analysis reports. Individual reports can depend on the group and product configuration. |
View Payroll Reporting |
Allows access to Payroll reporting. |
Requires View Reporting. This is reporting access, not permission to run payroll. |
View Analytics Reports |
Allows access to Analysis reporting. |
Requires View Reporting. Keep this separate from the Business Intelligence permission. |
View Business Intelligence |
Shows the Business Intelligence link and enables its functionality. |
Do not treat View Analytics Reports as an interchangeable permission or assume BI grants payroll processing. |
Basic Payroll Management |
Shows payroll-related employee-profile tabs and supports committing/submitting timesheets where Authorise Timesheets For Payroll is also granted. Requires multi-factor authentication under the reference. |
Editing payroll-related tabs also requires Create And Update Employees plus Basic or Full employee-information access. Some guidance calls this Payroll Management. It is not required just to use Modify on Manage Time in v25.4.1 onward. |
Manage Pay Runs |
Shows the Payroll link under Management and its dashboard tile. |
Treat as sensitive payroll access. Do not infer every Pay Engine action or report entitlement from this one Roubler permission; verify the connected payroll workflow. |
Example: payroll reports, without processing pay runs
Required together for the report screen:
View Reporting.
View Payroll Reporting.
Do not add Manage Pay Runs merely to make a payroll-reporting tile available. Check that report contents and employee/location scope meet the business’s privacy requirements; do not assume all payroll reports share the same location filtering.
Example: edit payroll-related employee information
The documented combination is:
Basic Payroll Management.
Create And Update Employees.
Either View Basic Employees Information or View Full Employees Information.
This is a different requirement from changing ordinary profile information or viewing employee names in a roster dropdown.
Related guidance: Roubler report access.
10. Messages
Permission |
What it does |
When another permission is needed / important limit |
|---|---|---|
View Messages |
Gives access to Messages in the mobile app and messaging in the web app. Also allows comments and reactions to posts. |
“View” does not mean entirely read-only here. |
Post Messages |
Allows posting new message threads; intended for managers. |
For the read-and-post workflow, include View Messages. The reference does not explicitly establish that viewing is automatically included by selecting Post Messages alone. |
11. Settings, permission groups and support access
Permission |
What it does |
When another permission is needed / important limit |
|---|---|---|
View Settings |
Shows Settings under Management, including applicable settings tiles. |
Screen visibility is not blanket authority to edit every setting. Other permissions determine the actions/tiles available. |
View Permission Groups |
Allows seeing permission groups in supported screens. Required for sending onboarding invitations and setting employee Location Access. |
Does not grant creation or editing of permission groups. |
Create And Update Permission Groups |
Allows managing custom permission groups. |
Requires View Settings to reach the permission-group settings tile. Keep View Permission Groups where the workflow needs group selection/viewing. Changes can affect everyone assigned the edited group. |
Company Administrator |
Privileged company-administration permission shown in the supplied screen. |
The retrieved reference does not define this exact chip’s complete action list. Do not assume this single permission is identical to applying the Administrator preset. Confirm its current scope before granting it. |
View Support Requests |
Intended to show support-access requests for the site. |
The public reference marks this as not fully implemented as of release 24.5. That historical note does not confirm current availability; verify in the site/version before promising the feature. |
Grant Or Revoke Support Requests |
Intended to grant/revoke support-user access to investigate issues. |
The same release-24.5 implementation caveat applies. Treat as privileged access, not ordinary viewing. |
Create And Update Integrations |
Integration-administration permission. |
This is a restricted system-administration capability. Do not add it to ordinary manager groups merely because it appears in a preset or permission list. |
Do not try to fix a missing employee, roster or report by adding Company Administrator or integration rights. Resolve the specific view/action dependency and location scope first.
Quick reference — when two or more permissions are needed
Task |
Permissions to check together |
Why |
|---|---|---|
See an own-profile tab |
View Own Employee Profile + the relevant own-tab permission |
The tab depends on access to the profile. |
Enter own timesheets |
Own profile + own Time & Attendance + own timesheet entry |
Separate self-service viewing and entry steps. |
See balances while approving leave |
Approve Leave Requests + View Leave Balances |
Approval is a documented balance-view prerequisite. |
Edit/publish roster shifts |
View Roster + Update And Publish Roster |
The action permission requires roster viewing. |
Manage shift templates |
View Templates + Create, Update And Delete Template |
Explicit viewing prerequisite. |
See roster costs |
View Roster + View Roster And Timesheet Costings |
Costs require access to the relevant screen. |
See timesheet costs |
View Time And Attendance + View Roster And Timesheet Costings |
Costs require access to the relevant screen. |
Unapprove a timesheet |
Approve Timesheets + Create And Update Timesheets, with screen access |
Unapproving has an extra dependency. |
Authorise timesheets |
Authorise Timesheets For Payroll + Create And Update Timesheets, with screen access |
Documented Roubler dependency. |
Unauthorise timesheets |
Authorise Timesheets For Payroll + Approve Timesheets, retaining authorisation prerequisites |
Unauthorising has its own approval prerequisite. |
Commit/submit timesheets |
Authorise Timesheets For Payroll + Basic Payroll Management, retaining workflow prerequisites |
Authorising and submitting are different powers. |
Edit employees |
Create And Update Employees + either Basic or Full employee-information access |
Viewing prerequisite for employee editing. |
Update qualifications |
View Employees Licences And Training + Create And Update Employees Licences And Training |
Explicit viewing prerequisite. |
Send onboarding invitations |
Create Onboarding Invites + View Permission Groups, with invite/list access |
Groups must be available for selection. |
View payroll reports |
View Reporting + View Payroll Reporting |
Reporting navigation and report category are separate. |
View Analysis reports |
View Reporting + View Analytics Reports |
Reporting navigation and report category are separate. |
Edit payroll-related employee tabs |
Basic Payroll Management + Create And Update Employees + Basic or Full employee-information access |
Payroll and employee-editing prerequisites both apply. |
These combinations describe feature access. The correct Location Access, product configuration and record status still need checking.
Need help applying the permissions?
For instructions on creating and assigning permission groups, Location Access and employee visibility, see Roubler Permissions, Primary Locations and Reporting Hierarchy.
For the specific shared-team privacy scenario, see How to allow two managers to manage the same employees without seeing each other’s profiles.
Related Roubler guidance
Roubler Permissions, Primary Locations and Reporting Hierarchy
Two managers sharing employees without seeing each other’s profiles
Comments
0 comments
Article is closed for comments.