How to Create a Role and Set the Permission Level

【What is a role?】

A role is a “job title” setting that bundles “who can do what.” Instead of granting permissions to each user individually, you bundle permissions into a role and assign that role to people.

(Admin screen: Admin → Roles → “Create”)

【① Basic info】

· Role name: the name shown on screen (e.g., Manager, Store Leader).

· Slug: internal identifier. Leave blank — it is auto-generated from the name.

· Role color: a color to tell roles apart in lists and badges.

【② Make it a tenant administrator? (permission level)】

Use the “Make this role a tenant administrator” toggle to decide whether the role is an admin.

· ON (administrator): can use every admin screen regardless of the “Admin delegation” below. However, some sensitive data — payroll, the wage ledger, My Number — must still be granted explicitly under “Admin delegation,” even for administrators.

· OFF (regular role): can only use what you allow under “Admin delegation.”

※ Only an administrator can make a role an administrator (delegated managers cannot create or set admin roles).

※ This sets system-level authority. Job grades (Section/Department manager) and salary ranges or approval limits are set under “Position management.”

〔Advanced〕 Internally this is a 0–100 “permission level” number, used for the “90+ = administrator” determination and the sort order of the role list. The toggle is enough for most cases. To adjust the number directly, open “Detail (permission-level number)” and pick a job-grade preset (general 0 / leader 30 / chief 50 / section manager 60–70 / department head 70–80 / administrator 90+) or type a value.

【③ Data scope】

The range of “whose data” this role’s users can see. For example, “Own department” lets a department head see only their own department’s attendance and leave. Tenant administrators always see the whole company and are unaffected by this setting.

【④ Allowed apps】

Decides which apps this role can use from the menu.

· Everyday apps (attendance, leave, overtime, expenses, tasks) are automatically included in every role.

· Industry-specific apps (HACCP, inventory, management, etc.) are not included by default. To enable them, choose “Select to grant” or “Grant all contracted.”

【⑤ Feature permissions】

Fine-grained toggles like “edit other people’s projects” or “add a break afterward.”

※ Applies only when “Enable role permissions” is ON in tenant settings. When OFF, everyone can perform these actions as before.

【⑥ Admin delegation】

Opens up admin-only screens (e.g., attendance settings, member management) to this role.

· Functions marked “Danger” (payroll, wage ledger, My Number, permission settings, tenant settings) require extra caution — only an administrator can delegate them, and even an admin role must be granted sensitive data here explicitly.

【Principle of least privilege】

Grant only the permissions needed and nothing more. Review roles regularly, especially on transfers and departures.