Roles and permissions
Who can see and do what in HCM, page by page and field by field.
The roles are given in the Tenant Portal; see Granting HCM access. A Tenant Admin with no HCM role has none of the rights below.
Pages
| Page or action | Employee | HR Manager | HR Administrator |
|---|---|---|---|
| My Leave: own balances, request, cancel own (needs a linked employee record) | Yes | Yes | Yes |
| My Documents: own, download only | Yes | Yes | Yes |
| Approval timeline of your own request | No | Yes | Yes |
| Approvals page and delegations | No | Yes | Yes |
| Decide a step | No | When it is routed to you or delegated to you | When it is routed to you or delegated to you |
| Team calendar | No | Self and everyone below | Whole workspace |
| Your team's reporting line | No | Yes | Yes |
| Employees page | No | Read-only roster | Full directory, add, edit, org chart |
| Employee record, history, documents, others' balances | No | No | Yes |
| Settings (all nine tabs) | No | No | Yes |
Nobody can decide their own request.
Protected fields
| Field | Who can read | Who can change |
|---|---|---|
| National ID, Bank IBAN, Bank BIC/SWIFT | HR administrators and the employee; never managers | HR administrators |
| Salary | HR administrators, the employee and their manager of record; others see "đź”’ Restricted" | HR administrators |
| Custom fields | By access class; see Custom fields and access classes | HR administrators (and the employee for Self (private)) |
In the October 2026 release, only HR administrators open employee records, so in practice the employee and the manager do not see these fields in HCM's screens.
Not in HCM
- Giving roles: Tenant Portal.
- Your own profile, password and date format: Tenant Portal and Launcher.
- Access follows the HCM role; it does not depend on a seat.