How to Manage Feature Access and Permissions

Getting There

1. Click Settings (cog icon) in the left sidebar.
2. Select Feature Access from the settings menu.

Selecting an Admin

1. Use the Search Employee field to find an admin by name.
2. Click their name in the list on the left to load their current permissions.

Screen Permissions

Screen permissions control which pages in Timecloud an admin can see.

• Screens are organised into categories (e.g. Roster, Attendance, Employees). Click a category header to expand or collapse it.
• Each screen within a category has an enable toggle.
• Toggle a screen on to grant access; toggle it off to hide it from that admin.
• Timecloud remembers which categories you have expanded, so your layout stays the way you left it.
• Use the Select All checkbox at the top of the list to enable or disable every screen permission at once.
  • A filled checkbox means all screens are currently enabled.
  • A dash (indeterminate) means some screens are enabled and some are disabled.
  • An empty checkbox means no screens are enabled.

Organisation View Permissions

The Organisation View has individual permissions for each section, giving you fine-grained control over what each admin can access:

This lets you grant an admin access to only the specific Organisation View sections they need - for example, giving an HR manager access to Competency Review and Lifecycle without exposing the Report Builder.

Payroll Provider Access

The All Payroll Providers toggle controls which payroll providers a sub-admin can access. It appears in the Time, Attendance & Payroll category.

• All Payroll Providers ON - The admin can access every connected payroll provider (current and future) and can create or enable new providers.
• All Payroll Providers OFF - Individual per-provider toggles appear beneath, letting you grant access to specific providers only.

Granting access to specific providers

1. Toggle All Payroll Providers off.
2. A list of your company's connected providers appears nested below.
3. Toggle each provider on or off to control that admin's access.

What this controls

• Which providers appear on the admin's Payroll page (they only see providers they have access to).
• Whether the admin can open a provider's dashboard, sync timesheets, manage mappings, etc.
• Whether the admin can create or enable new providers - only admins with All Payroll Providers enabled can do this.
• If a sub-admin tries to access a provider they don't have permission for, they'll see an error message and be redirected back to the Payroll page.

Operations Permissions

Operations permissions control what actions an admin can perform within each feature area.

• For each feature, you can toggle:
  • Add - create new records.
  • Delete - remove records.
  • Edit - modify existing records.
  • View - see records (read-only access).
• Use the Select All checkbox at the top of the list to enable or disable every operation (Add, Delete, Edit, View) across all features at once.
  • A filled checkbox means all operations are currently enabled.
  • A dash (indeterminate) means some operations are enabled and some are disabled.
  • An empty checkbox means no operations are enabled.

Key Operations

Manage Leave

The Manage Leave permission controls what a sub-admin can see and do with leave applications and leave balances.

How it works

• Company Admins always have full leave access regardless of this setting.
• Sub-Admins are subject to the individual View/Add/Edit/Delete toggles.
• If Feature Access is disabled for your company, all admins retain full access (the setting has no effect).
• Employees can always view their own leave balances and submit their own leave applications, regardless of admin-level permissions.
• When View is off, leave-related notification counts are also hidden from the notification bell.

Manage Shift

The Manage Shift permission controls what actions a sub-admin can perform on shift templates from the Shifts page.

How it works

• Company Admins always have full shift access regardless of this setting.
• Sub-Admins are subject to the individual View/Add/Edit/Delete toggles.
• If Feature Access is disabled for your company, all admins retain full access (the setting has no effect).
• Permissions are enforced on both the Shifts page and the server, so restricted actions return an error even if accessed directly.

Manage Roster Templates

The Manage Roster Templates permission controls what actions a sub-admin can perform on roster templates (also known as roster patterns). It appears in the Operations list only when the Roster Editor screen permission is enabled.

How it works

• Company Admins always have full roster template access regardless of this setting.
• Sub-Admins are subject to the individual View/Add/Edit/Delete toggles.
• If Feature Access is disabled for your company, all admins retain full access (the setting has no effect).
• When the Roster Editor screen permission is turned off, the Manage Roster Templates checkboxes are automatically cleared.
• This permission is not enabled by default - access must be explicitly granted to each sub-admin.

Manage Competencies

The Manage Competencies permission controls what actions a sub-admin can perform on competency records. It appears in the Operations list only when at least one competency-related screen (Competencies tab, Competency Templates, or Competency Review) is enabled.

How it works

• Company Admins always have full competency access regardless of this setting.
• Sub-Admins are subject to the individual View/Add/Edit/Delete toggles.
• If Feature Access is disabled for your company, all admins retain full access (the setting has no effect).
• When all competency screen permissions are turned off, the Manage Competencies checkboxes are automatically cleared.
• This permission is enabled by default - existing sub-admins keep full competency access unless you explicitly restrict it.

Manage Sensitive Properties

The Manage Sensitive Properties permission adds a second layer of access control for data marked as sensitive. It works alongside other operations permissions (like Manage Competencies) rather than replacing them.

How it works with payroll panels

Profile Templates include panel-level Sensitive toggles under the Payroll group. Each one gates an entire section of the employee's profile. Timecloud shows only the toggles relevant to your company's payroll setup - Legacy Payroll Fields and Employment Agreements are mutually exclusive, so you will see one or the other depending on your configuration:

• Payment & Tax Details - bank account, superannuation/KiwiSaver, and tax information (sensitive by default).
• Legacy Payroll Fields - weekly overtime overrides, overtime period, and payroll codes (not sensitive by default).
• Payroll Export Settings - payroll export toggle and custom codes (not sensitive by default).
• Employment Agreements - employment agreement, employee type, base pay rate, role-based pay rates, and auto allowances (sensitive by default).

When a panel is marked sensitive:

• Sub-admins without View cannot see the panel at all on employee profiles.
• Sub-admins with View but not Edit see the panel in read-only mode.
• The sensitivity also applies to the API and HR Report Builder - columns derived from a sensitive panel are marked as sensitive in report exports.
• Company Admins are always exempt and have full access.

Admins can change these toggles in Human Resources > Organization View > Profile Template under the Payroll group.

How it works with competency templates

When a competency template is marked as sensitive (via the toggle on the template), all the following are gated by the Manage Sensitive Properties permission:

• Visibility - the template and all employee records created from it are hidden from admins without View.
• Editing - the template content, its employee records, and bulk uploads against it require Edit.
• Deleting - removing the template or any employee record created from it requires Delete.
• Notifications - expiry alerts for sensitive items are only sent to managers who have View.

Company Admins are always exempt and have full access to sensitive data.

Saving Your Changes

• Click Save Changes after updating permissions for an admin.

Important Notes

• Only users with the admin role appear in this list. To make someone an admin, go to their employee profile and assign the admin role first.
• Changes take effect immediately after saving - the admin will see their updated access on their next page load.
• Be careful when removing View permissions - the admin will lose all access to that feature area.
• When a payroll provider is deleted, its per-provider permission is automatically removed from all admins.

Tips

• Use Select All to quickly grant full access to a new admin, then turn off the specific screens or operations they don't need.
• Give managers only the access they need - a roster manager may not need payroll or employee profile access.
• Use the granular Organisation View permissions to tailor access for different roles - a compliance manager may only need Competency Templates and Competency Review.
• Use All Payroll Providers to give payroll managers full access, or toggle it off and grant only specific providers for admins who manage a single integration.
• Use Manage Shift to control which sub-admins can create, edit, and archive shift templates - for example, give team leads view-only access to shifts while restricting creation and archiving to senior roster managers.
• Use Manage Roster Templates to control which sub-admins can create, edit, and archive roster templates - for example, give shift supervisors view-only access while restricting template creation to senior roster managers.
• Use Manage Competencies to give HR coordinators view-only access to competency records while restricting edits to senior HR staff.
• Use Manage Sensitive Properties to restrict sensitive payroll panels and competency templates to a small group of trusted admins while still giving broader teams access to non-sensitive data.
• Use Manage Leave > View to control which sub-admins can see leave balances and leave applications - for example, restrict leave visibility to HR and team leads while keeping it hidden from roster-only managers.
• Review permissions periodically, especially when admins change roles within your organisation.
• If an admin reports they can't see a page, check their screen permissions here first.
• If a sub-admin can't approve leave requests, check that the Manage Leave > Edit permission is enabled.
• If a sub-admin can't see leave balances on an employee's profile or the leave application list is empty, check that Manage Leave > View is enabled.
• If a sub-admin can't see a payroll provider, check their All Payroll Providers permission or the individual provider toggle.
• If a sub-admin can't see competency data, check both the relevant screen permission and the Manage Competencies > View toggle.
• If a sub-admin can't see certain competency templates, check whether those templates are marked as sensitive and whether the admin has Manage Sensitive Properties > View enabled.
• If a sub-admin can't see payroll panels (bank details, tax, pay rates) on an employee profile, check whether those panels are marked sensitive in Profile Templates and whether the admin has Manage Sensitive Properties > View enabled.
• If a sub-admin can't see roster templates or the Roster Patterns section on the Shifts page, check that both the Roster Editor screen permission and Manage Roster Templates > View are enabled.
• If a sub-admin can't create or edit shifts, check that the Manage Shift permission has the relevant action (Add, Edit, or Delete) enabled.