Role-Based Access Control for HR Software

Access Control decides who can do what in ZeniaHR. Each role gets eight actions per module, from view to finalize, a data scope that limits which employees it sees, and masking for salary, bank and contact fields. Seven ready roles give a starting point. Enforcement is switched on per company when the roles are ready, and until then the older permission matrix applies. Approvals follow one fixed chain for every request: the reporting manager first, then HR.

Who uses it

Company headOwns Access Control: seeds or creates roles, ticks actions per module, sets scope and masking, and switches enforcement on. Always keeps full access and can decide any approval step.

HR teamWorks within the HR role, decides the HR step of every request and sees data according to the scope the Company Head sets for HR.

ManagersApprove the first step of their direct reports' requests and, under the ready Manager role, see only their reporting line with salary and bank masked.

EmployeesWork under the Employee role with Self scope: their own attendance, leave, payslips and documents, with requests that go to their manager and then HR.

How access is decided

A user's access comes from the role that matches their login role. The role says which of eight actions they may take in each module, which employees they may see, and whether salary, bank and contact fields appear in full, masked or hidden. The Company Head and Super Admin always keep full access. The switch that turns all of this on is per company and off by default, so a company can prepare its roles first. The HRMS Setup wizard includes a roles and access step that seeds the standard roles and can switch enforcement on.

Approvals follow one fixed chain

ZeniaHR does not ask you to design approval flows. Every request that needs approval follows the same chain: the employee's reporting manager first, if one is set, then HR. One rejection ends the request, and the last approval applies it. The Company Head can decide any step. The chain covers leave, attendance corrections, WFH and on duty, overtime and shift swaps, and the HR dashboard shows the waiting queues so nothing sits unseen.

Rolling out access control safely

Switching on access control changes what every user sees the next time they open ZeniaHR. A short checklist, worked through calmly before the switch is turned on, avoids surprised managers, missing screens and urgent calls to HR on the first morning.

Seed the default roles, then review each role's table module by module.
Check that each user's branch, department and reporting manager are right, because scopes depend on them.
Decide masking for salary, bank and contact for each role.
Switch enforcement on at a quiet time; switching it off returns everyone to the older matrix.

Roles and access control features

Role permissionsSet view, create, edit, delete, approve, export, finalize and configure rights for each module per role, and switch enforcement on when roles are ready.Ready-made rolesStart from seven ready roles, Company Head, HR, Finance, Payroll Admin, Manager, Employee and Auditor, each with rights, data scope and masking set.Salary and bank data maskingShow salary, bank and contact details in full, masked or hidden for each role, so managers and auditors can use employee records without seeing pay.Approval workflowRequests go to the reporting manager first, then HR. One rejection ends a request, the last approval applies it, and the Company Head can decide any step.

See roles and access control on your own data

A 30-minute demo on a video call. We set it up for your departments and rules and show it running. Free for your first 50 employees.

Book a free demo See pricing

Frequently asked questions

What is role-based access control in HR software?

It means users get rights through roles, not one by one. A role such as HR, Finance or Manager carries the actions it may take in each module, the employees it may see and the fields it may read. In ZeniaHR, changing a role changes access for every user who has it.

Can I create my own roles in ZeniaHR?

Yes. Next to the seven ready roles, the Company Head can create a role with any name, such as Plant HR or Regional Manager, then tick its actions per module, pick its data scope and set masking. Custom roles can be deleted later; the ready system roles cannot.

Can I design my own approval workflow in ZeniaHR?

No. Approvals follow a fixed chain: the reporting manager first, then HR, with the Company Head able to decide any step. There is no screen to add levels or change the order. Most companies find this enough, and it keeps approvals predictable for employees and managers.

What happens before access control is switched on?

Until the Company Head switches on enforcement, the older per-user permission matrix in Settings decides access, with view, edit and export rights per module. You can build and review roles in Access Control in the meantime, and nothing changes for users until the switch is turned on.