HR Role Permissions: How Role-Based Access Works in HR Software
Table of Contents
An HR role permission system decides who can see and change what inside your HR software. Instead of setting access person by person, you give each person a role (owner, HR manager, department head, employee) and the role carries a set of permissions. Change someone's role and their access changes with it.
This guide covers how role-based access works, the roles most small teams need, what each should and shouldn't see, how approvals and activity logs fit in, and how to set it up. It also shows how roles work in Payrun, our own product.
What is role-based access control?
Role-based access control (RBAC) is a way of granting access by role rather than by individual. The US National Institute of Standards and Technology defines it as "a model for controlling access to resources where permitted actions on resources are identified with roles" (NIST).
Two principles sit behind it:
- Least privilege: restrict each user's access "to the minimum necessary to accomplish assigned tasks" (NIST).
- Separation of duties: no single person controls a sensitive process end to end. For example, the person who prepares payroll shouldn't be the one who approves it.
Why HR data needs role permissions
HR software holds some of the most sensitive data a company has: home addresses, ID documents, salaries, bank details, medical notes and performance records. Data protection law expects it to be kept secure. UK law, for example, requires personal data to be "handled in a way that ensures appropriate security" (GOV.UK). Roles are the simplest way to make sure a line manager can approve leave without also seeing everyone's salary.
Common HR roles and what they should see
Role | Typically sees | Typically can't see or do |
|---|---|---|
Owner | Everything, including billing and settings | — |
Admin | Company-wide employee records, settings, approvals | Billing, if reserved for the owner |
HR manager | Employee records, documents, leave, attendance | Payroll approval, unless also given that permission |
Finance manager | Salaries, payroll preparation, expenses | Approving a payroll they prepared |
Department head | Their own team (and sub-teams): leave, attendance, profiles | Other departments, company-wide pay |
Hiring manager / hiring team | Job posts, candidates, interview feedback | Current employees' pay and records |
Employee | Their own profile, payslips, leave and history | Anyone else's data |
These are starting points. Adjust them to how your company actually works, and review them when people change jobs.
Approvals: separating who prepares and who approves
Approvals are where permissions matter most. Payroll is the clearest case: if the same person can prepare and approve a pay run, a mistake or a deliberate change can go straight through. A two-step rule fixes this. One person prepares, a different, more senior person approves.
Apply the same idea to anything that moves money or changes access: expense claims, salary changes and role changes.
Activity logs: seeing who changed what
Permissions decide what people *can* do. An activity log records what they *did*: who invited a new user, who changed someone's role, who edited a record and when. Logs help you spot mistakes, answer audit questions, and check that permissions are working as intended.
How to set up role permissions for a small team
- List the jobs, not the people. Owner, HR, finance, managers, hiring, employees.
- Start from least privilege. Give each role only what it needs, then add access when someone asks for a real reason.
- Separate prepare and approve for payroll and other money-related steps.
- Limit owner and admin roles to the people who really need them.
- Use department scope so managers see only their own teams.
- Remove access on day one when someone leaves.
- Review roles regularly, for example every quarter and whenever someone changes job.
- Check the activity log after big changes such as a re-organization or a new admin.
Mistakes to avoid
- Giving everyone admin "to save time".
- Sharing one login between several people, which makes the activity log meaningless.
- Leaving former employees' accounts active.
- Letting the person who prepares payroll also approve it.
- Never reviewing roles after promotions or team changes.
How roles and permissions work in Payrun
Roles and permissions are included on every Payrun plan, including Free and Starter.
- Built-in roles: Owner, Admin, Department head, Employee, Hiring manager, HR manager, Hiring team and Finance manager. You can't create new roles, but you can switch individual permissions on or off for each built-in role, compare all roles side by side, and reset a role to its defaults (help center).
- More than one role per user: for example, a finance manager who is also an employee.
- Department scope: a department head can access their department and the departments under it.
- Employees see their own data only.
- Payroll approval: the person who created a payroll can't approve it. Final approval comes from an Owner or Admin.
- Activity log: a central page shows user activity, such as who invited whom and who changed whose role.
- Leavers: deactivating a user permanently disables their login.
- AI assistants: Payrun's MCP connection for Claude, ChatGPT and other assistants (Pro and Ultimate plans) is read-only and follows the user's existing permissions. An assistant can't create, approve or change anything (help center).
Written by the Payrun Team. Product details confirmed with the Payrun product team and help center on 4 November 2026. This is general information, not security or legal advice.
