TracefyHR has just two main roles — Manager and HR — but four fine-grained permissions on top. That's enough flexibility for most companies without the complexity of a full role-based access system.

The four permissions

Permission	What it unlocks	Who has it by default
`canAccessFinance`	Payroll finalize, Budget Planner, Analytics	Manager only
`canAccessForge`	Forge AI build / deploy / manage screens	Manager only
Leave Approver	Approve/reject leave requests	Assigned per user
Expense Approver	Approve/reject expenses	Manager only (immutable)

Managers always have all permissions — they can't be revoked. Permission toggles only affect HR users.

Grant or revoke a permission

Permissions in TracefyHR live on the employee record itself, not in a global Settings tab. This means access is tied to a person — promoting someone, archiving them, or transferring them automatically updates what they can do.

Open People → Employees in the sidebar.
Click the employee you want to grant or revoke a permission for.
Scroll to the Login Access section on their profile. You'll see:
4
- Login role — None / HR / Manager
- Can access Finance — toggle
- Can access Forge — toggle
- Is leave approver — toggle (also settable by Super Admin)
Flip the toggle or change the role. Changes save instantly. The user gets a notification email summarising what changed.

Promoting an employee to HR or Manager doesn't email them a new password — they keep their existing employee credentials and gain new access on next login. If they had no login at all (just an employee record), TracefyHR sends an onboarding email with a temp password.

Leave Approvers

Leave Approver is special — it's assigned by your Super Admin in the platform admin panel, not in your Settings. Reach out to whoever set up your company's TracefyHR account.

Once assigned, the Leave Approver:

Sees the Pending leave requests count in their notification bell
Can approve / reject from the Leave page
Receives email notifications when new requests come in

Anyone can be a Leave Approver — Manager, HR, or even another employee (for departmental approval flows).

Common patterns

"I want HR to handle finance day-to-day, I'll only finalise"

Grant canAccessFinance to your HR user
They can edit payroll and approve expenses
They still can't finalize payroll — that's the Manager-only checkpoint

Wait — finalising is the manager's specifically. Actually, with canAccessFinance, HR can see and edit finance, but the Finalize button is gated separately. To let HR finalize, grant canAccessFinance and delegate the action explicitly per-month from the Payroll page (top right, Allow HR to finalise this month).

"I want to give specific people approval power but no other access"

Make them a Leave Approver via Super Admin. They get the approval inbox without seeing payroll or finance.

"I built something with Forge AI and only HR should use it"

Forge feature deployment includes per-feature visibility settings — when you deploy, pick Visible to HR only in the deploy dialog.

Common questions

An HR user says they can't see Analytics — why? They don't have canAccessFinance. Open their employee profile → Login Access → toggle it on.

Can I create custom roles? Not currently — the permission set is fixed. If you have a complex permission need, build it as a Forge AI feature with explicit field-level visibility instead.

How do I see who has which permissions? Go to the Employees page — the directory shows each person's login role and access pills. Filter by role to see all Managers / HR users at once.

Permission change didn't take effect — what's wrong? The user needs to refresh their browser (or sign out and back in). TracefyHR caches permissions for 5 minutes for performance.