Setting permissions in the matrix

The permission matrix states what each role can do, module by module: one row per permission, one column per role. This article explains how to read it, how to grant or remove a permission, and how to stop a role from acting on its own holder’s file. It is intended for the organisation’s administrators.

Before you start #

• The matrix is in Settings › Manage Employees › Employee Roles.
• Viewing it requires “View the permissions matrix” (Access level); changing it requires “Edit permissions (V/H/E/I/D checkboxes)” at Execute level. Without the latter, the matrix is read-only: clicking a cell changes nothing. The search field requires “Search / Filter within the matrix”.
• For how roles work in general, see Understanding roles and permissions.

Displaying the matrix #

The matrix is displayed below the selected role’s sheet when the Authorized population or History tab is open. It is hidden on the Target population and Reminders tabs. So click a role card, then the Authorized population tab.

Above the matrix you will find the Effective permissions per employee block, then a summary of the selected role (number of permissions per level) and the Displayed roles button.

Reading the matrix #

• The title shows the number of permissions and roles displayed, with the Editable label.
• Sections by module: the row of buttons All, Absences, Performance, Roles & permissions, Employee fields… filters the matrix on one module or area; each button shows its number of permissions. Modules that are not installed are not listed.
• Filter…: type part of a permission’s name to keep only the rows that contain it.
• The legend recalls both scales: “Fields: View · Edit · Insert · Delete · History” and “Features: Access · Execute · Admin”.
• Sections group the permissions of a module. Click a section title to collapse or expand it. On its row, each column shows the highest level granted to the role in that section.
• Columns: one per active role, with the number of permissions granted. Clicking a column header selects that role on the page.

The Displayed roles button chooses the visible columns: tick or untick each role, or use All or Presets (the roles provided by Illizeo). This choice only affects the display.

Granting or removing a feature #

Feature rows show one level per role: None, Access, Execute or Admin. Each level includes the previous ones.

1. Find the cell where the permission and the role meet.
2. Click it to move to the next level (None, then Access, Execute, Admin, then None again). Shift+click goes back to the previous level.
3. To move to Admin, confirm in the Grant Admin? window with Grant Admin. Cancel leaves the cell unchanged.

Each click is saved straight away: the message “Permission updated” or “Permission removed” confirms it. If saving fails, the cell returns to its value and the message “Failed to save permission. Reverted.” is displayed. With the keyboard, the arrow keys move from cell to cell, and Enter or Space acts as a click.

Setting profile fields #

Field rows, such as those in the Employee fields section, cover the sections of employee profiles. Each cell shows small independent boxes, each marked with an initial; hover over a box to see its name: Read, Edit, Add (“Insert” in the legend), Delete and History. The initials are those of the French names (L, M, A, S, H).

• Each box is set on its own: for instance, you can grant Read and Add without Edit, so that an employee can file a new entry without rewriting the others.
• Ticking any box also ticks Read; unticking Read unticks every box in the cell.
• Add and Delete only exist for sections with multiple entries, and History only for dated sections.

Sections and their fields are defined in Settings › Manage Employees › Manage employee fields.

Excluding the employee themselves, permission by permission #

The “Exclude the employee themselves” setting on the Target population tab applies to all of the role’s permissions (see Defining a role’s target population). The matrix lets you refine it for a single permission: for example, letting a payroll manager view their own salary without being able to change it.

1. First grant a level to the cell: on a cell set to None, Illizeo replies “Grant a level first — there is nothing to restrict yet.”
2. Alt+click the cell (Option+click on a Mac). Each Alt+click moves to the next state, announced by a message: “On self: read only”, “On self: no access”, “On self: open, even if the role excludes”, then “On self: inherits the role”.

A small mark next to the level reminds you of the setting: a dot for read only, the empty-set sign for no access, a tick for access left open even if the role excludes its holder. A cell without a mark follows the role’s setting. This setting only applies to feature rows.

Each module’s permissions #

Each module has its own section in the matrix. The meaning of each permission, and the roles that hold it by default, are described in the module’s administration article, for example:

• Administering the Absence management module;
• Administering the Attendance module;
• Administering the Performance module;
• Administering the Training module;
• Administering the Expenses module;
• People Analytics: permissions and data confidentiality.

The Roles & permissions section itself is described in Understanding roles and permissions. To export the matrix to CSV, see Creating and managing roles.

Good to know #

• A change applies straight away to every action by the role’s members. A person already signed in sees their menus follow the change within a minute, or as soon as they return to the Illizeo tab.
• Only active roles have a column. Permissions of a module that is not installed are hidden, but their settings are kept.
• Changing the column of a role you hold yourself, or of an administration role, requires Admin level on “Edit permissions (V/H/E/I/D checkboxes)”. Without it, the cell returns to its value with the failure message.
• Illizeo refuses to remove Admin level on “Edit permissions” or “Add an individual member” from the last active role holding it.

FAQ #

I cannot see the matrix. #

Open the Authorized population or History tab of the selected role: the matrix does not appear under the Target population and Reminders tabs. If the message “You don’t have permission to view the permissions matrix.” is displayed, you are missing “View the permissions matrix”.

I cannot find a module’s permissions. #

Check that the module is installed in Applications: permissions of a module that is not installed do not appear.