Understanding roles and permissions

In Illizeo, what a person sees and can do depends on their roles. This article explains how a role is built, how Illizeo combines the roles held by one person, and what someone without the permission sees. It is intended for administrators who set up permissions for the organisation.

Before you start #

• Roles are managed in Settings › Manage Employees › Employee Roles. The page is titled Roles and permissions.
• To open this page, you need two permissions from the role matrix, at Access level at least: “Settings — Access” (Platform administration section) and “View role cards” (Roles & permissions section). By default, only the Administrator role holds both.
• A banner at the top of the page reminds you: “Check and test your roles before opening Illizeo to your employees”. Review each role’s permissions, target population and members, then test the access of a few typical profiles.

One role, three settings #

A role answers three questions, each set in a specific place on the page.

A role is therefore a set of permissions, exercised on a population, by the people who hold it. The Manager role provided is the typical example: its permissions let it set objectives, for instance; its target population is “My N-1 (Manager)”; and anyone named as manager in an employee’s profile holds it automatically.

How Illizeo decides #

• Roles add up, role by role. A person can hold several roles. An action on an employee is allowed when one and the same role grants the required level and includes that employee in its target population. A role’s permission is never exercised on another role’s population: a role with a global population does not widen the permissions of your other roles.
• On oneself. Acting on one’s own data does not go through the target population: one role granting the permission is enough. A role can, however, exclude its holder with the “Exclude the employee themselves” setting. Another role granting the same permission without excluding its holder is then enough.
• When no employee is targeted. For an action aimed at nobody in particular, such as opening a module or a settings page, the level held is enough.
• Employees who have left. An inactive employee no longer holds any permission, administrators included. Only the Former employee role keeps, during post-departure access, the right to view one’s own documents.
• Paused roles. A deactivated role, or a temporary role outside its dates, no longer gives its members anything.

Levels #

The matrix has two kinds of rows:

• Features use a four-step scale: None, Access (view), Execute (act: create, edit, launch) and Admin (the most sensitive actions of the feature, where it has any). Each level includes the previous ones: Execute includes Access.
• Employee profile fields use five independent boxes: Read, Edit, Add, Delete and History. Ticking any box also ticks Read.

Roles provided #

Each organisation receives ready-to-use roles, marked with the ILLIZEO badge. They cannot be renamed or deleted, but their permissions and populations can be changed like those of your own roles, and they can be duplicated.

The permissions provided are a starting point. Each module’s own permissions, and how they are spread across these roles by default, are described in the “Administering the module” article of each module, for example Administering the Absence management module or Administering the Performance module.

What a person without the permission sees #

• Without the permission, the entry does not exist for them: the menu, tab, tile, button or shortcut is not displayed, rather than appearing greyed out.
• With Access level only, a feature can be viewed but not acted on: action buttons are not displayed.
• If they type the address of a page that is not open to them, they land on the Access denied page.
• Permissions of a module that is not installed do not appear in the matrix. Settings already made are kept and come back if the module is reinstalled.

Checking a person’s permissions #

The Effective permissions per employee block gives the combined view of all of a person’s roles. It is displayed below the role sheet when the Authorized population or History tab is open.

1. Click Select an employee… and choose the person.
2. Illizeo shows their roles, then each permission with its Effective level (the highest among their roles) and its Source (the role that grants it).

This level does not tell you on whom it applies: check the target population of the source role. The same view exists in the Roles tab of each employee’s profile.

Who can manage roles #

Role management has its own section in the matrix, Roles & permissions. By default, the Administrator role holds all of these permissions at Admin level; HR Manager, Payroll Manager and Auditor have Access level on the viewing permissions (roles, scope, exclusions, members and matrix).

Changes require the Execute level. Any change to a population criterion, on either tab, also requires “Configure dynamic members (criteria pools)” at Execute level.

Good to know #

• There is always an administrator. Illizeo refuses any change that would remove Admin level on “Edit permissions” or “Add an individual member” from the last active role holding it, or from the last active named member of such a role.
• No self-promotion. Changing the matrix of a role you hold yourself, or of an administration role, requires Admin level on “Edit permissions”. Adding yourself to a role, or adding someone to an administration role, requires Admin level on “Add an individual member”.
• Separation of duties and access reviews are described in Governance & security. Mandatory two-factor authentication per role is set in Settings › Manage Employees › Security (see Security & compliance).
• A role can also designate the approvers of a workflow: see Flows & approvals.

FAQ #

An employee has two roles: which one wins? #

Neither overrides the other. Each role applies to its own target population, and the employee can do anything one of their roles allows, on the people that role covers.

An HR manager cannot see the Employee Roles page. #

By default, the HR Manager role does not have “Settings — Access”. They can view a person’s roles in the Roles tab of their profile. Grant “Settings — Access” if your HR team needs to open the page.