All applications583

Find your application

583 applications

Open full catalog

Browse applications by category or open the full catalog.

Core HR
Start now
More

Features

Industries

Reference

More

  1. Core HR
  2. Roles and permissions
Reference

Who can do what in Core HR

Core HR separates everyday self-service, team coordination and HR decisions. Access follows the current person, employer and permitted purpose. Being listed as a manager, owning a task or administering the installation does not grant unrestricted access to employee information.

How permissions work

Every surface follows the permission

Screens, reports, exports, notifications, snapshots and private file retrieval apply the same current restrictions.

Access follows current responsibility

Historical records do not restore a former manager’s access. Reassignment, separation and expired grants change current permissions even while an external account task remains unresolved.

Tasks have narrow scope

IT and Facilities participants receive access to their assigned checklist work without becoming broad HR readers.

Who can do what

Permissions by role
RoleEmployee recordsOrganization & positionsEmployee changesLeave managementOnboarding & offboardingDocuments & policiesHR reporting
AdminApproveApproveEdit—EditEdit—
HR ManagerApproveEditEditApproveEditEditApprove
ManagerApproveView—Approve—Edit—
HR SpecialistEditEditEdit—EditEdit—
EmployeeEditEdit—Edit——View

Each role in detail

Admin

Configures identity, integration and technical settings; administrative access does not automatically expose employee PII or confer HR domain approval.

Can

  • Manage Users identity mappings and technical access grants through independently reviewed configuration
  • Prepare technical HR changes and integration/template deployment
  • Configure integration events mappings and private file delivery
  • Read safe operational configuration and redacted diagnostics
  • Temporary technical support access to a subject/class requires independent HR Manager domain authorization, finite expiry, purpose and logged retrieval
  • No default national ID, DOB, personal/dependent/contact/medical/tax content access
  • No hire, termination, leave, policy, retention or readiness approval without separately granted HR Manager authority and actual-person independence
  • No direct accepted-history, leave-ledger or provider-outcome edits

Reviews and approves

  • Approve technical activation independently of requester/material editors when configured cross-entity/country or bulk-import changes require it

HR Manager

The HR Manager/HRBP domain role owns employee lifecycle, organization, policy and protected HR work within explicit employer/department grants.

Can

  • Prepare HR changes for Employees, employment spells, Positions, position assignments, departments, titles, entities, schedules, leave policies and other HR masters
  • Apply only approved current revisions at evidenced effective boundaries
  • Prepare and authorize class-scoped access grants under separation rules
  • Access full identity/personal/contact/dependent/document data only with current subject/entity/class/purpose grant
  • Prepare/review employee documents, document assignments and policy assignments in granted scope
  • Coordinate/check onboarding checklists and actual task outcomes
  • Generate restricted org chart snapshots and all seven reports under scope/small-group protections
  • No payroll, ATS, benefit enrollment or legal-compliance certification authority implied

Reviews and approves

  • Approve hire/lifecycle/master/policy/readiness/closure/retention/migration decisions independently of preparer/material editors and subject conflicts
  • Review escalated leave requests, unused cancellations and leave entries corrections independently of the employee/request preparer

Can't

  • Use a second role or delegation to sign own material change

Starts on: Pending Hire Approvals

Manager

An explicitly granted Manager role operates within the current cycle-safe direct/indirect reporting tree; a Manager pointer alone is not authorization.

Can

  • Read team directory fields full name, work email, work phone, Position, Department, Location, current Manager, hire date and employment status
  • Read only operational lifecycle summaries and absence dates/day fractions/status relevant to team work
  • Confirm factual elapsed team leave days under approved policy without editing balance buckets
  • Request promotion/transfer/manager changes through HR changes, never apply them
  • Complete assigned checklist tasks and see team checklist readiness
  • Receive approved neutral document requirement/expiry status only when manager visible is true
  • No national ID, DOB, gender, home/personal contact, emergency/dependent details, sensitive leave reason, medical documentation, tax/identity files or unrestricted file links
  • Current reassignment, separation or grant expiry removes team access and reroutes pending decisions
  • Historical reporting never restores old-manager access

Reviews and approves

  • Approve ordinary leave requests and confirm policy-qualified unused cancellations only when assigned approver user is self, policy allows Manager and actual subject/preparer differs

Starts on: Pending Leave Approvals

HR Specialist

Prepares delegated employee work and coordinates documents, tasks and acknowledgments without applying protected lifecycle decisions.

Can

  • Prepare hire/profile proposals under explicit delegated preparation access grants
  • Maintain permitted preferred name, personal email, home address and work phone only with employee request/evidence and protected edit history
  • Prepare legal-name, national ID, DOB, employer, manager, position or status changes for HR Manager review, not direct edits
  • Coordinate onboarding checklists and assigned checklist tasks
  • Record factual actual commencement under current delegated preparation scope, without applying employment state or substituting for HR Manager readiness
  • Upload employee documents and verify assigned document classes only with current sensitive access scope and requirement-defined review independence
  • Maintain emergency contacts and Dependents only for authorized subject/purpose with recorded request
  • Read safe Positions, Departments, Locations, company policies and scoped operational employee views
  • Follow policy assignments/document assignments and neutral reminders
  • Any such history is the guarded consequence of the HR-authorized action, never delegated CRUD

Can't

  • Open/retire positions, approve lifecycle/leave corrections or write employment history/position history/leave entries directly

Starts on: Recent Hires (last 30 days)

Employee

Uses the authenticated self-service identity and narrowly assigned tasks; peer directory visibility contains only names, titles and manager relationships. Manager tree access is calculated at request time from applied effective assignments and valid grants. It is cycle-safe, restricted by employer and allowed scope, and does not bypass document/field classification on joins, notifications, exports, snapshots or private-object retrieval. Services have named action scopes and cannot supply a human decision. A grant can reduce/temporarily delegate allowed preparation but cannot invent a role or bypass actual-person conflict checks.

Can

  • Read own permitted profile, leave balances, leave requests and own employee visible documents
  • Edit preferred name, personal email, home address and work phone through auditable permitted self-service actions
  • Prepare own draft leave requests, submit, request bounded cancellation and confirm own elapsed daily absence under approved policy without editing approval or ledger fields
  • Maintain own emergency contacts and Dependents except external benefits is covered authority
  • Acknowledge own exact policy assignments version/content as actual subject
  • Complete assigned checklist tasks and provide permitted evidence
  • View peer-safe org summaries only
  • No access to peer PII or general employee records from a task assignment
  • Submitted/accepted history, balances, manager/position/employment/legal-identity fields remain guarded

Starts on: Pending Policy Acknowledgments

Set up Core HR your way.

Start free, then use Proto to change fields, steps and approvals before your team goes live.

Start now Download Proto

How to get started

A personal agent for your business

Get started with Proto

Your app is selected. Download Proto, then open it with this context.

Selected appCore HR

Choose your computer’s platform.

Download Proto

Install Proto, then return to this panel.

Already installed? Open Proto

Free to use. Your own model provider may charge for usage.