Roles and permissions — who can access what in the web dashboard

The Settings → Roles and permissions section defines what each employee can do in the web dashboard: which sections they can open, which actions they can perform and which data they can see — rates, payroll, personal details, health records. Most permissions can be limited to locations: for example, a manager sees the schedule and timesheet of their own locations only, while an accountant sees payroll for the whole chain.

How permissions work

• A permission is a single capability: opening a section, performing an action or seeing certain data. Permissions are grouped by section: “Analytics and audits”, “HACCP”, “Shift schedule”, “Rates and payroll” and so on. The full list is at the end of this article.
• A role is a set of permissions ticked with checkboxes, for example “Accountant” or “HR”. Roles are assigned to employees, and the permissions from all of an employee's roles add up.
• Personal permissions — on top of roles, you can grant a specific employee an individual permission or deny it.
• A company administrator can do everything at all locations. Roles and personal permissions are not configured for them — to restrict an administrator, turn off Company administrator for them (see “Sign-in and administration”).

An employee without permissions sees only their own tasks, tests and schedule. Some rights work without roles because of a person's position: a department head sees their department, the author and assignee see their task, and access to instruction folders is set in the instructions themselves.

The Roles and permissions section is available to the administrator and to employees with the “Assigning roles and permissions to employees” or “Access log” permission. It has three tabs: Roles, Employees and Log.

Where a permission applies: locations

For a permission marked with locations you can choose where it applies:

• All locations — across the whole chain;
• Own locations — where the employee works or manages, plus the location of their shift today;
• Locations they manage — locations and regions where the employee is assigned as manager (in “Locations and regions”);
• Selected locations — a specific list of locations.

If the same permission comes from several roles with different locations, they are combined. Permissions without a location mark apply to the whole company — they can only be given or not given.

System roles “All employees” and “Location manager”

Every company has two roles that can be edited but not deleted:

• All employees — every employee has it. By default: “Analytics”, “Audit log and reports”, “Audit export (Excel, PDF)”, “Audit planner”, “All location tasks”, “HACCP: logs and deviations”, “Filling in HACCP logs”, “Routines: progress” and “Routine execution” — on own locations.
• Location manager — location and region managers have it. By default: “Shift schedule: view”, “Building the schedule”, “Publishing the schedule”, “Clock-in and clock-out”, “Timesheet”, “Employee KPI”, “Employee requests”, “Location settings”, “Handling deviations”, “Confirming task completion”, “Task report” and “Routine control” — on the locations they manage.

These defaults repeat what employees and managers could do before roles appeared. If, for example, regular employees don't need analytics, untick it in the “All employees” role.

Ready-made roles: Accountant, HR, HACCP technologist, Shift supervisor, Auditor

When the section is opened for the first time, the company gets preset roles. You can rename, change or delete them:

• Accountant — schedule and timesheet, rates, payroll with approval and payment, payroll export and payslips, employee list.
• HR — employees with contacts, adding and editing, employee sign-in, positions, HR card, personal details and documents, hiring, transfer and dismissal, vacations and sick leave, hiring and dismissal templates, employee requests.
• HACCP technologist — all HACCP permissions: logs, deviations (including critical ones), health records, registries, plan and settings.
• Shift supervisor — routines: progress, execution and control (accept, return, cancel a run), all location tasks and confirming their completion. If roles appeared in your company before routines, this preset is missing — create a role with these permissions yourself.
• Auditor — analytics and auditor ranking, audit log and export, checklists, planner, all location tasks, confirming their completion and the task report.

How to create a role and assign it

1. Open the section. Go to Settings → Roles and permissions, tab Roles.
2. Create a role. Click New role, enter a name and briefly describe who it is for. To start from an existing role, open it and click Copy.
3. Tick the permissions. Tick the permissions you need. For a permission marked with locations, choose where it applies. Permissions that the selected one depends on are added automatically, and when you untick a permission, the ones depending on it are removed too. Use Find a permission… to search by name. The ⓘ icon next to a permission opens a tip: what the permission gives, which menu items it opens, whether it can be limited to locations, which permissions it needs and who has it by default.
4. Save. Click Create role (for an existing role — Save).
5. Assign it to employees. In the Who has the role block, click Assign to employees and choose people. Permissions are updated immediately. A new employee can get a role right when hired: Staff → Employees → Hire, step Access, block Roles. Only roles you can assign are shown there.

To delete a role, click Delete — it is removed from all employees, and their permissions are reduced immediately.

An employee's personal permissions: grant or deny

On the Employees tab, select a person — their roles and permissions appear on the right. The same settings are on the Access tab of the employee card.

• Tick or untick the employee's roles.
• On the Personal permissions tab, for each permission choose: By roles — as in the employee's roles; Grant — add it personally, with a choice of locations; Deny — remove it even if a role grants it.
• Click Save.

A denial overrides any role: for example, you can give an employee the “HR” role but close “Personal details” to them.

Sign-in and administration

At the top of an employee's settings — on the Employees tab and on the Access tab of the employee card — there is a Sign-in and administration block with two switches:

• Company administrator — the employee can do everything at all locations. Only an administrator can switch it; you can't remove the mark from yourself, and the company creator is always an administrator. jeCheck asks for confirmation when you turn it on or off: Make an administrator? or Remove from administrators?
• Web dashboard access — whether the employee can sign in to the website; without access they work only in the mobile app. It can be changed by an administrator or by someone with the “Employee sign-in” permission at the employee's locations. Web dashboard access can't be closed for administrators and the company creator. More in Web dashboard access and “App only” mode.

Switch changes are saved immediately. Below, the block shows, where applicable: Manages locations: …, Manages regions: … and Can work at all locations — scheduling and audits at any location; sees data of the location where they have a shift. This is for reference only — to change it, follow the Change in “Locations and regions” link.

An employee with the “Employee sign-in” permission but without permissions for roles and the log sees the Access tab of the card with only this block.

Effective permissions and history

The Effective permissions block shows what the employee can actually do, at which locations, and where each permission comes from — which role or personally. If there are unsaved changes, the result is recalculated after saving. The History tab lists all changes to this employee's permissions: who changed what and when; it is visible to employees with the “Access log” permission.

Who can hand out permissions

• The administrator configures everything and appoints administrators. Only an administrator can make an employee an administrator or remove that mark.
• An employee with the “Assigning roles and permissions to employees” permission assigns roles and personal permissions, but can grant or deny only the permissions they have themselves, and only at their own locations. They cannot change administrators or themselves.
• To create and edit roles, the “Editing roles” permission is also needed — within the same limits.

Access log

The Log tab (the “Access log” permission) shows:

• changes to permissions and roles: permission granted, denied or removed, locations changed, role assigned or removed, role created, changed or deleted;
• making and removing administrators, opening and closing web dashboard access, issuing a temporary password (Temporary password issued);
• appointing and removing location and region managers, turning “Can work at all locations” on and off — the entries Appointed location manager, Removed as location manager, Appointed region manager, Removed as region manager, Can work at all locations, No longer works at all locations;
• views of sensitive data: the employee card and personal details, rates and payroll, documents, health records, proctoring recordings, mystery shopper payouts, AI dispatcher conversation texts;
• exports (Excel, PDF, payslips);
• denials — attempts to open something without permission.

Filters: employee, event type (Permission changes, Views, Exports, Denials), permission and dates. Records are kept for 12 months. Repeated views of the same data within a few minutes are merged into one record.

What happened to the former marks

The “schedule manager”, “payroll access”, “HACCP manager” and “test editor” marks are no longer set in the employee window or in section settings. Those who had them received the corresponding personal permissions at all locations — in the log these entries are “Previous permissions migrated”. From now on these permissions are configured only in Roles and permissions.

Permissions in the AI assistant and the mobile app

The AI assistant in the web dashboard works within the employee's permissions: it shows and changes only what the employee could do themselves.

Roles and permissions are configured in the web dashboard and also apply in the mobile app: an employee sees only what they are allowed to see.

• Checklists. The list and today's plan show only the checklists the employee can use (see Who can use the checklist). No separate permission is needed to run an audit.
• Audit history. An employee always sees their own audits. Other people's audits require Audit log and reports on the location, and the PDF link requires Audit export (Excel, PDF).
• Analytics. Audit dynamics and common errors require Analytics on the location.
• Tasks. An employee sees tasks they are involved in; All location tasks adds all tasks of a location.
• Reviews and customer requests. They require Location reviews and Customer requests.
• Documents. Uploading files and creating folders requires Managing the instruction library.
• Colleagues' email. In people lists it is shown with Employee phone and email.
• Always available. My schedule, clock-ins, own requests and assigned tests.

To leave an employee only their schedule and the right checklists, remove the unneeded permissions from the All employees role and restrict the checklists with Who can use the checklist. The data closes right away. Menu items disappear after the app update; until then such a screen may open empty.

All permissions by section

“By location” — the permission can be limited to locations. “Views logged” — every view of this data is recorded in the access log.

Home and AI Control

Analytics and audits

Checklists and planner

Routines

Tasks, projects and automation

Instructions and testing

Mystery shopper

HACCP

Employees and HR

Shift schedule

Rates and payroll

AI dispatcher

Company

Access rights

Frequently asked questions