# Roles and permissions — who can access what in the web dashboard

> Roles, location-based permissions, personal grants and denials, the access log — how to set up who sees and does what in the jeCheck web dashboard.

Источник: https://jecheck.io/en/docs/account/access-roles

The **Management → Roles and permissions** section defines what each employee can do in the web dashboard: which sections they can open, which actions they can perform and which data they can see — rates, payroll, personal details, health records. Most permissions can be limited to locations: for example, a manager sees the schedule and timesheet of their own locations only, while an accountant sees payroll for the whole chain.

## How permissions work

- A **permission** is a single capability: opening a section, performing an action or seeing certain data. Permissions are grouped by section: “Analytics and audits”, “HACCP”, “Shift schedule”, “Rates and payroll” and so on. The full list is at the end of this article.
- A **role** is a set of permissions ticked with checkboxes, for example “Accountant” or “HR”. Roles are assigned to employees, and the permissions from all of an employee's roles add up.
- **Personal permissions** — on top of roles, you can grant a specific employee an individual permission or deny it.
- A **company administrator** can do everything at all locations. Roles and personal permissions are not configured for them — to restrict an administrator, clear their administrator mark.

An employee without permissions sees only their own tasks, tests and schedule. Some rights work without roles because of a person's position: a department head sees their department, the author and assignee see their task, and access to instruction folders is set in the instructions themselves.

The **Roles and permissions** section is available to the administrator and to employees with the “Assigning roles and permissions to employees” or “Access log” permission. It has three tabs: **Roles**, **Employees** and **Log**.

## Where a permission applies: locations

For a permission marked with locations you can choose where it applies:

- **All locations** — across the whole chain;
- **Own locations** — where the employee works or manages, plus the location of their shift today;
- **Locations they manage** — locations and regions where the employee is assigned as manager (in “Locations and regions”);
- **Selected locations** — a specific list of locations.

If the same permission comes from several roles with different locations, they are combined. Permissions without a location mark apply to the whole company — they can only be given or not given.

> [!NOTE]
> Permissions with an eye icon cover sensitive data: personal details, payroll, rates, health records, proctoring recordings, shopper payouts. Every view of such data is recorded in the access log.

## System roles “All employees” and “Location manager”

Every company has two roles that can be edited but not deleted:

- **All employees** — every employee has it. By default: “Analytics”, “Audit log and reports”, “Audit export (Excel, PDF)”, “Audit planner”, “All location tasks”, “HACCP: logs and deviations” and “Filling in HACCP logs” — on own locations.
- **Location manager** — location and region managers have it. By default: “Shift schedule: view”, “Building the schedule”, “Publishing the schedule”, “Clock-in and clock-out”, “Timesheet”, “Employee KPI”, “Employee requests”, “Location settings”, “Handling deviations” and “Confirming task completion” — on the locations they manage.

These defaults repeat what employees and managers could do before roles appeared. If, for example, regular employees don't need analytics, untick it in the “All employees” role.

## Ready-made roles: Accountant, HR, HACCP technologist, Auditor

When the section is opened for the first time, the company gets preset roles. You can rename, change or delete them:

- **Accountant** — schedule and timesheet, rates, payroll with approval and payment, payroll export and payslips, employee list.
- **HR** — employees with contacts, adding and editing, employee sign-in, positions, HR card, personal details and documents, hiring, transfer and dismissal, vacations and sick leave, hiring and dismissal templates, employee requests.
- **HACCP technologist** — all HACCP permissions: logs, deviations (including critical ones), health records, registries, plan and settings.
- **Auditor** — analytics and auditor ranking, audit log and export, checklists, planner, all location tasks and confirming their completion.

## How to create a role and assign it

1. **Open the section.** Go to **Management → Roles and permissions**, tab **Roles**.
2. **Create a role.** Click **New role**, enter a name and briefly describe who it is for. To start from an existing role, open it and click **Copy**.
3. **Tick the permissions.** Tick the permissions you need. For a permission marked with locations, choose where it applies. Permissions that the selected one depends on are added automatically, and when you untick a permission, the ones depending on it are removed too. Use **Find a permission…** to search by name.
4. **Save.** Click **Create role** (for an existing role — **Save**).
5. **Assign it to employees.** In the **Who has the role** block, click **Assign to employees** and choose people. Permissions are updated immediately.

To delete a role, click **Delete** — it is removed from all employees, and their permissions are reduced immediately.

## An employee's personal permissions: grant or deny

On the **Employees** tab, select a person — their roles and permissions appear on the right. The same settings are on the **Access** tab of the employee card.

- Tick or untick the employee's roles.
- On the **Personal permissions** tab, for each permission choose: **By roles** — as in the employee's roles; **Grant** — add it personally, with a choice of locations; **Deny** — remove it even if a role grants it.
- Click **Save**.

A denial overrides any role: for example, you can give an employee the “HR” role but close “Personal details” to them.

## Effective permissions and history

The **Effective permissions** block shows what the employee can actually do, at which locations, and where each permission comes from — which role or personally. If there are unsaved changes, the result is recalculated after saving. The **History** tab lists all changes to this employee's permissions: who changed what and when; it is visible to employees with the “Access log” permission.

## Who can hand out permissions

- The **administrator** configures everything and appoints administrators. Only an administrator can make an employee an administrator or remove that mark.
- An employee with the “Assigning roles and permissions to employees” permission assigns roles and personal permissions, but can grant or deny only the permissions they have themselves, and only at their own locations. They cannot change administrators or themselves.
- To create and edit roles, the “Editing roles” permission is also needed — within the same limits.

## Access log

The **Log** tab (the “Access log” permission) shows:

- changes to permissions and roles: permission granted, denied or removed, locations changed, role assigned or removed, role created, changed or deleted;
- making and removing administrators, opening and closing web dashboard access;
- views of sensitive data: the employee card and personal details, rates and payroll, documents, health records, proctoring recordings, mystery shopper payouts;
- exports (Excel, PDF, payslips);
- denials — attempts to open something without permission.

Filters: employee, event type (**Permission changes**, **Views**, **Exports**, **Denials**), permission and dates. Records are kept for 12 months. Repeated views of the same data within a few minutes are merged into one record.

## What happened to the former marks

The “schedule manager”, “payroll access”, “HACCP manager” and “test editor” marks are no longer set in the employee window or in section settings. Those who had them received the corresponding personal permissions at all locations — in the log these entries are “Previous permissions migrated”. From now on these permissions are configured only in **Roles and permissions**.

## Permissions in the AI assistant and the mobile app

The AI assistant in the web dashboard works within the employee's permissions: it shows and changes only what the employee could do themselves. Roles and permissions are configured in the web dashboard; in the mobile app some screens still only check whether the employee is an administrator.

## All permissions by section

“By location” — the permission can be limited to locations. “Views logged” — every view of this data is recorded in the access log.

### Home and AI Control

| Permission | What it gives | By location | Views logged |
|---|---|:-:|:-:|
| AI Control settings and service signals | Refresh the report, mute signals, signals about photo fraud and lenient auditors, schedule an audit from a signal | — | — |
| Company-wide dashboards | Publish dashboards to the whole company and edit shared ones | — | — |

### Analytics and audits

| Permission | What it gives | By location | Views logged |
|---|---|:-:|:-:|
| Analytics | Analytics sections and dashboard metrics | yes | — |
| Auditor ranking | Auditors with strictness scores | yes | — |
| Audit log and reports | The “Audit log” section, the “Audits” screen and audit reports | yes | — |
| Audit export (Excel, PDF) | Excel and PDF of audits; without it, the online report opens instead of the PDF | yes | yes |
| Deleting audits | Delete completed audits | yes | — |

### Checklists and planner

| Permission | What it gives | By location | Views logged |
|---|---|:-:|:-:|
| Checklists in the web dashboard | List and view checklists | — | — |
| Creating and editing checklists | Builder, folders, scenarios, who can access a checklist | — | — |
| Deleting checklists | Trash and deleting checklists | — | — |
| Audit planner | The “Planner” section | yes | — |
| Audit planning | Plans, templates, rescheduling and reassignment | yes | — |

### Tasks and automation

| Permission | What it gives | By location | Views logged |
|---|---|:-:|:-:|
| All location tasks | Without this permission, only own tasks are visible (author, assignee, watcher) | yes | — |
| Confirming task completion | Confirm task completion or send tasks back for rework | yes | — |
| Deleting other people's tasks | Delete tasks created by others; authors can always delete their own tasks | yes | — |
| Automation | Violation scenarios, positions and location management | — | — |

### Instructions and testing

| Permission | What it gives | By location | Views logged |
|---|---|:-:|:-:|
| Managing the instruction library | Root folders, access to all instructions, AI and API. Permissions for individual folders are set in the instructions themselves | — | — |
| Creating and editing tests | Create and edit tests | — | — |
| Testing results | Results and assigning tests to employees | yes | — |
| Reviewing attempts and proctoring recordings | Grading open answers, voiding, strict mode photos and videos | yes | yes |
| Exporting test results | — | yes | yes |

### Mystery shopper

| Permission | What it gives | By location | Views logged |
|---|---|:-:|:-:|
| Mystery shopper questionnaires | The “Mystery shopper” section: visits and questionnaires | — | — |
| Managing visits and shoppers | Create a visit, accept, return, reject a questionnaire | — | — |
| Shopper payouts and their contacts | Payout amounts to shoppers and their contacts | — | yes |
| Ordering turnkey checks | The “Managed mystery guest” section | — | — |

### HACCP

| Permission | What it gives | By location | Views logged |
|---|---|:-:|:-:|
| HACCP: logs and deviations | HACCP sections: overview, “Today”, logs, deviations, registries | yes | — |
| Filling in HACCP logs | If the log lists positions, also by position | yes | — |
| Handling deviations | Correct, void an entry, skip a measurement, close a non-critical deviation | yes | — |
| Closing critical deviations | Close critical deviations | yes | — |
| Employee health records | Employee health records in HACCP registries | yes | yes |
| Editing HACCP directories | Equipment, suppliers, calibrations, health records | — | — |
| HACCP plan | The “HACCP plan” section | — | — |
| HACCP settings, logs and sites | HACCP settings, logs and sites | — | — |

### Employees and HR

| Permission | What it gives | By location | Views logged |
|---|---|:-:|:-:|
| Employee list | The “Employees” section — employees of the locations where the permission applies | yes | — |
| Employee phone and email | Phone and email in the list and the employee card | yes | — |
| Adding employees | Create new employees | — | — |
| Editing employees | Name, position, locations, checklist access | yes | — |
| Employee sign-in | Web dashboard access, password, invitations | yes | — |
| Deleting and restoring employees | — | yes | — |
| Exporting the employee list | Excel with the employee list | yes | yes |
| Positions directory | Directory of positions | — | — |
| HR card | Employment, history, vacations, employee onboarding | yes | yes |
| Personal details | Documents, addresses, tax ID, bank details, emergency contact | yes | yes |
| HR documents and files | The “Documents” tab in the employee card | yes | yes |
| Hiring, transfer and dismissal | Hire, transfer and dismiss employees | yes | — |
| Vacations and sick leave | The “Vacations and sick leave” section | yes | — |
| Hiring and dismissal templates | Hiring and dismissal checklist templates | — | — |

### Shift schedule

| Permission | What it gives | By location | Views logged |
|---|---|:-:|:-:|
| Shift schedule: view | The “Shift schedule” section, without editing | yes | — |
| Building the schedule | Shifts, templates, auto-fill, employees in the schedule | yes | — |
| Publishing the schedule | Publish the schedule to employees | yes | — |
| Clock-in and clock-out | The “Attendance” section | yes | — |
| Timesheet | The “Timesheet” section | yes | — |
| Employee KPI | The “KPI” section | yes | — |
| Employee requests | Vacations, days off, shift swaps | yes | — |
| Location settings | Clock-in sites, QR, shift templates, staffing needs | yes | — |
| General rules, holidays and KPI metrics | Holidays, company-wide rules, shared shift templates, KPI metrics | — | — |

### Rates and payroll

| Permission | What it gives | By location | Views logged |
|---|---|:-:|:-:|
| Employee rates | Rate, rate history, shift cost in the schedule | yes | yes |
| Changing rates | Change employee rates | yes | — |
| Payroll | The “Payroll” section | yes | yes |
| Approving and paying payroll | Approve, reopen, mark as paid, bonuses and deductions | yes | — |
| Payroll export and payslips | Payroll Excel and payslips | yes | yes |

### Company

| Permission | What it gives | By location | Views logged |
|---|---|:-:|:-:|
| Locations and regions | Create, edit, delete a location or region | — | — |
| Location staff and managers | Who works at a location and who manages it | — | — |
| Departments: all departments | A department head sees their own department even without this permission | — | — |
| Departments: editing | Create and edit departments | — | — |
| Report mailings | The “Mailing lists” section | — | — |
| Company details and settings | Name, company details, report language, logo, reminders | — | — |
| Plan, payment and invoices | Plan, billing contact, issued invoices | — | yes |

### Access rights

| Permission | What it gives | By location | Views logged |
|---|---|:-:|:-:|
| Assigning roles and permissions to employees | You can grant only the permissions you have yourself; administrators cannot be changed | — | — |
| Editing roles | Create, edit and delete roles | — | — |
| Access log | The “Log” tab in “Roles and permissions” | — | — |

## Frequently asked questions

### How do I give a manager access to payroll for their locations?

Open **Roles and permissions → Employees**, select the manager and for the “Payroll” permission click **Grant**, with the scope **Locations they manage**. The “Employee rates” permission is added automatically. If all managers need payroll access, tick these permissions in the “Location manager” role.

### Why doesn't an employee see a section even though they have the role?

Open the employee on the **Employees** tab and look at **Effective permissions**: the permission may be denied personally, or it may apply at other locations. For example, “Own locations” are only the locations where the employee works or manages, plus the location of their shift today.

### Can I deny something to an administrator?

No, an administrator can do everything. To restrict a person, clear their administrator mark and assign the roles they need.

### Who can see that I opened payroll or personal details?

Employees with the “Access log” permission and administrators — on the **Log** tab. Only views of sensitive data (permissions with an eye icon), exports and access denials are recorded.

### Where did “Test editor” and “HACCP managers” go?

These marks have been replaced by the “Creating and editing tests” permission and the “HACCP technologist” role. The former marks were automatically migrated to employees' personal permissions at all locations.