User rights reference: what each right does
Use this to look up what a single right does before you give it to a role: All Employees, IDs and Banking, Bulk Profile Data, Auto-approve, Require 2FA, Super Admin and the rest. It covers the My Team rights page and the company User Rights page. How roles and access work, and how to change a role, are in User rights and access control.
Where:
- My Team rights: My Team › Settings › Approvals & Access › User Rights
- Company rights: More › Settings › People › User Rights
You need: the My Team User Rights right for the My Team page, or the User Rights right for the company page. Read lets you look, write lets you change.
How to change a right for a role
- Open the rights page and find the right. Roles are columns.
- Select the icon where the right and the role meet.
- Choose Write access, Read Only or No access. Some rights offer only two of these. It saves straight away for everyone with that role.
A right marked "Always on for the Admin role and cannot be changed" is locked. A default system role cannot be renamed or deleted.
My Team page
Access Rights
| Right | What it does |
|---|---|
| All Employees | See every employee, whatever their Access Rights filters say. Read or none |
Profile Data Rights: what someone sees and edits on the profiles they can reach.
| Right | What it covers |
|---|---|
| Personal | Contact information, dependants and education history |
| IDs and Banking | Government IDs and bank details used for payroll |
| Employment | Department, position and other job details |
| Display mobile number | Whether employees' mobile numbers are shown. Set to no access to hide them |
| Team org | Manager, approvers and direct reports |
| Attendance | Leave policies, check-in records and shift schedules |
| Standard Schedule | The employee's standard work schedule. Needs Attendance |
| Payroll | Wages, tax exemptions and salary details |
| Future Profile Changes | View, schedule, edit and cancel changes to position, department, branch, manager and basic wage that apply on a future date. Scheduling also needs edit rights on that field's section |
| Team Profile Audit | The log of changes to other employees' profiles. Read or none |
| My Profile Audit | Whether people see the log of changes to their own profile. Read or none |
| Access | Which modules and role the employee has |
| All Role Access | With edit on Access: give any role. Without it: only Employee or Manager |
Bulk Data
| Right | What it does |
|---|---|
| Bulk Profile Data | Import and export the profile data they have rights over |
| Profile Manager | View and edit profile fields in bulk, and approve any profile change request for another approver |
| My Team Reports | Demographics, turnover, audit and contract reports. Read or none |
| Anomaly Review | Run anomaly scans and review findings on profile audit trails |
| Audit Sensitive Fields | Choose which fields the Profile Data Audit report treats as sensitive. Needs My Team Reports |
| Missing Data Reminders | Switch on Missing Data reminder emails and send one-off reminders. Needs My Team Reports |
| Key Dates Reminders | Remind line managers about upcoming key dates. Needs My Team Reports |
| Branches | Bulk import and export of branch data |
| Employment History | Bulk import and export of employment history records |
Actions
| Right | What it does |
|---|---|
| Manager & Approver | Lets people be a manager or approver. Turning it off removes them from employees' team org |
| Add Employee | Add employees and see every new employee request in Team Approvals |
| New Employee Approver | Decide any new employee request, even one waiting on someone else. Off by default except for Admin and KAMI Support |
| Delete Employee | Permanently remove a profile. Cannot be undone |
| Terminate Employee | Deactivate a profile |
| Termination Pay | Add or view the termination date on a profile |
| Workflow Automation | Read sees workflows, write creates and changes them |
Documents
| Right | What it does |
|---|---|
| Add Document | Upload documents, and approve any document request for the assigned approver |
| Delete Document | Everyone can delete their own. With edit, delete other people's |
| Auto-approve | Documents this role uploads or edits are approved with no review |
| Document Templates | View and add document templates |
| Document Access (Public) | The profile Documents tab, for public documents |
| Private, Confidential, Restricted | Documents at those levels. Restricted includes system-generated payroll reports |
Company Policies
| Right | What it does |
|---|---|
| Policy Library | Read opens the library, issuances and compliance reporting. Write creates, edits, publishes, archives and deletes policies |
| Issue Policies | Issue policies, send reminders and waive acknowledgements. Employees need no right to acknowledge |
Settings
| Right | What it does |
|---|---|
| My Team User Rights | Open and change this page. Always on for Admin |
| User Rights | View or manage other roles' rights. Always on for Admin |
| Team Organization | Subsidiaries, branches, departments, positions, groups, approval matrices and Bulk Assignments |
| Cost Centers | Cost centres |
| Onboarding Wizard | The onboarding checklist for new hires |
| Discipline Types | Disciplinary templates |
| Announcements | Company-wide announcements |
| Company Notifications | Company notification defaults |
Security
| Right | What it does |
|---|---|
| Require 2FA | People with this role must set up two-factor authentication |
| Reset 2FA | Reset another person's 2FA |
| Force Short Token Lifetime | Logs people out after a short session when they tick "I'm on a Public Computer" at login |
Company User Rights page
| Right | What it does |
|---|---|
| Activate KAMI Module | Turn on access to more KAMI modules |
| Company Details | Company details, help contacts and number precision |
| Custom Fields | Create profile fields |
| Separation Types | How employees leave, used by the Turnover report |
| Support | KAMI live support |
| Support Portal | Raise and read KAMI support tickets |
| Report Scheduler | Scheduled automated reports |
| Workflow Automation | The same right as on the My Team page |
| Require 2FA | Two-factor authentication on top of the password |
| Super Admin | Admin-only areas |
| Biometric Tablet Admin | Configure biometric tablet settings |
| Device Monitoring | View which devices are reporting. Edit renames devices and sets offline thresholds |
| Webhooks | Webhook integrations with other systems |
| Utilization & Limits | View the AI token pool and set per-person limits |
Tips
- Give the widest rights last: All Employees, IDs and Banking, Payroll, Delete Employee and Super Admin.
- Pair rights that depend on each other. Standard Schedule needs Attendance, and the reminder rights need My Team Reports.
- Prefer Terminate Employee to Delete Employee. Deleting loses the history.