Roles and Permissions Guide
Match Line uses role-based access control (RBAC) enforced on routes and services — not navigation visibility alone.
Roles
| Role | Purpose |
|---|---|
admin |
Full organisation permissions |
hr |
People, leave, recruiting hire, hiring requests |
recruiter |
Recruiting read/write, people read |
finance |
Leave approve (stage), clients/bookings — not payroll |
manager |
Team view, leave approve (stage 1), hiring requests |
employee |
Own leave read/request |
viewer |
Read-only org, people, recruiting, leave |
super_admin |
Platform operator (all permissions) |
Default for ambiguous assignment: viewer.
Permission enforcement
Permissions defined in src/workforce_os/platform/permissions/catalog.py, mapped in roles.py.
Examples:
PEOPLE_WRITE— create/edit employees (HR, admin)RECRUITMENT_WRITE— pipeline, inbox (recruiter, HR)RECRUITMENT_HIRE— hire action (HR, admin)LEAVE_APPROVE— manager, HR, finance stagesWORKFORCE_TEAM_VIEW— manager team page
Route decorators and service checks call role_has_permission().
Role summaries
Admin
- Organisation setup, invites, all HRMS and recruiting
- Billing changes in pilot: operator-assisted
HR
- Directory, leave admin, hire, offers approve, workforce import
- Cannot access platform
/admin
Recruiter
- Inbox, pipeline, requisitions, talent search
- Read people; no
PEOPLE_WRITEunless also HR/admin
Manager
- Direct reports, leave approval stage 1, hiring requests
- No bulk import, no policy edit
Employee
LEAVE_READ— request own leave via UI that grants employee contextDOCUMENTS_SELF_READ— download own employee-visible documents at/hrms/my-documents- No access to HR-only documents or other employees' files
Finance
- Leave approval stage (labelled payroll)
- Clients/bookings read/write
PAYSLIP_READ_ALL— download payslip documents only (not all HR documents)- No payroll engine
Viewer
- Read-only across org, people, recruiting, leave
- No employee document access
Permissions matrix (simplified)
| Action | admin | hr | recruiter | manager | employee | finance | viewer |
|---|---|---|---|---|---|---|---|
| Org settings | ✓ | read | read | read | — | read | read |
| People write | ✓ | ✓ | — | — | — | — | — |
| Leave approve | ✓ | ✓ | — | ✓ | — | ✓ | — |
| Recruiting write | ✓ | ✓ | ✓ | — | — | — | — |
| Hire | ✓ | ✓ | — | — | — | — | — |
| Team view | ✓ | ✓ | ✓ | ✓ | — | — | — |
| Workforce import | ✓ | ✓* | — | — | — | — | — |
| HR document manage | ✓ | ✓ | — | — | — | — | — |
| Own documents (visible) | — | — | — | — | ✓ | — | — |
| Payslip documents (all) | ✓ | ✓ | — | — | own only | ✓ | — |
Tenant isolation
Each organisation’s data is scoped by organisation_id. Users only access organisations they belong to. Cross-tenant access is denied at storage layer.
Invitations
Role assigned at invite creation. Changing roles: re-invite or admin user management where available.
Help
/help/roles