Role-Based Access Control in HR Software: Who Should See What

In any leave management system, not everyone should see everything. Employees should see their own balances and requests. Managers should see their team’s leave data. HR should see everything. Finance should see payroll-relevant data. And administrators should have full access. Role-based access control (RBAC) enforces these boundaries so sensitive employee data is only visible to the people who need it.

Leave Balance implements RBAC at the workspace level. Each user is assigned a role that determines what they can see and do. The system comes with standard roles and supports custom roles for organisations that need fine-grained permissions.

Key Takeaways

• RBAC ensures each user sees only the data relevant to their role
• Leave Balance provides standard roles (Employee, Manager, HR Admin) and supports custom roles
• Proper access control is a compliance requirement under GDPR, Fair Work, and most data protection regulations

Why RBAC Matters for HR Software

HR systems contain some of the most sensitive data in any organisation: personal information, salary details, medical leave records, disciplinary history. Without proper access controls, anyone with access to the HR tool can see data that is not relevant to their role.

This creates three problems:

1. Privacy violations. An employee’s medical leave should not be visible to their colleague. Salary data should not be visible to non-HR staff. Without RBAC, these boundaries are enforced by convention, not by the system.
2. Compliance risk. GDPR, the Australian Privacy Act, and most data protection regulations require that personal data is only accessible to authorised personnel. Without RBAC, there is no technical control to demonstrate compliance.
3. Audit failures. When an auditor asks “who can see employee salary data?” and the answer is “anyone with admin access,” that is a finding. RBAC provides the documented, enforceable access control that auditors expect.

Standard Roles in Leave Balance

Leave Balance ships with three standard roles:

Employee

The default role for all team members. Employees can:

• View their own leave balances and leave history
• Submit leave requests
• View their own approved and pending requests
• See the team calendar (who is out today)
• Cancel their own pending requests

Employees cannot see other employees’ balances, leave reasons, or manager comments.

Manager

Managers have all Employee permissions plus:

• View their direct reports’ leave balances and requests
• Approve or reject leave requests from their direct reports
• View the team leave calendar with all direct reports’ absences
• See the absence history for their direct reports
• Receive notifications for pending approvals

Managers cannot see salary data, medical leave reasons (unless configured), or employee data outside their reporting line.

HR Admin

HR administrators have all Manager permissions plus:

• View all employee records across the organisation
• View all leave balances, requests, and histories
• Configure leave policies and approval workflows
• Import and export employee data
• Access reporting and analytics dashboards
• Manage user roles and permissions

HR Admins do not have permission to delete audit logs or override compliance rules.

Custom Roles

For organisations that need more granular control, Leave Balance supports custom roles. Create a role and assign specific permissions:

Permission	Description
leave_requests:view_own	View own leave requests
leave_requests:view_team	View direct reports’ leave requests
leave_requests:view_all	View all leave requests
leave_requests:approve	Approve or reject requests
balances:view_own	View own balances
balances:view_team	View team balances
balances:view_all	View all balances
employees:view_all	View all employee records
employees:edit	Edit employee records
policies:manage	Create and edit leave policies
reports:view	Access reporting dashboards
reports:export	Export reporting data
audit_logs:view	View audit trail

Example Custom Roles

Payroll Officer: Can view approved leave and employee records but cannot approve leave or modify policies.

Department Head: Can view all leave data for their department but not other departments.

IT Admin: Can manage user accounts and SSO settings but cannot view leave data.

How to Configure RBAC in Leave Balance

Step 1: Review the Default Roles

Navigate to Settings > Roles & Permissions to see the default roles and their permissions. Most small to mid-size businesses use the standard roles without customisation.

Step 2: Create Custom Roles if Needed

If the standard roles do not fit your organisation:

1. Click “Create Custom Role”
2. Name the role (e.g., “Payroll Officer”, “Department Head”)
3. Select the permissions from the list
4. Save the role

Step 3: Assign Roles to Users

For each user in your workspace:

1. Navigate to Settings > Users
2. Click the user’s name
3. Select their role from the dropdown
4. Save

Role changes take effect immediately. The user does not need to log out and back in.

Step 4: Audit Role Assignments Quarterly

Set a quarterly reminder to review who has which role. Common audit checks:

• Are terminated employees still assigned roles?
• Have any employees changed departments without a role update?
• Are there more HR Admins than necessary?
• Are custom roles still appropriate for the people assigned to them?

Best Practices

• Follow the principle of least privilege. Assign the role that provides the minimum access needed for the person’s job. Do not give someone HR Admin access because they need to approve one team’s leave.
• Separate HR and payroll roles. The person who approves leave should not necessarily be the person who sees salary data. Use separate roles for HR and payroll functions.
• Limit HR Admin roles. The fewer people with HR Admin access, the lower the risk of data misuse or accidental changes. Reserve this role for the HR team lead and one backup.
• Document role assignments. Maintain a simple spreadsheet or table showing who has which role, when it was assigned, and why. This is invaluable during audits.
• Review after organisational changes. When someone changes roles, departments, or leaves the company, update their RBAC assignment immediately.

FAQ

Can an employee have multiple roles?

No. Each user is assigned exactly one role. If someone needs permissions from multiple roles, create a combined custom role that includes all the necessary permissions.

Can a manager see leave reasons?

By default, managers see the leave type and dates but not the detailed reason. If your organisation requires managers to see reasons (e.g., for medical leave), you can enable this in the policy settings.

Does RBAC apply to the API?

Yes. API keys are assigned the same roles as human users. An API key with Employee permissions can only access employee-level data through the API.

Can I temporarily elevate someone’s role?

Yes. Change their role to the elevated level, then change it back when the temporary need is over. Leave Balance logs all role changes in the audit trail.

What happens if I delete a role that is assigned to users?

Leave Balance prevents deletion of a role that is currently assigned to users. You must reassign those users to a different role before deleting the role.