# Roles and permissions explained

> What each role can do, who should be assigned which one, and how to adjust what a role is allowed to do.

Every user in Timed has a **role**, and each role grants a set of **permissions**. Most pages and actions are controlled by a permission rather than a role name, so if a built-in role doesn't quite fit, you can adjust which permissions that role has instead of needing a new role.

## The built-in roles

| Role | Typical use | Key things they can do |
|---|---|---|
| **owner** | The company's account holder | Everything in their company: employees, locations, shifts, clock-ins, leave, disciplinary records, reports, payroll, users and settings. |
| **manager-owner** | A senior manager who also configures the company | Same as owner. |
| **manager** | Floor or branch manager | Views employees and locations, manages clock-ins (force clock-out, manual entry), approves variances and leave, runs reports. Can't change company settings or invite users. |
| **hr** | HR administrator | Manages employees, leave and disciplinary records. Can view reports. No clock-in management. |
| **field-manager** | Manager who oversees a few branches | Views employees and locations, approves variances, runs reports. No editing. |
| **client** | External viewer (e.g. a site supervisor) | Views reports and task lists only. |
| **employee** | Regular staff | Clocks themselves in and out, views their own leave, views task lists assigned to them. |
| **member** | Users who haven't been given a role yet | No permissions until a role is assigned. |

You may also see a **partner** role. It's used by Timed's reseller partners and isn't one you'd normally assign.

## When something is missing for a user

The sidebar and most pages check for a **permission**, not a role. If a user can't see a page or button they need:

1. Check which role the user has under **Users**.
2. Open **Role Permissions** (in the Admin section of the sidebar) and see whether that role has the permission the page needs.
3. Either give the user a role that has the permission, or add the permission to their current role.

For example, the **Manual Entry** button on the Attendance Report needs the **Manage clock-ins** permission. By default owner, manager-owner and manager have it, but hr does not. You can add it to the hr role on the Role Permissions page without changing anyone's role.

## A quick guide to choosing a role

| If you want this person to… | Give them this role |
|---|---|
| Run the company in Timed | owner or manager-owner |
| Approve clock-ins and leave for their team | manager |
| Add and edit employees but not manage clock-ins | hr |
| Just clock themselves in and out | employee |
| View reports only (e.g. an external client) | client |

## Editing role permissions

Users with the **Manage company settings** permission (owners and manager-owners by default) can add or remove permissions for each role on the **Role Permissions** page. Permissions are grouped by area (Access, Employees, Locations & Shifts, Attendance, Leave & Discipline, Reports & Payroll, Tasks & Departments). Changes apply to everyone in your company with that role as soon as you save, and you can reset a role back to its defaults at any time.