Payroll · Reference

Access and permissions

Which permission each Payroll screen needs, who may see and change what, and the rules that keep people from approving their own work.

On this page (17)

Permissions by screen All payroll screens Payroll run record Role assignment Payment files Manual inputs Rule packages / Settlement policies Settlement record Provisions ESS > Payroll Payslips / Payment status All payroll All commands Applications > Payroll > Features Configuration Rule packages Applications > Payroll

Permissions by screen

Screen	Menu	Permission needed
Payroll runs	Payroll > Payroll runs	payroll.view (list); payroll.prepare (New run)
Payroll run record	Payroll runs > open a run	payroll.view; buttons by payroll.prepare / approve / post / pay_prepare
Final settlements	Payroll > Final settlements	payroll.view; payroll.prepare (Check for terminations)
Settlement record	Final settlements > open a settlement	payroll.view; actions by payroll.prepare / settlement_review / approve / post / pay_prepare
Payslips	Payroll > Payslips	payroll.view
Pay inputs	Payroll > Pay inputs > Manual inputs	payroll.view; payroll.prepare (New); payroll.approve (Approve / Reject)
Adjustments	Payroll > Pay inputs > Adjustments	payroll.view; payroll.approve (Void)
Eligibility	Payroll > Pay inputs > Eligibility	payroll.view; payroll.prepare (Check eligibility)
Payment files	Payroll > Payment files	payroll.view; payroll.pay_release / pay_prepare
End-of-service provisions	Payroll > End-of-service provisions	payroll.view; payroll.prepare (propose, cancel); payroll.post (post)
Payroll register	Payroll > Reporting > Payroll register	payroll.view
Variance and exceptions	Payroll > Reporting > Variance and exceptions	payroll.view
Payment status	Payroll > Reporting > Payment status	payroll.view
Rule packages	Payroll > Configuration > Rule packages	payroll.view; payroll.configure (New, DEMO)
Rule package record	Rule packages > open a package	payroll.view; payroll.configure; payroll.rules_approve
Settlement policies	Payroll > Configuration > Settlement policies	payroll.view; payroll.configure
Settlement policy record	Settlement policies > open a policy	payroll.view; payroll.configure; payroll.rules_approve
Pay elements	Payroll > Configuration > Pay elements	payroll.view
Pay groups	Payroll > Configuration > Pay groups	payroll.view; payroll.configure
Pay periods	Payroll > Configuration > Pay periods	payroll.view; payroll.configure
Payroll app configuration	Administration > Applications > Payroll > Features / Fields	company.manage (proposer and a different approver)

All payroll screens

Rule	What the system does
Salary figures need a payroll permission	Refused (403); no amount in any response. HR permissions grant no payroll figures

Payroll run record

Rule	What the system does
Preparer cannot approve	Refused 'A payroll run is approved by somebody other than the person who created, froze or calculated it.'
Approved / posted runs are frozen	Refused with the state message; changes only by a correction run
Tamper evidence	Refused 'The payslips changed after calculation. Calculate again.' / 'The payslips no longer match what was approved...'

Role assignment

Rule	What the system does
Duty conflicts on roles	Flagged as a high/medium duty conflict in Access review; refused when the company rule says 'Refuse the grant'

Payment files

Rule	What the system does
File preparer cannot release	Refused 'A payment file is released by somebody other than whoever prepared it.'
Stored file is checked before release	Refused 'The stored file no longer matches its hash. It will not be released.'

Manual inputs

Rule	What the system does
Input maker-checker	Refused 'A pay input is approved by somebody other than whoever entered it.'

Rule packages / Settlement policies

Rule	What the system does
Author cannot approve	Refused 'A rule package is approved by somebody other than its author.' / 'A settlement policy is approved by somebody other than its author.'

Settlement record

Rule	What the system does
Four different people	Refused with the reviewer / approver / payer messages; the Separation of duties box explains who may act

Provisions

Rule	What the system does
Proposer cannot post	Refused 'A provision is posted by somebody other than whoever proposed it.'

ESS > Payroll

Rule	What the system does
Employee sees only own published payslips	Only E's published payslips; another id -> 'Payslip not found.'; employer cost never shown; bank masked

Payslips / Payment status

Rule	What the system does
Bank numbers masked	IBAN masked (first 4 + last 4) everywhere except inside the bank file itself

All payroll

Rule	What the system does
Company isolation	Not found / refused; nothing of company 2 shown

All commands

Rule	What the system does
Stale screen and replayed command	Second tab refused with the revision message; the replay returns the first answer and does nothing twice

Applications > Payroll > Features

Rule	What the system does
A turned-off feature refuses changes	Refused 'capability_disabled'; lists still readable; menu entry gone

Configuration

Rule	What the system does
Only configurers change configuration	Buttons hidden; API refused 'You do not have permission for this action.'

Rule packages

Rule	What the system does
Approval needs rules_approve and a second person	Refused for missing permission; refused 'A rule package is approved by somebody other than its author.'
Closing a window needs rules_approve	Refused (permission)

Applications > Payroll

Rule	What the system does
Protected core	Not offered (always on)

Updated 3 October 2026