First, the two words that explain everything

A permission is one specific thing a person is allowed to do — like “see their own payslip” or “approve the team’s leave.” You don’t usually hand these out one by one; you bundle them into a role (like “Manager”) and give people the role. This page is the dictionary: it tells you what each permission lets someone do.

“Self,” “team,” and “all” — what these mean

Many permissions come in three sizes, called scopes, which control whose records the permission covers:

self — only the person’s own records.
team — the people who report to them (their team).
all — everyone in the company.

A quick example with viewing employees:

self = “I can see my own profile.”
team = “I can see my team members’ profiles.” (good for a manager)
all = “I can see everyone’s profile.” (good for HR)

The technical name for each permission is shown in code style so you can match it to what you see in the permission grid. You don’t need to memorise these — the plain description is what matters.

People & directory

Employees - See your own profile — employees.read.self - See your team’s profiles — employees.read.team - See everyone’s profile — employees.read.all - Edit your own profile — employees.write.self - Edit your team’s profiles — employees.write.team - Edit anyone’s profile — employees.write.all - Delete employees — employees.delete - Invite new people to join — employees.invite

Time & attendance

Attendance (clock in/out records) - View attendance — your own / your team’s / everyone’s — attendance.read.self / .team / .all - Record your own attendance — attendance.write.self - Edit attendance — your team’s / everyone’s — attendance.write.team / .all - Approve correction requests (when someone fixes a clock-in) — attendance.approve_corrections - Manage attendance settings — attendance.admin

Leave (time off) - View leave — your own / your team’s — leave.read.self / .team - Request your own time off — leave.create_self - Approve your team’s time off — leave.approve_team - Set up leave types and rules — leave.admin

Work & goals

Boards (task/project tracking) - View boards — boards.read - Create and edit board content — boards.write - Administer boards, including deleting whole boards/workspaces — boards.admin

Performance (reviews) - View performance — your own / your team’s — performance.read.self / .team - Create a review — performance.create_review - Finalize (lock) a review — performance.finalize_review - Manage the scorecards (score definitions) — performance.admin

Daily reports - Read reports — your own / your team’s — reports.read.self / .team - Write your own daily report — reports.write.self - Comment on your team’s reports — reports.comment_team

OKRs (goals) - View goals — okr.read - Edit your own goals — okr.write.self - Edit your team’s goals — okr.write.team - Manage company-wide goals — okr.admin

Requests & money

Workflow (approval setup) - Manage approval chains (who approves what) — workflow.admin

Expenses - Submit your own expense claims — expense.create_self - Approve your team’s expenses — expense.approve_team - Manage expense settings and reimbursements — expense.admin

Travel - Request your own travel — travel.create_self - View travel — your own / your team’s / everyone’s — travel.read.self / .team / .all

Payroll - View payroll (the HR/Finance area) — payroll.read - Create and calculate pay runs — payroll.run - Export pay files — payroll.export - View your own payslips — payroll.read.self

Compensation (salaries) - View compensation — compensation.read - Propose a salary change — compensation.propose_change - Cancel a pending salary change — compensation.cancel_change

Growth & hiring

Training - View training — training.read - Assign training to people — training.assign - Manage training — training.admin

Recruiting (hiring) - View the hiring pipeline — recruiting.read - Edit the pipeline — recruiting.write - Administer recruiting — recruiting.admin - Submit scorecards for interviews assigned to you — recruiting.submit_scorecard.self

Onboarding - View onboarding — onboarding.read - Complete onboarding tasks — onboarding.complete_item - Manage onboarding templates — onboarding.admin

Administration

Settings & roles - Manage company settings — settings.org - Manage workflow settings — settings.workflows - Manage roles and permissions — settings.roles - Administer the Roles & Permissions area — rbac.manage - View the audit log — audit.read

Data export - Request a company-wide data export — org.export.create - Download a company data export — org.export.download - Request your own personal data export — user.export.create - Download your own data export — user.export.download_own - Download another person’s data export — user.export.download_others

Common questions

Someone has the same access from two roles — which wins? Access adds up. A person can do anything any of their roles allows. There’s no “stronger role” — it’s everything combined.
What’s the difference between self, team, and all again? Self = their own records, team = the people who report to them, all = the whole company.
Which permissions can the Owner never lose? Core ones like managing roles (rbac.manage, settings.roles), company settings (settings.org), full employee access (employees.read.all, employees.write.all), and the audit log (audit.read) — so the company can’t be locked out. See Customizing roles and permissions.