Privacy, visibility and retained history
Directory access does not include every HR record. Optional areas have their own features and permissions; hidden tabs do not request those records. Within an accessible employee, different child types have different scope checks.
Evidence and privacy map
| Area | Current behaviour |
|---|---|
| Directory/master | Party-resolved display name, work channels and master facts; no embedded salary, dependant or emergency details |
| Compensation/benefits | Separate permission/feature and linked-employer access |
| Personal records/documents | Separate area rights and accessible employee; private references remain text |
| Employee visibility | Any recorded accessible employment/assignment can qualify, including historical periods |
| Status history | Retained reasoned transitions, actor and timestamps; employment-view authority |
| Other HR edits | Audited/versioned row corrections; not immutable snapshots of every prior field value |
| Payroll snapshots | Separate historical copies owned by Payroll with source IDs/versions |
Historical visibility is not automatic revocation
Moving an employee out of North does not remove a North HR user's ability to see the master if an old North employment/assignment still satisfies the visibility check. This implementation is not current-assignment-only access. Review the exact rules before promising that a transfer hides all history from a former unit.
Compensation can still be unavailable if the linked employer unit is outside the caller's grants. Conversely, accessible master plus personal/document rights can expose employee-linked supporting records without a separate per-record unit field. Approve those authorities with that scope in mind.
Retention and correction
There are no Employee hard-delete endpoints. Close periods, end benefits or deactivate contacts through their supported fields. Lack of deletion does not mean every prior value of an edited row remains retrievable. Status transitions are retained evidence; master/child updates are not a complete immutable revision chain.
The Employee workspace provides no subject-access export pack, automatic retention purge, HR audit export or document-store retention implementation. Do not apply Care retention procedures to Employee records merely because both concern people.
Safe support and screenshots
Use invented training data or approved demo records. Capture tenant, employee number/record ID, operation and exact non-secret error. Keep salaries, contacts, dependant names, authorisation restrictions and private file references out of broad support material.
A Verified flag means a saved administrative decision, not automatic external verification. Review evidence under the responsible team's process and keep reasons necessary and proportionate to their purpose. Employee permission does not grant access to the external document store or another module's confidential record.