Access and permissions in Payroll

What you can see and do in Payroll depends on four layers. All four must allow it.

Layer 1: modules

An administrator switches these on for the whole organisation.

Module or feature	Needed for
Payroll	All of Payroll
Employee, Party, Organization	Opening Payroll at all
Employee feature Compensation	Capturing employees into a run
Employee feature Benefits	Including benefit enrolments in snapshots (optional)

If any of the four modules is off, the dashboard card shows Access required and Payroll shows "Payroll requires enabled Payroll, Employee, Party and Organization modules and payroll view permissions."

Layer 2: permissions

Permission	Allows
payroll.setup.view	See payroll groups and component versions
payroll.setup.manage	Create payroll groups and component versions
payroll.run.view	See pay runs and their totals
payroll.detail.view	See each employee's entry, snapshot and lines (individual pay)
payroll.run.manage	Create runs, add and remove employees and lines, reopen, cancel
payroll.run.calculate	Calculate a draft run
payroll.run.review	Review a calculated run
payroll.run.approve	Approve a reviewed run
payroll.audit.view	See the run's workflow history

To capture employees you also need employee.view (to choose the employee). You do not need Employee's compensation permission to read a payroll snapshot: payroll.detail.view covers it.

Totals versus individual pay

payroll.run.view alone shows run totals but no employee's pay. Give payroll.detail.view only to people who need to see individual salaries.

Example roles at Bright Haven:

Person	Permissions
Farah (preparer)	setup.view, setup.manage, run.view, run.manage, run.calculate, detail.view
Ben (reviewer)	setup.view, run.view, run.review, detail.view, audit.view
Carol (approver)	run.view, run.approve, audit.view

Layer 3: business units

Each payroll group and run belongs to an employer business unit.

Action	You must be assigned to
See groups and runs in lists	The employer unit (others are hidden)
Open or change a run	The run's employer unit
Capture an employee	The employment's employer unit and the employee's assignment unit

If you are assigned to no units, the lists fail with "No payroll business-unit access is assigned to this user". Component versions are shared across the organisation.

Layer 4: independence

Whoever prepared a run can't review or approve it, and the reviewer can't approve it. See the three-person rule.

Changes don't show?

Permissions are read when you sign in. After an administrator changes them, sign out and back in.

Next: Set up Payroll.