How-to
HR roles and permissions
Six HR roles control who can do what. Granted in Portal under Users. Walks through each role's reach and how to grant or revoke.
Jump to section
The six roles
(See What roles exist in Blankitt HR? for the quick-reference table.)
What each role can access
Admin
The everything role. Use sparingly — anyone you give Admin to can:
- Add, edit and terminate employees
- Run and finalise pay runs
- Change company settings (pension, email provider, payroll account codes)
- Invite and remove users
- Manage onboarding templates and leave policies
Manager
The role for people who manage a team. They can:
- See their direct reports' profiles, contracts and salary
- Approve or reject their reports' leave requests
- See their reports' performance reviews
- Lock their reports' ratings during calibration
They can't see other people's employees or organisation-wide reporting.
Payroll Admin
For finance/accounts people who run payroll but don't manage the org. They can:
- Create, calculate, finalise and void pay runs
- Manage tax codes, student loans and salary sacrifice for every employee
- Configure pension settings
- Export pay runs to Xero, Sage or BrightPay
- Download payslip PDFs
They can't add or terminate employees, change job titles, or edit settings unrelated to pay.
Recruiter
For people focused on hiring. They can:
- Create and manage jobs
- Add candidates and move them through the pipeline
- Schedule interviews
- Create offers
- Accept offers (which creates the employee)
They can't edit existing employees after hire — that's the Admin or Manager's job.
Employee
The self-service role. They see:
- Their own profile, contract and pay history
- Their leave balances and the team calendar
- Their personal documents and payslips
- Their onboarding checklist
- Their reviews and any feedback they've been asked to give
Nothing else.
Calibration Moderator
A specialist role for senior leaders who run cross-manager calibration sessions. They can:
- Open and close calibration sessions
- Override any locked manager rating with a reason
- See the full calibration grid across the org
Usually granted just before a calibration cycle and removed after.
Granting and revoking
In Portal > Users, find the user, find the HR product card, set the role. Save.
Changes take effect on the user's next sign-in (or within a few hours automatically).
What if I lock myself out?
The first user in a new HR setup defaults to Admin so you're never locked out before you've assigned explicit roles. If you somehow remove Admin from yourself, contact support — we'll restore it.