Roles and Permissions

Enterprise-Grade Access Control for Your Organization

Sparko uses Role-Based Access Control (RBAC) to ensure that every employee has the right level of access to your HRIS data. With 5 global system roles plus fine-grained permissions, you can control exactly who can see and do what. You can also create custom roles tailored to your organization's specific needs.

Overview

What is RBAC?

Role-Based Access Control (RBAC) is a security system that restricts system access based on a person's role within your organization. Instead of managing permissions for each employee individually, you assign roles, and those roles come with predefined permissions.

Key Benefits

✅ Security - Control who can access sensitive data like compensation and payroll ✅ Compliance - Granular access controls, audit logging, and GDPR data-handling support ✅ Efficiency - Quick onboarding with predefined role templates ✅ Flexibility - Employees can have multiple roles (additive permissions) ✅ Audit Trail - All permission-sensitive actions are logged

Global System Roles vs Custom Roles

Sparko provides two types of roles:

Global System Roles

  • 5 predefined roles shared across all Sparko companies
  • Managed centrally by the Sparko team
  • Cannot be edited by individual companies (read-only)
  • Provide standardized, best-practice permission sets
  • Automatically updated with new features and permissions
  • The 5 roles: Super Admin, HR Admin, IT Admin, Manager, Employee

Note: Older docs referenced 10 roles including C-suite titles (CEO, CTO, CFO, CHRO, CPO, CMO). As of May 2026, those org titles live exclusively on Employee.job_title and don't grant elevated access. To give a CEO full access, assign them the Super Admin role.

Company Custom Roles

  • Created by your company for specific organizational needs
  • Fully customizable - you control all permissions
  • Can be created from scratch OR by replicating a system role
  • Perfect for unique job functions or department-specific needs
  • Examples: "Sales Manager", "Customer Support Lead", "Data Analyst"

Global System Roles

Sparko provides 5 predefined global roles that cover most organizational needs. Need something more specific? Replicate any system role to a custom role and adjust the permissions (see Creating Custom Roles below).

1. Super Admin

Use Case: Full system access. Default role assigned to the first user of a new tenant.

  • Permissions: All permissions via the *.all.manage wildcard
  • Best Practice: Assign sparingly. New tenants get one Super Admin (the founder/admin who set up the company); additional grants should be deliberate.
  • Typical Users: Founders, system administrators, break-glass emergency access

2. HR Admin

Use Case: Day-to-day HR operations

  • Permissions: Full access to People, Performance, Recruiting, Onboarding, Time & Leave, Compensation, Career, and Engagement modules. Plus exclusive access to personal documents and PII (DOB, SSN, ethnicity, address, emergency contact).
  • Can Do:
    • ✅ Manage all employee data
    • ✅ View / upload / delete personal employee documents (HR-only by default)
    • ✅ View sensitive PII (full DOB, SSN, ethnicity, etc.)
    • ✅ Conduct performance reviews
    • ✅ Manage recruiting pipeline
    • ✅ Approve time-off requests
    • ✅ Manage compensation bands and equity grants
    • ✅ Manage roles and permissions (admin.roles.*, admin.permissions.view)
    • ✅ View and export audit logs
  • Cannot Do:
    • ❌ Manage integrations (IT Admin scope)
    • ❌ Manage feature flags (IT Admin scope)
  • Typical Users: HR Managers, HR Business Partners, CHRO

3. IT Admin

Use Case: System administration and integrations

  • Permissions: All admin module permissions (admin.*) including integrations, feature flags, audit logs, and system settings. Basic employee directory view (no HR data by default).
  • Can Do:
    • ✅ Configure integrations (Slack, Google, HRIS imports)
    • ✅ Manage feature flags
    • ✅ View and export audit logs
    • ✅ Manage roles and permissions
    • ✅ Manage system settings
  • Cannot Do:
    • ❌ View HR data (no employee profile / compensation / performance access by default)
    • ❌ View personal documents or PII
  • Typical Users: IT Managers, DevOps Leads, Security Engineers

4. Manager

Use Case: Team management — automatically assigned by the org chart.

  • Permissions: Team-scoped permissions across People, Performance, Time & Leave, Compensation, Career, and Engagement.
  • Data Scope: Team subtree — direct reports + indirect reports (reports of reports). Endpoints expose ?include_indirect=false for direct-only views.
  • Auto-assignment: When an employee gains their first direct report, the system grants them the Manager role automatically. When their last report is removed, the role is auto-revoked. Don't assign manually.
  • Can Do:
    • ✅ View their org subtree's employees, performance reviews, 1:1 notes, PTO, timesheets, compensation
    • ✅ Approve team time-off
    • ✅ Conduct team performance reviews
  • Cannot Do:
    • ❌ View other org subtrees
    • ❌ View company-wide compensation
    • ❌ View personal documents or PII (HR Admin only)
  • Typical Users: People Managers, Directors, VPs, CxOs (the role applies regardless of org-chart depth)

5. Employee

Use Case: Self-service baseline (auto-assigned to all employees)

  • Permissions: Self-service permissions for own profile, OKRs, performance, PTO, timesheets, bank details, and pay components.
  • Data Scope: Own only (self)
  • Can Do:
    • ✅ View and edit own profile
    • ✅ View own personal documents
    • ✅ Submit time-off requests
    • ✅ View and edit own bank details and pay components
    • ✅ Update own skills and certifications
    • ✅ Submit timesheets
  • Cannot Do:
    • ❌ View other employees' personal data
    • ❌ Approve requests
    • ❌ Manage system settings
  • Typical Users: All employees (automatically assigned)

Multi-Role Support

Employees can have multiple roles, and permissions are additive (combined).

Common Multi-Role Examples

Example 1: HR Admin + Manager (the most common combination)

  • Scenario: HR Manager who also manages a team
  • Permissions: HR Admin permissions + Manager team-scoped permissions
  • Result: Can manage all HR operations AND manage their direct reports
  • Note: The Manager role is auto-assigned by the system once the employee has direct reports — you only need to manually grant HR Admin.

Example 2: IT Admin + Custom "Compliance" Role

  • Scenario: Security engineer who also reviews compliance reports
  • Permissions: IT Admin (integrations, feature flags, audit) + custom role granting *.reports.view_all
  • Result: Can manage system AND pull aggregate compliance reports without seeing individual records

Example 3: Custom "Legal" Role + Employee

  • Scenario: General Counsel needs document access but not full HR
  • Approach: Replicate HR Admin → custom "Legal" role, then strip out the HR-operational permissions (recruiting, performance, etc.) and keep documents.personal.view_all
  • Result: Can view personal documents company-wide for legal holds without seeing performance reviews or compensation

Data Scopes

Permissions can have different data scopes that control what data users can access:

Scope Description Example
all All employees in the company HR Admin viewing all employee data
team Direct reports only Manager viewing their team's PTO balances
own Self only Employee viewing their own bank details

How Data Scopes Work

When you assign a role with a scoped permission, the system automatically filters data:

  • HR Admin with people.employees.view_all → Sees ALL employees
  • Manager with people.employees.view_team → Sees ONLY direct reports
  • Employee with people.employees.view_own → Sees ONLY themselves

Sensitive Permissions

Some permissions are marked as sensitive and require extra scrutiny:

Highly Sensitive (Payroll/Compensation)

  • ❗ compensation.employee.view_all - View all employee compensation
  • ❗ compensation.payroll_run.run - Run a payroll extract (pay + bank files)
  • ❗ people.bank_accounts.view_all - View all employee bank details
  • ❗ compensation.equity.grant - Grant equity to employees

Best Practices

  • Limit access: Only assign to trusted roles (HR Admin, Super Admin)
  • Audit regularly: Review who has these permissions quarterly
  • Enable MFA: Require multi-factor authentication for these roles
  • Monitor usage: All sensitive actions are logged in audit trail

Assigning Roles

How to Assign Roles (Admin Guide)

  1. Navigate to People → Employees
  2. Select employee
  3. Click "Edit Roles"
  4. Check roles to assign:
    • ✅ Employee (auto-assigned to all users)
    • ⚙️ Manager (auto-assigned when the employee has direct reports — don't assign manually)
    • ☐ HR Admin (for HR team members who need full HR + PII + document access)
    • ☐ IT Admin (for system administrators managing integrations, feature flags, and audit)
    • ☐ Super Admin (full access — for founders, owners, or emergency recovery only)
    • ☐ Any custom roles your company has created (e.g., "Legal", "Finance Lead")
  5. Save changes

Role Assignment Best Practices

✅ Principle of Least Privilege: Give users the minimum permissions needed ✅ Review Quarterly: Audit role assignments every 3 months ✅ Offboarding: Remove all roles immediately when employees leave ✅ Onboarding: Start with Employee role, add others as needed ✅ Multi-Role: Combine roles when users have multiple responsibilities

❌ Don't over-assign: Avoid giving Super Admin to everyone ❌ Don't forget to remove: Update roles when responsibilities change ❌ Don't bypass scopes: Use proper roles instead of granting exceptions

Permission Reference

Module Permissions

Permissions are organized by module:

Module Sample Permissions Count
People people.employees.view_all, people.employees.create, people.departments.edit 11
Recruiting recruiting.jobs.create, recruiting.candidates.view_all, recruiting.offers.approve 24
Performance performance.reviews.create, performance.okrs.approve, performance.feedback.submit 48
Time-Leave pto.requests.approve, timesheets.view_all, holidays.manage 28
Compensation compensation.bands.view_all, compensation.employee.edit, compensation.payroll_run.run, compensation.equity.grant 20
Career career.skills.manage, career.certifications.verify, career.goals.create 22

Total: permissions span all core modules

Common Permission Patterns

Pattern Example Description
*.view_all people.employees.view_all View all records (scope: all)
*.view_team pto.requests.view_team View team records (scope: team)
*.view_own compensation.employee.view_own View own record (scope: own)
*.create recruiting.jobs.create Create new records
*.edit people.employees.edit Edit existing records
*.delete recruiting.jobs.delete Delete records
*.approve pto.requests.approve Approve requests/workflows
*.submit timesheets.submit Submit items for approval

Security and Compliance

Audit Logging

All permission-sensitive actions are logged:

  • ✅ Who performed the action
  • ✅ What action was performed
  • ✅ When it happened (timestamp)
  • ✅ What data was accessed/modified
  • ✅ IP address and user agent

Compliance Features

Access controls:

  • Access controls enforced at API level
  • Audit trails for all sensitive operations
  • Role-based segregation of duties

GDPR:

  • Employee data access tracked
  • PII encryption at rest
  • Right to access (employees can view own data)

Creating Custom Roles

Need a role that doesn't exist in the global system roles? You can create custom roles tailored to your organization's unique needs.

Option 1: Replicate a System Role

Start with a proven template and customize it for your needs.

When to use this:

  • You like most of a system role's permissions but need modifications
  • You want a starting point based on best practices
  • You need a role similar to an existing one but with some changes

How to replicate:

  1. Navigate to Settings → Roles & Permissions
  2. Find the global system role you want to copy (e.g., "HR Admin")
  3. Click the ⋮ menu next to the role
  4. Select "Replicate to Custom Role"
  5. Give your custom role a unique name (e.g., "Senior HR Administrator")
  6. Click "Replicate"
  7. The new role appears in your "Custom Roles" section with all permissions copied
  8. Click "Edit Permissions" to customize the permission set
  9. Add or remove permissions as needed
  10. Click "Save"

Example use cases:

  • Copy "Manager" → Create "Senior Manager" with additional reporting permissions
  • Copy "HR Admin" → Create "HR Coordinator" with limited permissions
  • Copy "Employee" → Create "Remote Employee" with specific remote work permissions

Option 2: Create from Scratch

Build a role with exactly the permissions you need, starting from zero.

When to use this:

  • You need a highly specialized role unlike any system role
  • You want maximum control over every permission
  • You're creating a role for a unique department or function

How to create from scratch:

  1. Navigate to Settings → Roles & Permissions
  2. Click "Create Custom Role" button
  3. Enter role details:
    • Role Name: e.g., "Customer Success Manager"
    • Description: What this role is for
    • Role Type: "Custom"
  4. Click "Create Role"
  5. Click "Edit Permissions" on your new role
  6. Browse permissions by module and select what you need:
    • ✅ Check boxes for permissions to grant
    • ❌ Leave unchecked for permissions to deny
  7. Click "Save Permissions"
  8. Assign employees to the new role

Permission categories:

  • View permissions: See data (e.g., "View all employees")
  • Create permissions: Add new records (e.g., "Create job postings")
  • Edit permissions: Modify existing data (e.g., "Edit employee profiles")
  • Delete permissions: Remove records (e.g., "Delete candidates")
  • Approve permissions: Approve requests (e.g., "Approve time-off")

Managing Custom Roles

Edit permissions:

  1. Go to Settings → Roles & Permissions
  2. Find your custom role in the "Custom Roles" section
  3. Click "Edit Permissions"
  4. Modify the permission checkboxes
  5. Click "Save"

Rename a role:

  1. Go to Settings → Roles & Permissions
  2. Click the ⋮ menu next to your custom role
  3. Select "Edit Role Details"
  4. Update name and description
  5. Click "Save"

Delete a custom role:

  1. Go to Settings → Roles & Permissions
  2. Click the ⋮ menu next to your custom role
  3. Select "Delete Role"
  4. Confirm deletion (employees assigned to this role will lose those permissions)

⚠️ Important:

  • You cannot edit global system roles - only view them
  • You can only delete custom roles you created
  • Deleting a custom role removes it from all employees who have it
  • Always test custom roles with a test user before wide deployment

Custom Role Best Practices

✅ Name clearly: Use descriptive names that indicate the role's function ✅ Start minimal: Grant minimum permissions needed, add more later if needed ✅ Document purpose: Add clear descriptions explaining when to use the role ✅ Review regularly: Audit custom roles quarterly to ensure they're still needed ✅ Test first: Assign to yourself or a test user before rolling out company-wide ✅ Keep it simple: Don't create too many custom roles - use multi-role assignment instead

Troubleshooting

Common Issues

Q: Employee says they can't access a feature

  • Check: Verify they have the correct role assigned
  • Check: Verify the role has the required permission
  • Check: Check if it's a team-scoped permission and they're viewing the right data

Q: Manager can't see team member's data

  • Check: Verify they have "Manager" role assigned
  • Check: Verify the team member reports to them (manager_id set correctly)
  • Check: Verify they're looking at team-scoped data, not all-company data

Q: How do I give someone access to everything?

  • Answer: Assign "Super Admin" role (but use sparingly - this is emergency access only)

Q: Can I customize roles or create new ones?

  • Answer: Yes! You can create custom roles in two ways:
    1. Start from scratch: Create a blank role and add specific permissions
    2. Replicate a system role: Copy a global role as a template and customize it
  • See: "Creating Custom Roles" section below for step-by-step instructions

Best Practices Summary

✅ Start Minimal: Begin with Employee role, add others as needed ✅ Use Multi-Role: Combine roles instead of creating exceptions ✅ Audit Quarterly: Review role assignments every 3 months ✅ Enable MFA: Require MFA for sensitive roles (HR Admin, Super Admin) ✅ Monitor Logs: Review audit logs for suspicious activity ✅ Document Changes: Keep a record of why roles were assigned ✅ Test Access: Verify new employees have correct access ✅ Offboard Promptly: Remove roles immediately when employees leave

Need Help?

Applies To: All Sparko HRIS customers Feature Tier: Enterprise (RBAC included in all plans, advanced roles in Business+)

Still need help? Reach us at support@sparko.app.

← Back to Help Center