> For the complete documentation index, see [llms.txt](https://help.allwage.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.allwage.com/fundamentals/users-and-employees/user-permissions/payroll-permissions.md). # Payroll Permissions How payroll access works: payroll companies and pay runs, what payroll users can see and change, payroll reports, and fixing payroll access problems. If your organisation uses AllWage payroll, payroll has its own scope and its own permissions. Everything on the other User Permissions pages still applies — this page adds what's specific to payroll. **What this page covers:** * Payroll access, payroll companies and pay runs * How time and attendance and payroll access combine * The payroll permissions, including reports * Work that needs a whole company — filing, SARS submissions and company-wide reports * Payroll in presets, with examples * Troubleshooting payroll access **Who this is for:** Owners and payroll administrators who set up payroll access. Read [User Permissions](/fundamentals/users-and-employees/user-permissions.md) and [Permission Presets](/fundamentals/users-and-employees/user-permissions/permission-presets.md) first. ## Payroll Access and Payroll Scope ### Payroll access: yes or no Every preset that could include payroll starts with **Payroll access?** * **No** — no payroll at all: no pay runs, no payroll companies, no payroll reports and no payroll information on employees. Every payroll permission becomes No access. Any preset can be set to No. * **Yes** — you then choose the payroll scope. ### Two separate payroll scopes Payroll has two scopes. They mean different things, and you usually only need one. * **Payroll companies — the whole company.** Every pay run in the company, including pay runs added later. This is for someone who **administers** a company's payroll — including filing and SARS submissions, the OID return of earnings and the company-wide reports. * **Pay runs — specific pay runs only.** Just the chosen pay runs, without the rest of their company. This is for someone who works on particular pay runs, not on a company as a whole. ### Choose the one that matches the job | Job | Payroll companies | Pay runs | | ---------------------------------------------------------------------------- | ----------------- | ---------------------------------- | | Administers the whole payroll for a company, including filing | That company | **None** | | Works on certain pay runs only | **None** | Those pay runs | | Administers one company, and also needs one pay run from a different company | That company | The pay run from the other company | Only combine the two scopes in the last case. A pay run can only come from a company that isn't already chosen — if a company is chosen, its pay runs are already included, and AllWage shows *"Already included through"* that company. If payroll companies is **All**, every pay run is already included. ## Seeing vs Editing A user can reach an employee in two ways: through their **T\&A teams**, or through their **payroll scope**. * **What they can see:** everyone on their teams, **plus** everyone in their payroll scope. * **What they can change in time and attendance:** clocks, leave, activity items, hour overrides and the employee record — only for employees on their **teams**. * **What they can change in payroll:** only for employees in their **payroll scope**, and only as far as their payroll permissions allow. For example, a team manager's team has 20 employees, and their weekly pay run pays 60 employees across four teams. They see all 60. They can work on payroll for all 60, but can only change clocks, leave and records for their own 20. {% hint style="info" %} **"I limited this manager to one team, but they can see hundreds of employees."** Check their payroll scope. A whole payroll company, or a pay run that covers many teams, brings everyone on it into view. To limit what they see, narrow the payroll scope too, or set payroll access to No. {% endhint %} **Payroll only, no teams.** A payroll administrator can have T\&A teams set to **None** and a whole payroll company. They see everyone the company pays and work on their payroll, but can't change anyone's clocks or leave. **Employees not on a pay run.** An employee who isn't on any pay run is visible to anyone with payroll access, so they can be put onto the right pay run. Their historic payroll information stays out of reach unless those pay runs are in the user's scope. ## Payroll Permissions and Reports | Permission | What it covers | Levels | | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | | **Employee payroll** | Everything payroll-related on an employee: payroll details, earnings and deductions, recurring amounts, employment periods, leave balances, loans and savings. | No access, Read, Read / Write | | **Pay runs** | Working on pay runs, including finalising them. | No access, Read, Read / Write | | **Payments** | Preparing the payments that come out of a pay run. | No access, Read, Read / Write | | **Filing** | Submitting statutory returns. Needs a whole company. | No access, Read, Read / Write | | **Reports** | Each payroll report is its own permission. | No access, Read | ### Permissions that need another first AllWage never switches the missing permission on for you. The preset editor shows what's needed, and the permission has no effect until you give it. * **Pay runs** needs **Employee payroll** at least at Read. * **Payments** needs **Pay runs** at least at Read. * **Payroll reports** need at least Read on Employee payroll, Pay runs, Payments or Filing. ### Editing is not the same as finalising Employee payroll and Pay runs are independent, so preparing pay and signing it off can be different people. | Employee payroll | Pay runs | Within their scope, they can… | | ---------------- | ------------ | ---------------------------------------------------------- | | Read / Write | Read | Capture and correct employees' pay, but not finalise. | | Read | Read / Write | Finalise the pay run, but not change anyone's pay by hand. | | Read | Read | Check everything, and change nothing. | Finalising still makes the updates a pay run needs, such as leave balances and loans and savings. Permissions never override a pay run's own rules — a finalised or locked pay run stays locked. ### Reports only show the employees in your scope Every report is **filtered by the employees in your scope**, and never shows someone you can't see. A payroll administrator with the whole company sees everyone the company pays; a user with one pay run sees only that pay run's employees. ### Work that needs the whole company These are **only available to users with at least one whole payroll company** — chosen under payroll companies, not just some of its pay runs: * Filing * SARS Code Summary * OID Report * Employment Tax Incentive (ETI) Breakdown * Skills & Equity * BIBC * Accounting Journal Export The **Overall Usage Report** covers every company, so it's only available with payroll companies set to **All**. Every other payroll report — such as the Pay Run Template Summary, Leave Liability, UI-19, Certificate of Service, Cost Report and Nett Pay Report — works with any payroll scope, filtered to the employees in it. **If the preset fixes the payroll scope** to specific pay runs, the editor won't allow Filing or the company-wide reports. **If the scope is Set per user**, each user gets what their own scope supports, and the Resolved access preview explains anything they can't use under **Why some access is limited**. ## Payroll in Presets | Preset | Payroll | | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Admin — Full** | Every company: every pay run, filing, all reports and all payroll setup. | | **User — Full (unscoped)** | Reads all payroll. Changes nothing. | | **User — Full (scoped)** | The payroll chosen for each user. With a whole company, that includes filing and the company's own setup. Also reads and manages employees' documents within their scope. | | **Admin — T\&A only**, **User — T\&A only** | No payroll access. | User — Full (scoped) leaves teams, payroll companies and pay runs on **Set per user**. When you add a user to it, AllWage asks **Payroll access?**, then their payroll companies, then their pay runs, along with their teams. ### Payroll setup Payroll setup is always at least **Read** for anyone who works on payroll. Who can change it follows the same rule as the rest of AllWage — you can change what's inside your scope; only Admins change what's shared by everyone. * **Pay run settings, payslip settings and company settings** belong to one company. A scoped user with that **whole company** can change them. A user with only specific pay runs can read them but not change them. * **Leave policies, input templates and input variables** — the earnings and deductions everyone's pay is built from — are shared by the whole organisation. Only Admins change them. * **Company documents** are shared by every payroll company, so they need payroll companies set to **All**. ### Example: the regional payroll administrator Runs the whole payroll for one company, North, including filing, and manages time and attendance for the teams in their area. * **Preset:** User — Full (scoped) * **Scope:** teams in their area · payroll companies: North · pay runs: None They get every North pay run, filing and North's reports, and can manage North's pay run settings, payslip settings and company settings. They read leave policies and input templates. ### Example: the pay-run clerk Works on the Weekly Casuals pay run only. No filing, no company-wide reports. * **Preset:** User — Full (scoped) — no custom preset needed * **Scope:** payroll companies: None · pay runs: Weekly Casuals Filing and the company-wide reports simply aren't available, because the clerk doesn't have a whole company. ### Example: maintaining earnings and deductions Someone like the regional payroll administrator who is also responsible for the organisation's input templates. Input templates are shared by everyone, so a scoped user can't change them. Build a custom preset upward from **User — Full (scoped)**, raising **Input templates** from Read to **Read / Write**, and name it after the job. Any change they make affects every company and every employee. ## Troubleshooting Payroll Access | Complaint | What to check | | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | "This manager can see far too many employees." | Their payroll scope. Everyone in it is visible. In Explore employee access, these employees show a payroll reason instead of a team. | | "I can see this employee but can't fix their clock." | The employee is probably visible through payroll only, and isn't on the user's teams. | | "Filing is greyed out." | Filing needs at least one whole payroll company. A user with only specific pay runs can't file. | | "A report is missing." | Does the preset give the report? Does it need a whole company, or all companies? Does the preset give a payroll permission for the report to work from? | | "Payments doesn't do anything." | Payments needs Pay runs at least at Read, and Pay runs needs Employee payroll at least at Read. | | "I can't change the pay run settings." | Managing pay run settings, payslip settings and company settings needs a whole payroll company. | Use the **Resolved access** preview and **Explore employee access** to confirm the reason before changing anything. See [Designing and Troubleshooting Access](/fundamentals/users-and-employees/user-permissions/designing-and-troubleshooting-access.md#diagnosing-access-problems). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.allwage.com/fundamentals/users-and-employees/user-permissions/payroll-permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.