> For the complete documentation index, see [llms.txt](https://help.allwage.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.allwage.com/fundamentals/users-and-employees/user-permissions/permission-presets.md).

# Permission Presets

The seven built-in permission presets, how scope works on a preset, and how to build, edit and delete your own custom presets.

A **permission preset** is a named bundle of access. Every user is linked to exactly one preset, and it decides everything they can do. AllWage comes with seven built-in presets, and you can build your own for jobs that don't quite fit.

**What this page covers:**

* The seven built-in presets, and the rule behind them
* Fixed scope and Set per user
* Why every user is linked to a preset
* Building a custom preset — and why you should build upward
* Editing and deleting custom presets
* Scoped users and shared setup

**Who this is for:**

Owners and anyone who manages permission presets. Read [User Permissions](/fundamentals/users-and-employees/user-permissions.md) first if you're new to presets, permissions and scope.

## The Built-in Presets

The built-in presets follow one rule:

{% hint style="info" %}
**You can change anything that belongs entirely inside your scope. Only Admins can change setup that's shared by the whole organisation.**
{% endhint %}

| Preset                          | Covers                   | What it's for                                                                                                                                                           |
| ------------------------------- | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Owner**                       | Everything               | Full control, including managing users and presets.                                                                                                                     |
| **Admin — T\&A only**           | The whole organisation   | Runs time and attendance, including all shared setup. No payroll.                                                                                                       |
| **Admin — Full**                | The whole organisation   | The same, including payroll.                                                                                                                                            |
| **User — T\&A only (unscoped)** | The whole organisation   | Reads all time and attendance. Changes nothing.                                                                                                                         |
| **User — Full (unscoped)**      | The whole organisation   | Reads all time and attendance and payroll. Changes nothing.                                                                                                             |
| **User — T\&A only (scoped)**   | Chosen teams             | Changes their teams' clocks, leave, activity items, hour overrides, biometrics and WhatsApp. Reads shared setup.                                                        |
| **User — Full (scoped)**        | Chosen teams and payroll | The same, plus payroll and employee documents within their scope. See [Payroll Permissions](/fundamentals/users-and-employees/user-permissions/payroll-permissions.md). |

### Admin or User?

* **Admins change shared setup** — clock templates, activities, devices, custom metrics, teams and the rest. Because shared setup affects everyone, Admins always cover the whole organisation. Admins can read the list of users and presets, but only Owners manage them.
* **Users never change shared setup.** Without a scope, a User reads everything and changes nothing. **A scope is what lets a User write** — within that scope. Even a scoped User with **All** teams can only change employee data, never shared setup.

| Job                                                      | Preset                                         |
| -------------------------------------------------------- | ---------------------------------------------- |
| Controls who has access                                  | **Owner**                                      |
| Runs time and attendance, including shared setup         | **Admin — T\&A only**                          |
| Looks after their own team's time data                   | **User — T\&A only (scoped)**, with their team |
| Changes every employee's time data, but not shared setup | **User — T\&A only (scoped)**, with All teams  |
| Sees everything and changes nothing                      | **User — T\&A only (unscoped)**                |

Built-in presets can't be edited. If one is almost right, copy it — see [Building a custom preset](#building-a-custom-preset).

## Fixed Scope and Set per User

Every scope on a preset is one of four values: **All**, **None**, **Specific** or **Set per user**.

* **All, None or Specific — fixed on the preset.** Everyone linked to the preset gets exactly that scope. It's read-only on each user; to change it, you change the preset, and everyone on it changes together.
* **Set per user.** The preset doesn't decide. When someone is linked to it, you choose All, None or Specific for that person. Changing one user's scope affects nobody else.

{% hint style="info" %}
**Set per user is not None.** None means no access. Set per user means "choose for each person" — AllWage won't let you save a user until every Set per user scope has been chosen.
{% endhint %}

The scoped built-in presets use Set per user, so each team manager can have their own team. Fix the scope on a custom preset when everyone on it covers exactly the same records — for example, day, night and weekend supervisors for the same two teams. If a third team is added later, you change the preset once.

Once users are linked to a preset, you can't switch a scope between fixed and Set per user. Copy the preset, change the copy, and move the users onto it.

## Every User Is Linked to a Preset

There are no permission switches on individual users. The only thing that can differ between users on the same preset is scope, where the preset says Set per user.

**To change what one person can do:**

1. Copy the preset they're linked to. The copy starts with exactly the same access.
2. Change the copy.
3. Give it a name that describes the job, and a description.
4. Link the person to the new preset.

If someone else needs the same access later, link them to the same preset. This keeps every user's access named, described and easy to change in one place.

{% hint style="info" %}
Nobody can change their own preset or scope. Someone else who can manage users has to make the change.
{% endhint %}

## Building a Custom Preset

Only people with **Read / Write** on **Permission presets** can create, copy, edit or delete presets. By default, that's Owners.

### It stays linked to its base

Every custom preset starts from another preset — there's no blank preset. It stays linked to the built-in preset it was based on, and only stores **what you changed**. Everything else still comes from the base.

When AllWage adds a new feature, each built-in gets a sensible level for it, and your custom preset automatically picks up its base's level. Nobody has to update custom presets after each release.

### Build upward

Because a custom preset keeps following its base, **start from the built-in with the least access that fits, and raise specific permissions** — from No access to Read, or from Read to Read / Write. Avoid starting from a bigger preset and lowering permissions.

For example, if your accountant should see everything and change one or two things, start from a **User** preset and raise those one or two permissions. If you started from an **Admin** preset and lowered everything else, the accountant would get Admin-level access to every new feature AllWage adds.

### Create a preset

Presets are managed from the **preset picker**, which opens when you choose a user's preset while adding or editing a user. It has two tabs: **Built-In** and **Custom**.

1. Open the preset picker from **Add A User** or **Edit access** on the [Users](/fundamentals/users-and-employees/users.md) page.
2. Click **Add preset**, then choose the built-in preset to start from. Or click **Copy** on an existing preset to start from exactly its access.
3. Enter a **Preset name** and a **Description**. Name it after the job, not the person.
4. Work through each area — **Time & Attendance**, **Payroll**, **Document management** and **Administration**. In each area, set the scope first, then the permissions.
5. Click **Add Preset** (or **Copy Preset** if you copied one).

While you work:

* **Greyed-out choices** come with a short reason.
* **Changed rows are marked Custom**, alongside the base's default. **Reset** puts a row back.
* **Search permissions** finds a permission by name.
* The **Resolved access** panel shows what someone on the preset will and won't be able to do.

The Owner preset can't be copied. If you need something close to it, start from an Admin preset and raise what you need.

### Example: a team manager who also reads documents

1. Click **Add preset** and choose **User — T\&A only (scoped)** as the base.
2. Name it *Team Manager with Documents*, and add a description.
3. Leave Time & Attendance as it is. T\&A teams stays Set per user.
4. Under Document management, raise **Employee documents** from No access to **Read**.
5. Click **Add Preset**.

## Editing and Deleting Presets

### Edit a custom preset

Editing a custom preset changes **every user linked to it**.

1. In the preset picker, open the **Custom** tab.
2. Click **⋯** on the preset, then **Edit**.
3. Make your changes and click **Update Preset**.
4. AllWage shows how many users will be affected. Confirm to apply the change.

Each linked user has the new access from their next action in AllWage. Scopes that are **Set per user** keep each user's own value; a **fixed** scope changes for everyone.

Some edits are refused:

* **Edits that couldn't work for users already linked.** AllWage names the users affected, so you can sort them out first.
* **Widening a preset you're linked to.** An Owner has to make that change.

### Delete a custom preset

You can only delete a preset that **nobody is linked to**.

1. In the preset picker, open the **Custom** tab.
2. Click **⋯** on the preset, then **Delete**.
3. Confirm with **Delete preset**.

If users are still linked, AllWage lists them. Move each one to another preset first. Deleting can't be undone.

## Scoped Users and Shared Setup

Scoped built-in presets give **Read** on shared setup, because a scoped user only sees part of the organisation. A change to a clock template, for example, would reach teams they can't see.

Some setup belongs entirely to one scope rather than to everyone — most importantly a payroll company's own pay run settings, payslip settings and company settings. Whoever has that whole company can change them. See [Payroll Permissions](/fundamentals/users-and-employees/user-permissions/payroll-permissions.md#payroll-setup).

### Giving a scoped user Read / Write on shared setup

A custom scoped preset can have Read / Write on shared setup if a job genuinely needs it — for example, a senior manager who looks after three teams but is also responsible for all the organisation's clock templates. AllWage shows a reminder when you do this. Make it a deliberate choice, and build the preset upward from the scoped User preset.

### Teams

Managing teams — creating, renaming and deleting them — needs **T\&A teams set to All**.

* If a preset **fixes** teams to anything other than All, the editor won't allow Read / Write on Teams.
* If teams are **Set per user**, a user with specific teams only gets Read on Teams, and their access preview explains why.

This doesn't stop a scoped manager adding employees to their own teams or moving people between them. That's managing employees, not managing teams.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.allwage.com/fundamentals/users-and-employees/user-permissions/permission-presets.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.