Permission Presets

The seven built-in permission presets, how scope works on a preset, and how to build, edit and delete your own custom presets.

A permission preset is a named bundle of access. Every user is linked to exactly one preset, and it decides everything they can do. AllWage comes with seven built-in presets, and you can build your own for jobs that don't quite fit.

What this page covers:

• The seven built-in presets, and the rule behind them

• Fixed scope and Set per user

• Why every user is linked to a preset

• Building a custom preset — and why you should build upward

• Editing and deleting custom presets

• Scoped users and shared setup

Who this is for:

Owners and anyone who manages permission presets. Read User Permissions first if you're new to presets, permissions and scope.

The Built-in Presets

The built-in presets follow one rule:

You can change anything that belongs entirely inside your scope. Only Admins can change setup that's shared by the whole organisation.

Preset	Covers	What it's for
Owner	Everything	Full control, including managing users and presets.
Admin — T&A only	The whole organisation	Runs time and attendance, including all shared setup. No payroll.
Admin — Full	The whole organisation	The same, including payroll.
User — T&A only (unscoped)	The whole organisation	Reads all time and attendance. Changes nothing.
User — Full (unscoped)	The whole organisation	Reads all time and attendance and payroll. Changes nothing.
User — T&A only (scoped)	Chosen teams	Changes their teams' clocks, leave, activity items, hour overrides, biometrics and WhatsApp. Reads shared setup.
User — Full (scoped)	Chosen teams and payroll	The same, plus payroll and employee documents within their scope. See Payroll Permissions.

Admin or User?

• Admins change shared setup — clock templates, activities, devices, custom metrics, teams and the rest. Because shared setup affects everyone, Admins always cover the whole organisation. Admins can read the list of users and presets, but only Owners manage them.

• Users never change shared setup. Without a scope, a User reads everything and changes nothing. A scope is what lets a User write — within that scope. Even a scoped User with All teams can only change employee data, never shared setup.

Job	Preset
Controls who has access	Owner
Runs time and attendance, including shared setup	Admin — T&A only
Looks after their own team's time data	User — T&A only (scoped), with their team
Changes every employee's time data, but not shared setup	User — T&A only (scoped), with All teams
Sees everything and changes nothing	User — T&A only (unscoped)

Built-in presets can't be edited. If one is almost right, copy it — see Building a custom preset.

Fixed Scope and Set per User

Every scope on a preset is one of four values: All, None, Specific or Set per user.

• All, None or Specific — fixed on the preset. Everyone linked to the preset gets exactly that scope. It's read-only on each user; to change it, you change the preset, and everyone on it changes together.

• Set per user. The preset doesn't decide. When someone is linked to it, you choose All, None or Specific for that person. Changing one user's scope affects nobody else.

Set per user is not None. None means no access. Set per user means "choose for each person" — AllWage won't let you save a user until every Set per user scope has been chosen.

The scoped built-in presets use Set per user, so each team manager can have their own team. Fix the scope on a custom preset when everyone on it covers exactly the same records — for example, day, night and weekend supervisors for the same two teams. If a third team is added later, you change the preset once.

Once users are linked to a preset, you can't switch a scope between fixed and Set per user. Copy the preset, change the copy, and move the users onto it.

Every User Is Linked to a Preset

There are no permission switches on individual users. The only thing that can differ between users on the same preset is scope, where the preset says Set per user.

To change what one person can do:

1. Copy the preset they're linked to. The copy starts with exactly the same access.

2. Change the copy.

3. Give it a name that describes the job, and a description.

4. Link the person to the new preset.

If someone else needs the same access later, link them to the same preset. This keeps every user's access named, described and easy to change in one place.

Nobody can change their own preset or scope. Someone else who can manage users has to make the change.

Building a Custom Preset

Only people with Read / Write on Permission presets can create, copy, edit or delete presets. By default, that's Owners.

It stays linked to its base

Every custom preset starts from another preset — there's no blank preset. It stays linked to the built-in preset it was based on, and only stores what you changed. Everything else still comes from the base.

When AllWage adds a new feature, each built-in gets a sensible level for it, and your custom preset automatically picks up its base's level. Nobody has to update custom presets after each release.

Build upward

Because a custom preset keeps following its base, start from the built-in with the least access that fits, and raise specific permissions — from No access to Read, or from Read to Read / Write. Avoid starting from a bigger preset and lowering permissions.

For example, if your accountant should see everything and change one or two things, start from a User preset and raise those one or two permissions. If you started from an Admin preset and lowered everything else, the accountant would get Admin-level access to every new feature AllWage adds.

Create a preset

Presets are managed from the preset picker, which opens when you choose a user's preset while adding or editing a user. It has two tabs: Built-In and Custom.

1. Open the preset picker from Add A User or Edit access on the Users page.

2. Click Add preset, then choose the built-in preset to start from. Or click Copy on an existing preset to start from exactly its access.

3. Enter a Preset name and a Description. Name it after the job, not the person.

4. Work through each area — Time & Attendance, Payroll, Document management and Administration. In each area, set the scope first, then the permissions.

5. Click Add Preset (or Copy Preset if you copied one).

While you work:

• Greyed-out choices come with a short reason.

• Changed rows are marked Custom, alongside the base's default. Reset puts a row back.

• Search permissions finds a permission by name.

• The Resolved access panel shows what someone on the preset will and won't be able to do.

The Owner preset can't be copied. If you need something close to it, start from an Admin preset and raise what you need.

Example: a team manager who also reads documents

1. Click Add preset and choose User — T&A only (scoped) as the base.

2. Name it Team Manager with Documents, and add a description.

3. Leave Time & Attendance as it is. T&A teams stays Set per user.

4. Under Document management, raise Employee documents from No access to Read.

5. Click Add Preset.

Editing and Deleting Presets

Edit a custom preset

Editing a custom preset changes every user linked to it.

1. In the preset picker, open the Custom tab.

2. Click ⋯ on the preset, then Edit.

3. Make your changes and click Update Preset.

4. AllWage shows how many users will be affected. Confirm to apply the change.

Each linked user has the new access from their next action in AllWage. Scopes that are Set per user keep each user's own value; a fixed scope changes for everyone.

Some edits are refused:

• Edits that couldn't work for users already linked. AllWage names the users affected, so you can sort them out first.

• Widening a preset you're linked to. An Owner has to make that change.

Delete a custom preset

You can only delete a preset that nobody is linked to.

1. In the preset picker, open the Custom tab.

2. Click ⋯ on the preset, then Delete.

3. Confirm with Delete preset.

If users are still linked, AllWage lists them. Move each one to another preset first. Deleting can't be undone.

Scoped Users and Shared Setup

Scoped built-in presets give Read on shared setup, because a scoped user only sees part of the organisation. A change to a clock template, for example, would reach teams they can't see.

Some setup belongs entirely to one scope rather than to everyone — most importantly a payroll company's own pay run settings, payslip settings and company settings. Whoever has that whole company can change them. See Payroll Permissions.

Giving a scoped user Read / Write on shared setup

A custom scoped preset can have Read / Write on shared setup if a job genuinely needs it — for example, a senior manager who looks after three teams but is also responsible for all the organisation's clock templates. AllWage shows a reminder when you do this. Make it a deliberate choice, and build the preset upward from the scoped User preset.

Teams

Managing teams — creating, renaming and deleting them — needs T&A teams set to All.

• If a preset fixes teams to anything other than All, the editor won't allow Read / Write on Teams.

• If teams are Set per user, a user with specific teams only gets Read on Teams, and their access preview explains why.

This doesn't stop a scoped manager adding employees to their own teams or moving people between them. That's managing employees, not managing teams.