Users & Permissions

Overview

MeritHRMS separates who can sign in from what they can do:

Layer	Controls	Entry point
Login & seats	Account creation, password reset, suspension	Users & seats /system/users/seats
Organisation membership	Which legal entities and divisions a user accesses	Permissions — Section 1
Role permissions	Modules, sensitive payroll, workflow actions	Permissions — Section 2 + Access templates

Navigation: Shell sidebar → System administration

Seven system access templates

Template	Typical role
Attendance admin	Attend management, terminals
HR specialist	Talent, Leave, employee records
Payroll preparer	Run and adjust payroll
Payroll auditor	Read-only payroll and CPF reports
Finance officer	Pay reports, expense approval
Department head	Team leave approval, limited Talent
Executive GM	Cross-module read, executive dashboards

Permissions = template union minus deny overrides. Assign one or two closest templates, then fine-tune denies.

---

Step-by-Step Guide

Provision a new user (first-time login)

1. Sign in as Owner.
2. Switch to the target legal entity (top right).
3. Open System administration → Users & seats.
4. Select an unlinked employee or enter a new work email.
5. Set initial password (or link existing login).
6. Choose org role and operational hats if shown.
7. Click Provision.

Assign organisations (Section 1)

1. Open Permissions (/system/users/permissions).
2. Under Assign organisations, select the user by work email.
3. Check each legal entity they may access.
4. Optionally check divisions (branches / business units) per company.
5. Save — this controls which companies appear in the org switcher.

Assign access templates (Section 2)

1. On Permissions, open Assign access.
2. Click the user row in the membership table to switch active company context.
3. Stack access templates (checkboxes).
4. Apply deny overrides for sensitive areas if needed:
   • System administration
   • Sensitive payroll (salary, NRIC, CPF reports)
   • Payroll workflow (Calculate / Confirm / Mark paid)
5. Set division data scope where applicable.
6. Save.
7. Review Effective permissions preview at the bottom (Modules, Salary, CPF, Calc/Confirm/Pay).

Manage access templates

1. Open Access templates (/system/users/templates).
2. Review or duplicate system templates.
3. Adjust module bundles for your organisation (Owner only).

Suspend a user

1. Open Users & seats.
2. Locate the user and click Suspend.
3. Suspension freezes the global login across all companies.
4. To remove access from one company only, use Remove in Permissions Section 1 instead.

Bulk import (Excel)

1. On the Permissions page, use Excel import at the top (if enabled).
2. Download the template, fill user–company–template mappings.
3. Upload and review validation results.

---

FAQ

Q: What is the seat cap?
A: Subscription userLimit controls maximum provisioned users. Exceeding it returns SUBSCRIPTION_USER_CAP.

Q: Can HR access payroll without seeing salary figures?
A: Yes — use templates without sensitive payroll, or apply deny overrides for Salary/CPF.

Q: Must every user have an employee record?
A: Provisioned users should link to an employee profile in at least one organisation. Cross-org access does not require a local employee in every company.

Q: Who can save permission changes?
A: Typically Owners only. Admins may have read-only access depending on configuration.

Q: Where is the detailed permissions manual?
A: See repository docs USER_ACCESS_PERMISSIONS_MANUAL_EN.md / USER_ACCESS_PERMISSIONS_MANUAL_ZH.md for exhaustive field-level guidance.