Users & Permissions

Overview

MeritHRMS separates who can sign in from what they can do:

Layer	Controls	Entry point
Login & seats	Account creation, password reset, suspension	Users & seats /system/users/seats
Organisation membership	Which legal entities and divisions a user accesses	Permissions — Section 1
Role permissions	Modules, sensitive payroll, workflow actions	Permissions — Section 2 + Access templates

Navigation: Shell sidebar → System administration

System access templates (shared catalogue)

System presets are seeded once for the platform (tenantId null, read-only). Every tenant can see and assign them without copying.

Template	Typical role
Employee self-service	Merit Me worker portal (ESS)
Attendance admin	Attend management, terminals
HR specialist	Talent, Leave, employee records
Payroll officer	Unrestricted ops preset (Owner-equivalent for day-to-day payroll; billing/transfer still Owner-gated)
Payroll preparer	Run and adjust payroll (SOX-style)
Payroll auditor	Read-only payroll and CPF reports
Finance officer	Pay reports, expense approval
Department head	Team leave approval, limited Talent
Executive GM	Cross-module read, executive dashboards

Permissions = template union minus deny overrides. Assign one or two closest templates, then fine-tune denies.

System preset vs tenant copy

Kind	Who can use it	Editable?	Scope
System preset	All tenants — assign directly on Permissions	No (Owner cannot edit/delete)	Shared catalogue
Tenant copy (Duplicate)	Only the tenant that created the copy	Yes — Role matrix / policy of that copy	Private to that tenant

• You do not need to duplicate a system template just to assign it. Duplicate only when this organisation needs a custom variant (different matrix ticks, name, or data scope).
• A copy is a snapshot of the source policy at duplicate time. Later platform updates to system presets do not rewrite existing tenant copies.
• Copies get slug suffix -copy (or -copy-2, …) and appear only in that tenant’s template list together with the shared system presets.

---

Step-by-Step Guide

Provision a new user (first-time login)

1. Sign in as Owner.
2. Switch to the target legal entity (top right).
3. Open System administration → Users & seats.
4. Select an unlinked employee or enter a new work email.
5. Set initial password (or link existing login).
6. Choose org role and operational hats if shown.
7. Click Provision.

Assign organisations (Section 1)

1. Open Permissions (/system/users/permissions).
2. Under Assign organisations, select the user by work email.
3. Check each legal entity they may access.
4. Optionally check divisions (branches / business units) per company.
5. Save — this controls which companies appear in the org switcher.

Assign access templates (Section 2)

1. On Permissions, open Assign access.
2. Click the user row in the membership table to switch active company context.
3. Stack access templates (checkboxes).
4. Apply deny overrides for sensitive areas if needed:
   • System administration
   • Sensitive payroll (salary, NRIC, CPF reports)
   • Payroll workflow (Calculate / Confirm / Mark paid)
5. Set division data scope where applicable.
6. Save.
7. Review Effective permissions preview at the bottom (Modules, Salary, CPF, Calc/Confirm/Pay).

Manage access templates (Role matrix)

1. Open Access templates / Role matrix (/system/users/templates or /admin/templates).
2. Review the shared system presets (all tenants can assign these).
3. To customise: Duplicate a preset → edit the tenant copy’s capability × action matrix (and name / data scope) → Save.
4. System presets themselves stay read-only; only tenant copies can be edited or deleted (Owner).
5. Assign templates to people on Permissions Section 2 (stack templates; matrix/menu is the projection of grants).

Suspend a user

1. Open Users & seats.
2. Locate the user and click Suspend.
3. Suspension freezes the global login across all companies.
4. To remove access from one company only, use Remove in Permissions Section 1 instead.

Bulk import (Excel)

1. On the Permissions page, use Excel import at the top (if enabled).
2. Download the template, fill user–company–template mappings.
3. Upload and review validation results.

---

FAQ

Q: What is the seat cap?
A: Subscription userLimit controls maximum provisioned users. Exceeding it returns SUBSCRIPTION_USER_CAP.

Q: Can HR access payroll without seeing salary figures?
A: Yes — use templates without sensitive payroll, or apply deny overrides for Salary/CPF.

Q: Must every user have an employee record?
A: Provisioned users should link to an employee profile in at least one organisation. Cross-org access does not require a local employee in every company.

Q: Who can save permission changes?
A: Typically Owners only. Admins may have read-only access depending on configuration.

Q: Are system Role matrix templates shared across all tenants?
A: Yes. System presets are a shared catalogue every tenant can select and assign. They are not tenant-owned and cannot be edited.

Q: What does Duplicate create?
A: A tenant-private copy of that template’s policy (Role matrix snapshot). Only the current tenant sees and can edit that copy. Other tenants are unaffected.

Q: Must I copy a system template before assigning it?
A: No. Assign system presets directly. Copy only when you need a custom role for this organisation.

Q: Where is the detailed permissions manual?
A: See repository docs USER_ACCESS_PERMISSIONS_MANUAL_EN.md / USER_ACCESS_PERMISSIONS_MANUAL_ZH.md for exhaustive field-level guidance.