Roles and Permissions

Access Control for Your Organization

Sparko uses Role-Based Access Control (RBAC) to ensure that every employee has the right level of access to your HRIS data. With 13 global system roles plus fine-grained permissions, you can control exactly who can see and do what. You can also create custom roles tailored to your organization's specific needs.

Overview

What is RBAC?

Role-Based Access Control (RBAC) is a security system that restricts system access based on a person's role within your organization. Instead of managing permissions for each employee individually, you assign roles, and those roles come with predefined permissions.

Key Benefits

✅ Security - Control who can access sensitive data like compensation and payroll ✅ Compliance - Granular access controls, audit logging, and GDPR data-handling support ✅ Efficiency - Quick onboarding with predefined role templates ✅ Flexibility - Employees can have multiple roles (additive permissions) ✅ Audit Trail - All permission-sensitive actions are logged

Global System Roles vs Custom Roles

Sparko provides two types of roles:

Global System Roles

13 predefined roles shared across all Sparko companies
Managed centrally by the Sparko team
Cannot be edited by individual companies (read-only)
Provide standardized, best-practice permission sets
Automatically updated with new features and permissions
People: Super Admin, HR Admin, IT Admin, Manager, Employee, Contractor (for contractors and freelancers: their own profile, documents, onboarding tasks, equipment and learning; Sparko assigns it from the worker type)
Legal: Legal Admin, Compliance, Contract Manager, Legal Viewer
Books: Books Admin, Accountant, Books Viewer

Note: Older docs referenced 10 roles including C-suite titles (CEO, CTO, CFO, CHRO, CPO, CMO). As of May 2026, those org titles live exclusively on Employee.job_title and don't grant elevated access. To give a CEO full access, assign them the Super Admin role.

Company Custom Roles

Created by your company for specific organizational needs
Fully customizable - you control all permissions
Can be created from scratch OR by replicating a system role
Perfect for unique job functions or department-specific needs
Examples: "Sales Manager", "Customer Support Lead", "Data Analyst"

Global System Roles

Sparko provides 13 predefined global roles that cover most organizational needs. Need something more specific? Replicate any system role to a custom role and adjust the permissions (see Creating Custom Roles below).

1. Super Admin

Use Case: Full system access. Default role assigned to the first user of a new tenant.

Permissions: All permissions via the *.all.manage wildcard
Best Practice: Assign sparingly. New tenants get one Super Admin (the founder/admin who set up the company); additional grants should be deliberate.
Typical Users: Founders, system administrators, break-glass emergency access

2. HR Admin

Use Case: Day-to-day HR operations

Permissions: Full access to People, Performance, Recruiting, Onboarding, Time & Leave, Compensation, Career, and Engagement modules. Plus exclusive access to personal documents and PII (DOB, SSN, ethnicity, address, emergency contact).
Can Do:
- ✅ Manage all employee data
- ✅ View / upload / delete personal employee documents (HR-only by default)
- ✅ View sensitive PII (full DOB, SSN, ethnicity, etc.)
- ✅ Conduct performance reviews
- ✅ Accept or return goals that managers create from roadmap items (performance.okrs.approve)
- ✅ Manage recruiting pipeline
- ✅ Approve time-off requests
- ✅ Manage compensation bands and equity grants
- ✅ Manage roles and permissions (admin.roles.*, admin.permissions.view)
- ✅ View and export audit logs
Cannot Do:
- ❌ Manage integrations (IT Admin scope)
- ❌ Manage feature flags (IT Admin scope)
Typical Users: HR Managers, HR Business Partners, CHRO

3. IT Admin

Use Case: System administration and integrations

Permissions: All admin module permissions (admin.*) including integrations, feature flags, audit logs, and system settings. Basic employee directory view (no HR data by default).
Can Do:
- ✅ Configure integrations (Slack, Google, HRIS imports)
- ✅ Manage feature flags
- ✅ View and export audit logs
- ✅ Manage roles and permissions
- ✅ Manage system settings
Cannot Do:
- ❌ View HR data (no employee profile / compensation / performance access by default)
- ❌ View personal documents or PII
- ❌ Edit the public careers page (replicate IT Admin and add View Careers Page Builder and Edit and Publish the Careers Page to allow it)
Typical Users: IT Managers, DevOps Leads, Security Engineers

4. Manager

Use Case: Team management, automatically assigned by the org chart.

Permissions: Team-scoped permissions across People, Performance, Time & Leave, Compensation, Career, and Engagement.
Data Scope: Team subtree: direct reports plus indirect reports (reports of reports). Endpoints expose ?include_indirect=false for direct-only views.
Auto-assignment: When an employee gains their first direct report, the system grants them the Manager role automatically. When their last report is removed, the role is auto-revoked. Don't assign manually.
Can Do:
- ✅ View their org subtree's employees, performance reviews, 1:1 notes, PTO, timesheets, compensation
- ✅ Approve team time-off
- ✅ Conduct team performance reviews
Cannot Do:
- ❌ View other org subtrees
- ❌ View company-wide compensation
- ❌ View personal documents or PII (HR Admin only)
Typical Users: People Managers, Directors, VPs, CxOs (the role applies regardless of org-chart depth)

5. Employee

Use Case: Self-service baseline (auto-assigned to all employees)

Permissions: Self-service permissions for own profile, OKRs, performance, PTO, timesheets, bank details, and pay components.
Data Scope: Own only (self)
Can Do:
- ✅ View and edit own profile
- ✅ View own personal documents
- ✅ Submit time-off requests
- ✅ View and edit own bank details and pay components
- ✅ Update own skills and certifications
- ✅ Submit timesheets
Cannot Do:
- ❌ View other employees' personal data
- ❌ Approve requests
- ❌ Manage system settings
Typical Users: All employees (automatically assigned)

Multi-Role Support

Employees can have multiple roles, and permissions are additive (combined).

Common Multi-Role Examples

Example 1: HR Admin + Manager (the most common combination)

Scenario: HR Manager who also manages a team
Permissions: HR Admin permissions + Manager team-scoped permissions
Result: Can manage all HR operations AND manage their direct reports
Note: The Manager role is auto-assigned by the system once the employee has direct reports. You only need to manually grant HR Admin.

Example 2: IT Admin + Custom "Compliance" Role

Scenario: Security engineer who also reviews compliance reports
Permissions: IT Admin (integrations, feature flags, audit) + custom role granting *.reports.view_all
Result: Can manage system AND pull aggregate compliance reports without seeing individual records

Example 3: Custom "Legal" Role + Employee

Scenario: General Counsel needs document access but not full HR
Approach: Replicate HR Admin → custom "Legal" role, then strip out the HR-operational permissions (recruiting, performance, etc.) and keep documents.personal.view_all
Result: Can view personal documents company-wide for legal holds without seeing performance reviews or compensation

Data Scopes

Permissions can have different data scopes that control what data users can access:

Scope	Description	Example
all	All employees in the company	HR Admin viewing all employee data
team	Direct reports only	Manager viewing their team's PTO balances
own	Self only	Employee viewing their own bank details

How Data Scopes Work

When you assign a role with a scoped permission, the system automatically filters data:

HR Admin with people.employees.view_all → Sees ALL employees
Manager with people.employees.view_team → Sees ONLY direct reports
Employee with people.employees.view_own → Sees ONLY themselves

Sensitive Permissions

Some permissions are marked as sensitive and require extra scrutiny:

Highly Sensitive (Payroll/Compensation)

❗ compensation.employee.view_all - View all employee compensation
❗ compensation.payroll_run.run - Run a payroll extract (pay + bank files)
❗ people.bank_accounts.view_all - View all employee bank details
❗ compensation.equity.grant - Grant equity to employees

Best Practices

Limit access: Only assign to trusted roles (HR Admin, Super Admin)
Audit regularly: Review who has these permissions quarterly
Enable MFA: Require multi-factor authentication for these roles
Monitor usage: All sensitive actions are logged in audit trail

Assigning Roles

How to Assign Roles (Admin Guide)

Open Workspace settings > Roles and access.
Find the role under System roles or Custom roles.
Click its people count to open the members drawer.
Click Assign people, find the person and select them.
Choose Where the role applies, then click Save.

The Manager role is assigned automatically when a person has direct reports; do not assign it manually. You can grant only permissions you already hold, within the scope you are allowed to manage.

Role Assignment Best Practices

✅ Principle of Least Privilege: Give users the minimum permissions needed ✅ Review Quarterly: Audit role assignments every 3 months ✅ Offboarding: Remove all roles immediately when employees leave ✅ Onboarding: Start with Employee role, add others as needed ✅ Multi-Role: Combine roles when users have multiple responsibilities

❌ Don't over-assign: Avoid giving Super Admin to everyone ❌ Don't forget to remove: Update roles when responsibilities change ❌ Don't bypass scopes: Use proper roles instead of granting exceptions

Permission Reference

Module Permissions

Permissions are organized by module:

Module	Sample Permissions	Count
People	`people.employees.view_all`, `people.employees.create`, `people.departments.manage`	41
Recruiting	`recruiting.jobs.create`, `recruiting.applications.view_all`, `recruiting.offers.approve`	39
Performance	`performance.reviews.create`, `performance.okrs.create`, `performance.feedback.give`	59
Time and Leave	`time_leave.requests.approve`, `time_leave.timesheets.view_all`, `time_leave.holidays.manage`	44
Compensation	`compensation.bands.view`, `compensation.employee.edit`, `compensation.payroll_run.run`, `compensation.equity.grant`	65
Career	`career.skills.manage`, `career.certifications.verify`, `career.framework.manage`	41

Total: permissions span all core modules

Common Permission Patterns

Pattern	Example	Description
`*.view_all`	`people.employees.view_all`	View all records (scope: all)
`*.view_team`	`time_leave.requests.view_team`	View team records (scope: team)
`*.view_own`	`compensation.employee.view_own`	View own record (scope: own)
`*.create`	`recruiting.jobs.create`	Create new records
`*.edit`	`people.employees.edit`	Edit existing records
`*.delete`	`recruiting.jobs.delete`	Delete records
`*.approve`	`time_leave.requests.approve`	Approve requests/workflows
`*.submit`	`time_leave.timesheets.submit`	Submit items for approval

Onboarding and equipment permissions

Permission	Code	Who holds it by default	What it allows
Approve Onboarding Plans	`onboarding.plans.approve`	Manager, HR Admin, Super Admin	Review and start a direct report's generated plan, pick their buddy and write their welcome note
View All Equipment	`people.equipment.view_all`	IT Admin, HR Admin, Super Admin	Open People > Equipment and every item
View Team Equipment	`people.equipment.view_team`	Manager	See the items of people in their team, on their profiles
View Own Equipment	`people.equipment.view_own`	Employee	See their own items, including before their first day
Manage Equipment	`people.equipment.manage`	IT Admin, HR Admin, Super Admin	Order, assign, take back and report items lost, see purchase cost, and tick IT tasks on onboarding plans

IT Admin has no onboarding plan access: IT completes its tasks from the Equipment page.

Security and Compliance

Audit Logging

All permission-sensitive actions are logged:

✅ Who performed the action
✅ What action was performed
✅ When it happened (timestamp)
✅ What data was accessed/modified
✅ IP address and user agent

Compliance Features

Access controls:

Access controls enforced at API level
Audit trails for all sensitive operations
Role-based segregation of duties

GDPR:

Employee data access tracked
PII encryption at rest
Right to access (employees can view own data)

Creating Custom Roles

Need a role that doesn't exist in the global system roles? You can create custom roles tailored to your organization's unique needs.

Option 1: Replicate a System Role

Start with a proven template and customize it for your needs.

When to use this:

You like most of a system role's permissions but need modifications
You want a starting point based on best practices
You need a role similar to an existing one but with some changes

How to replicate:

Open Workspace settings > Roles & Access. The roles are in a table (Role, Type, Members, Permissions). Use the System roles and Custom roles tabs to switch between them.
Click Replicate role in the page header, or click the system role you want to copy (for example "HR Admin") and click Replicate role at the bottom of its drawer.
Choose the Source role and give your custom role a unique New role name (for example "Senior HR Administrator").
Click Replicate.
The new role appears under Custom roles with all permissions copied. Click it to open its drawer.
Turn permissions on or off. They are grouped by module; click a module to open it. Each switch saves as you click it.

Example use cases:

Copy "Manager" → Create "Senior Manager" with additional reporting permissions
Copy "HR Admin" → Create "HR Coordinator" with limited permissions
Copy "Employee" → Create "Remote Employee" with specific remote work permissions

Option 2: Create from Scratch

Build a role with exactly the permissions you need, starting from zero.

When to use this:

You need a highly specialized role unlike any system role
You want maximum control over every permission
You're creating a role for a unique department or function

How to create from scratch:

Open Workspace settings > Roles & Access.
Click Create role in the page header.
Enter the role details:
- Role name: for example "Customer Success Manager"
- Description (optional): what this role is for
Click Create role. The new role starts with no permissions.
Click the new role in the table to open its drawer.
Open each module and turn on the permissions you need. Search this role's permissions finds one by name or code.
Click the people count in the drawer to open its members, then Assign people to give the role to employees.

Permission categories:

View permissions: See data (e.g., "View all employees")
Create permissions: Add new records (e.g., "Create job postings")
Edit permissions: Modify existing data (e.g., "Edit employee profiles")
Delete permissions: Remove records (e.g., "Delete candidates")
Approve permissions: Approve requests (e.g., "Approve time-off")

Managing Custom Roles

Find a role: the search box on Roles & Access looks at role names and at permissions, so you can find every role that holds a permission. Filter narrows the list further, and its count shows how many filters are on.

Edit permissions:

Go to Workspace settings > Roles & Access and open your custom role under Custom roles.
Open a module and switch permissions on or off. Each module shows how many are granted, for example "4 of 12 granted".
Click Done. System roles show On and Off and cannot be changed.

See who holds a role: click the people count in the table, or in the role's drawer. The members drawer lists everyone who holds it, with Assign people to add more and a remove button beside each person. The Manager role is given to managers automatically and cannot be assigned by hand.

Delete a custom role:

Open the role from Custom roles.
Click Delete role at the bottom of the drawer.
Confirm deletion (employees assigned to this role will lose those permissions)

⚠️ Important:

You cannot edit global system roles - only view them
With Manage Roles, you can delete custom roles belonging to your company, including ones another administrator created
Deleting a custom role removes it from all employees who have it
Always test custom roles with a test user before wide deployment

Custom Role Best Practices

✅ Name clearly: Use descriptive names that indicate the role's function ✅ Start minimal: Grant minimum permissions needed, add more later if needed ✅ Document purpose: Add clear descriptions explaining when to use the role ✅ Review regularly: Audit custom roles quarterly to ensure they're still needed ✅ Test first: Assign to yourself or a test user before rolling out company-wide ✅ Keep it simple: Don't create too many custom roles - use multi-role assignment instead

Roles for the whole workspace or one entity

When your company has two or more entities, a role can cover the whole workspace or one entity.

Whole workspace. The role covers everyone in the company. We call this a group role.
One entity. The role covers only the people in that entity. Someone who holds HR Admin for one entity sees, approves and acts on that entity's people only.

Giving a role for one entity

Open Roles and access and pick the role.
Press Assign people.
Choose the person, then set Where to the entity.
Press Save.

The role's Assigned list groups people by where the role applies: Whole workspace, or the entity's name.

Roles that always cover the whole workspace. Employee, Manager, any role with full admin access and the Legal roles. For these, Sparko says "This role always covers the whole workspace."

Who can give what. You can give only permissions you hold yourself. Someone whose role covers one entity can give roles only for that entity, and only to that entity's people.

Managers and their reports. A manager always sees and approves their own reports, in every entity. Entity roles never change reporting lines.

People with no entity. Only group roles see people who have no entity.

Plans. Roles for one entity are on Growth and above. On Core every role covers the whole workspace, and Where shows Whole workspace with the line "Give a role for one entity on Growth."

After a downgrade. Roles given for one entity show Paused. They keep covering their entity only. You can remove them, but you cannot give new ones.

Permissions for client work and payroll

These permissions cover clients, assignments, advances and payroll rules. HR Admin and Super Admin hold all of them. Managers hold View Team Assignments. Every employee holds View Own Assignments and View Own Advances and Loans.

Permission	What it allows
View Clients	See your clients
Manage Clients	Add and edit clients
View Client Projects	See client projects
Manage Client Projects	Add and edit client projects, their pay cycle and who approves hours
View All Assignments	See every worker's assignments
View Team Assignments	See your reports' assignments
View Own Assignments	See your own assignments
Manage Assignments and Rates	Add assignments and change bill and pay rates
View All Advances and Loans	See every worker's advances and loans
View Own Advances and Loans	See your own advances and loans
Manage Advances and Loans	Issue, pause and adjust advances and loans
Manage Pay Groups	Add and edit pay groups
View Payroll Rules	See the payroll rules for each country
Manage Payroll Rules	Edit, end, revert and verify payroll rules
Export Billable Hours	Download approved billable hours per client

A pay rate is shown only to people who may see that worker's pay.

Troubleshooting

Common Issues

Q: Employee says they can't access a feature

Check: Verify they have the correct role assigned
Check: Verify the role has the required permission
Check: Check if it's a team-scoped permission and they're viewing the right data

Q: Manager can't see team member's data

Check: Verify they have "Manager" role assigned
Check: Verify the team member reports to them (manager_id set correctly)
Check: Verify they're looking at team-scoped data, not all-company data

Q: How do I give someone access to everything?

Answer: Assign "Super Admin" role (but use sparingly - this is emergency access only)

Q: Can I customize roles or create new ones?

Answer: Yes! You can create custom roles in two ways:
1. Start from scratch: Create a blank role and add specific permissions
2. Replicate a system role: Copy a global role as a template and customize it
See: "Creating Custom Roles" section below for step-by-step instructions

Best Practices Summary

✅ Start Minimal: Begin with Employee role, add others as needed ✅ Use Multi-Role: Combine roles instead of creating exceptions ✅ Audit Quarterly: Review role assignments every 3 months ✅ Enable MFA: Require MFA for sensitive roles (HR Admin, Super Admin) ✅ Monitor Logs: Review audit logs for suspicious activity ✅ Document Changes: Keep a record of why roles were assigned ✅ Test Access: Verify new employees have correct access ✅ Offboard Promptly: Remove roles immediately when employees leave

Need Help?

Email: [email protected]
Documentation: https://sparko.app/docs
Status: https://status.sparko.app

Applies To: All Sparko customers Feature Tier: Roles and permissions are on every plan. Core includes 2 custom roles; Growth and above are unlimited. Assignment rules and delegations are Business and Custom (FEATURES_AND_PRICING rows "Custom roles" and the advanced_rbac note).

Still need help? Reach us at [email protected].

← Back to Help Center