Access Overview

Who can do what?

A plain-English guide to the five roles in the Payroll Management System, what each one is allowed to do, and how the maker–checker workflow keeps sensitive changes safe. Designed to be readable in a single sitting — no tech background needed.

The five roles

Every person who logs in has exactly one of these five roles. The role decides which screens they see and which buttons are enabled.

★
Super Admin
Platform owner
All companies
  • Sees and does everything across every company on the platform.
  • Onboards new companies (multi-tenant — one platform, many businesses).
  • Final escalation for stuck approvals, locked accounts, or failed payroll runs.
  • Switches between specific companies or "All Companies" from the top bar.
✓
HR Manager
Approves and oversees
One company
  • Approves changes submitted by HR Executives — new hires, edits, exits, pay revisions.
  • Approves the monthly payroll run before it locks and bank file is generated.
  • Configures statutory rules (PF, ESI, Professional Tax, TDS).
  • Reviews the audit log.
  • Manages company profile.
Doesn't: directly add or edit employees. They approve what the HR Executive submits.
✎
HR Executive
Day-to-day data entry
One company
  • Onboards new employees, updates their details, files exits.
  • Sets up departments, designations, locations, cost centres.
  • Designs pay structures; manages loans, advances, insurance.
  • Records attendance, applies leaves, approves team's leaves.
  • Drafts the monthly payroll run and runs the calculation.
Catch: every important change waits in the approvals queue until the HR Manager OKs it.
₹
Finance
Money side of payroll
One company
  • Downloads the bank file (NEFT CSV) to disburse salaries.
  • Configures statutory tax rules (PF, ESI, PT, TDS).
  • Generates compliance files for EPFO, ESIC, P.Tax, and TDS filings.
  • Pulls salary advances from BWays ERP and pushes recoveries back.
  • Runs payroll reports across the company; reads attendance & leave data (no edits).
Doesn't: create employees, configure org structure, or approve HR changes.
👤
Employee
Self-service only
Own data only
  • Views own profile and employment history.
  • Applies for leave; sees own leave balance.
  • Sees own attendance record.
  • Downloads own payslip after a run is locked.
  • Updates their own TDS investment declaration.
  • Sees the company holiday list.
Never sees: anyone else's salary, attendance, or personal data.

How the approval flow works

Sensitive writes are protected by a maker–checker queue. Two people are always involved before a change goes live.

Maker–checker 2 people

The HR Executive proposes the change. The HR Manager (or Super Admin) reviews it in the approvals queue and clicks Approve or Reject. Only then does the database update.

HR Executive submits a new employee →
change waits in Approvals queue →
HR Manager clicks Approve →
employee record is created.

Payroll run lifecycle 7 stages

A payroll run starts as a draft, gets calculated, reviewed, approved, and then locked. The bank file and payslips are generated only at the end, so there's never a half-finished payout in flight.

DRAFT → COMPUTED → PENDING APPROVAL → APPROVED → LOCKED
(revertable; bank file + payslips emit only at LOCKED)

Multi-company isolation tenant-safe

The platform supports multiple companies in one database. Every record is tagged with a company ID. Users only ever see data from their own company — except the Super Admin, who can switch.

HR Manager of Acme tries to view a Globex employee → Access denied.
Super Admin can switch to "Globex" from the top bar and see them.

Capability matrix

What each role can do, by category. Hover any row to highlight it.

Action Super
Admin		 HR
Manager		 HR
Executive		 Finance Employee
People & Org
View employee directoryname, code, department, status ✓ ✓ ✓ read-only own profile
Add or edit an employeeonboard, update details, file exit ✓ approves submits — —
Upload / delete employee documentscontracts, IDs, certificates ✓ ✓ ✓ read-only own only
Set up departments, designations, locations, cost centres ✓ approves submits — —
Pay setup
Define pay componentsbasic, HRA, allowances, deductions ✓ approves submits — —
Build pay structures and assign to employees ✓ approves submits — —
Manage loans, advances, insurance ✓ approves submits — —
Leave & Attendance
Apply for own leave ✓ ✓ ✓ — ✓
Approve / reject team's leave ✓ ✓ ✓ — —
Configure leave types, holidays, shifts ✓ ✓ ✓ read-only read-only
Record / import attendancefrom biometric or CSV ✓ ✓ ✓ read-only own only
Lock attendance for the monthrequired before payroll runs ✓ ✓ ✓ — —
Payroll run (monthly cycle)
Draft a new payroll run ✓ approves ✓ — —
Compute the runcalls PF, ESI, PT, TDS calculators ✓ — ✓ — —
Submit run for approval ✓ — ✓ — —
Approve & lock the rungenerates payslips + bank file ✓ ✓ — — —
Revert a locked runused after a discovered error ✓ ✓ — — —
Download own payslip (PDF) ✓ ✓ ✓ ✓ ✓
Download bank file (NEFT CSV) for salary disbursement ✓ ✓ — ✓ —
Statutory Compliance
Configure PF / ESI / Professional Tax / TDS rules ✓ ✓ read-only ✓ —
Generate compliance filesEPFO ECR, ESIC, P.Tax, TDS ✓ ✓ — ✓ —
Submit own TDS investment declarationHRA, 80C, etc. ✓ ✓ ✓ ✓ ✓
Reports & Imports
Run pre-built reports42+ reports across HR, payroll, statutory ✓ company-wide ✓ company-wide payslip + salary cert
Upload data importsemployees, attendance, leave balances (CSV / XLSX) ✓ ✓ ✓ — —
Sync with BWays ERPpull advances, push recoveries ✓ — — ✓ —
Platform & Audit
View audit logwho-did-what trail ✓ ✓ — — —
Onboard a new companymulti-tenant ✓ — — — —
View other companies' data ✓ — — — —
Reset another user's password ✓ — — — —
✓ Can do directly approves Reviews and approves another role's submission submits Submits — change goes through approvals first read-only Can see but not edit own only Restricted to their own data — No access