Roles: what Administrators, Managers and Employees see

The three roles in Evenpay, what each can see and do, and the primary owner.

Written By Karl

Last updated 1 day ago

Evenpay has three fixed roles: Administrator, Manager and Employee. Access depends on the role, where it is granted and the person's permitted reporting relationships. In a multi-entity organisation, someone can hold different roles in different entities.

Role	In short
Administrator	Administrative access within the scope of the grant. A group administrator and an entity administrator do not have the same reach.
Manager	Reads permitted team data and works on team proposals. Reading a record does not automatically permit editing it.
Employee	Reads their own profile, compensation and reviews.

Administrators

Group administrators manage organisation-wide settings and employee data within their effective access. They set up the organisation, run analyses, manage pay, handle pay information requests and manage users, subject to the relevant feature and workflow requirements.

Entity administrators have administrative access within the entity and its subtree for entity-supported operations. An entity Administrator grant does not make someone a group administrator or unlock every group-wide setting and workflow. See Giving people access to entities.

Read access and edit access

This table summarises employee-record permissions for the standard roles. Administrative actions still require authority over the target record. A person with multiple grants may have a broader combined scope than one role suggests.

Task	Group administrator	Entity administrator	Manager	Employee
Read employee profiles and pay	Within effective group access.	Within granted entity reach; permitted reporting relationships can also apply.	Permitted reporting chain, managed units and own record.	Own record.
Edit employee profile fields	Within administrative scope.	Within administrative scope over the record.	Permitted fields of direct reports; not every employee they can read.	No general employee-record editing permission from this role.
Directly edit compensation records	Within administrative scope.	Within administrative scope over the record.	Not granted by the standard Manager role.	Not granted.
Change employee status, reporting line or email	Requires administrative profile-edit authority over the record's entity.	Requires administrative profile-edit authority over the record's entity.	Not granted by the standard Manager role.	Not granted.

Proposing a pay change in a merit worksheet is different from directly editing compensation. Assignment, access scope and approval-stage rules still apply. Nobody can create, submit, approve or reject a merit proposal about their own pay. See The approval flow.

Managers

A manager can read permitted employee data for:

their direct reports and employees further down their reporting line;
the organisation units they manage, including units below them;
their own linked employee record.

Their profile-edit permission is narrower: it covers permitted fields of direct reports, not everyone they can read. The standard Manager role does not grant direct compensation editing.

Their menus are renamed for their team: My Team, Team Positions and Worksheets. Managers without additional administrator grants don't see the administrator pages for Pay Equity, Merit Cycles, Pay Bands, Alerts or the Audit log. See What you can see and do as a manager.

Employees

Employees see Home, My Profile and Settings. The standard Employee role limits employee-record access to their own data. See What you can see in Evenpay.

Entities and reporting relationships

Entity grants reach the granted entity and its subtree. Permitted self-access and reporting-line access are evaluated separately, so an entity restriction does not necessarily remove access obtained through those relationships. An entity selector is not a way to grant extra access or a substitute for reviewing a person's combined permissions.

Use View Access and verify representative users before rollout, especially for cross-entity managers. Check both which records they can read and which actions they can perform.

The primary owner

One administrator is the Primary owner: Evenpay's main contact for contracts, billing and service notices. No other administrator can remove or demote them, and only they can hand the role over. See The primary owner.

Good to know

The three roles are fixed. You can't create custom roles. To see the role permissions, open Settings → Organization → Users & roles → Roles & Permissions. A role's permission list still needs to be considered together with its scope.
In organisations with several entities, someone can have a different role in each entity. See Giving people access to entities.
Group administrators change organisation roles under Settings → Organization → Users & roles. See Inviting, changing and removing users.

Was this helpful?

Still need help? Share an idea