Check the permissions attached to a company role and understand why a screen or action is available.

Inspect your company roles

Open Company Settings / Roles & Permissions (/permissions). Access requires manage_role. The page lists company roles and a searchable Role × Permission Matrix loaded from the server.

This page is read-only. It does not create roles, edit grants, or assign users. Use the account controls on an employee profile to choose a role while creating an account. You can change a member's role later on Company Settings / Users (/users), which needs manage_users and manage_role. See Company Setup & User Management for account setup.

Default roles

New companies receive these nine role definitions. The matrix shows your company's actual grants; role names are display labels and may differ from the defaults.

Role	Default focus
Admin	All tenant permissions; excludes platform-only administration
HR Manager	Employee management, payroll, leave, attendance, recruiting, performance, benefits, expenses and compliance
Finance Manager	Payroll, compensation, benefits, expenses, salary advances, compliance and integrations; employee records are read-only
Department Manager	Team operations, including employee, leave, attendance, scheduling, performance and expense management
Recruiter	Recruiting management and access to supporting records
Compliance Officer	Compliance and document management, audit access and company-wide performance visibility
Read-only Reviewer	Read-only access for accountants and auditors, including partner firms
Hiring Panel	Reviews candidates for the jobs whose hiring team they are on, and nothing else. For outside consultants and panel members: add them to a job's hiring team as a Reviewer to let them rate candidates and give interview feedback there
Employee	Own profile and payslips, leave requests, clocking, shifts, reviews, benefits, expenses, documents and published policies

Access is determined by grants and record scope, not a role's name. A tenant Admin is different from a platform administrator: platform access is an account-level flag used for Arche's operator surfaces.

Read, manage, and self-service permissions

Names describe an action and resource, such as view_employees, manage_employees, or view_own_payslip. They are separate grants; do not assume every manage_ grant includes every read or approval action.

Useful distinctions:

manage_payroll and approve_payroll are separate payroll permissions.
manage_leave enables leave operations, including crediting compensatory leave; manage_leave_config controls policy configuration.
Taking your own approved overtime as leave uses clock_in_out, the same permission as clocking in. Undoing someone else's needs both manage_leave and manage_attendance; nobody can take overtime as leave for someone else.
manage_attendance and manage_attendance_config separate attendance operations from configuration.
manage_salary_advance and disburse_salary_advance separate approval from payment.
manage_expenses provides scoped expense approval; approve_all_expenses adds company-wide approval authority.
view_performance does not itself grant company-wide visibility. That requires view_all_performance or platform-admin access.
The view_all_* family sets how far a person's reach goes: view_all_employees, view_all_leave, view_all_attendance, view_all_schedule, view_all_expenses, view_all_salary_advances, view_all_documents, view_all_payroll, view_all_compensation, view_all_recruiting and view_all_performance. With the one for an area, you reach the whole company in that area. Without it, you reach your own team; in recruiting you reach the postings whose hiring team you are on, until your end date. A manage_ permission never gives company-wide reach by itself.
manage_org_structure controls departments, teams and reporting lines, because they decide who counts as someone's team.
view_users and manage_users cover the Users page and company logins, and manage_role covers the Roles & Permissions page and the role selector on the Users page. manage_partner_access covers inviting and removing partner firms.
view_documents, view_benefits, and view_expenses are also used by Employee self-service. A view_ prefix does not universally mean access to everybody's records.

Why a page or action is unavailable

Check these separately:

Current company. Your company selection determines which membership and records you are using.
Licensed module. Feature access also depends on the company's module licence.
Permission. Inspect the relevant grant in the role matrix.
Record scope and state. An approver may need to be assigned to the current step; a manager's reach is their team, meaning people below them in the reporting chain and members of departments they head; completed records may reject edits.

The UI filters navigation and actions. The backend checks permissions and any applicable ownership, team, and lifecycle conditions again when a request is made. A visible button does not bypass those checks.

Web and mobile use shared permission names, but their available screens and controls differ. Use each surface's actual navigation rather than assuming every web action has a mobile equivalent.