A practical guide to what each user role can do in CHRIS.
Role Overview
CHRIS has three user roles plus a special team leader capability:
| Role | Purpose | Who Uses It |
|---|---|---|
| Employee | Basic access for all staff | All employees |
| Team Leader | Employee + team management | Managers with direct reports |
| HR Manager | Employee management | HR personnel |
| Admin | Full system control | IT/System administrators |
!!! note "Team Leader is not a role" Team Leader is a capability, not a separate role. An employee or HR manager becomes a team leader when assigned to lead a team.
Employee Role
The base role for all users. Every person in CHRIS has at least employee permissions.
What Employees Can Do
Dashboard & Profile
- View personal dashboard with leave balance
- Edit personal profile (photo, phone, emergency contact)
- View personal leave calendar
Leave Requests
- Submit new leave requests
- View personal leave history
- Cancel pending requests
- Attach documents to requests
- View leave balance and entitlements
Contracts
- View own employment contract
- Download contract documents
What Employees Cannot Do
- View other employees' profiles or requests
- Approve leave requests
- Access HR or admin settings
Team Leader Capability
Team leaders are employees who manage one or more teams. They have additional permissions for their team members.
How to Become a Team Leader
An employee becomes a team leader when:
- A team is created
- They are assigned as the team's leader
- Team members are added to the team
What Team Leaders Can Do
Everything an employee can do, plus:
Team Management
- View team members' profiles
- View team calendar showing availability
- See who is on leave and when
Leave Approval
- View leave requests from team members
- Approve or reject team member requests
- Add comments when approving/rejecting
Team Leader Scope
!!! important "Team leaders can only manage their own team(s)" A team leader cannot approve requests from other teams. If they lead multiple teams, they can approve requests from all their teams.
HR Manager Role
HR managers handle employee administration across the organization.
What HR Managers Can Do
Everything an employee can do, plus:
Employee Management
- View all employee profiles
- Edit any employee profile
- Create new employees
- Add HR notes to profiles
- Upload employee documents
Leave Management
- View all leave requests (across all teams)
- Approve or reject any leave request
- Submit leave on behalf of employees
- Revoke previously approved leave
- View leave statistics and reports
Team Management
- Create and edit teams
- Assign team members
- Set team leaders
Contract Management
- View all contracts
- Create new contracts
- Edit existing contracts
- Upload contract documents
Reporting
- View audit logs
- Generate leave reports
- View team analytics
What HR Managers Cannot Do
- Configure system settings (SMTP, company info)
- Manage leave types
- Manage holiday schemes
- Access translations
- Delete employees or teams
- Masquerade as other users
Admin Role
Administrators have complete system access. This role should be limited to trusted IT personnel.
What Admins Can Do
Everything HR managers can do, plus:
System Configuration
- Edit company settings (name, logo, address)
- Configure SMTP email settings
- Manage leave types
- Manage holiday schemes (by country/year)
- Edit translations
User Administration
- Delete employees
- Delete teams
- Reset user passwords
- Masquerade as any user (for troubleshooting)
Full Data Access
- View all audit logs
- Access all system data
- No restrictions on viewing or editing
Masquerade Feature
!!! warning "Admin-only feature" Masquerading allows an admin to view the system as another user. This is useful for troubleshooting but should be used responsibly.
To masquerade:
- Go to Employees
- Click on an employee
- Click View As button
- System now shows what that employee sees
- Click Exit Masquerade when done
All masquerade sessions are logged for security.
Role Comparison Chart
Data Access
| Data | Employee | Team Lead | HR Manager | Admin |
|---|---|---|---|---|
| Own profile | ✅ | ✅ | ✅ | ✅ |
| Team profiles | ❌ | ✅ | ✅ | ✅ |
| All profiles | ❌ | ❌ | ✅ | ✅ |
| Own leave | ✅ | ✅ | ✅ | ✅ |
| Team leave | ❌ | ✅ | ✅ | ✅ |
| All leave | ❌ | ❌ | ✅ | ✅ |
| Own contract | ✅ | ✅ | ✅ | ✅ |
| All contracts | ❌ | ❌ | ✅ | ✅ |
| Audit logs | ❌ | ❌ | ✅ | ✅ |
Actions
| Action | Employee | Team Lead | HR Manager | Admin |
|---|---|---|---|---|
| Submit leave | ✅ | ✅ | ✅ | ✅ |
| Approve leave | ❌ | ✅ (team) | ✅ | ✅ |
| Create employee | ❌ | ❌ | ✅ | ✅ |
| Delete employee | ❌ | ❌ | ❌ | ✅ |
| Create team | ❌ | ❌ | ✅ | ✅ |
| Edit settings | ❌ | ❌ | ❌ | ✅ |
| Masquerade | ❌ | ❌ | ❌ | ✅ |
Navigation by Role
What you see in the navigation depends on your role:
Employee Navigation
📊 Dashboard
📅 My Leave
👤 My Profile
Team Leader Navigation
📊 Dashboard
📅 My Leave
👥 My Team
👤 My Profile
HR Manager Navigation
📊 Dashboard
📅 Leave Requests
👥 Employees
🏢 Teams
📄 Contracts
📊 Reports
👤 My Profile
Admin Navigation
📊 Dashboard
📅 Leave Requests
👥 Employees
🏢 Teams
📄 Contracts
📊 Reports
⚙️ Settings
👤 My Profile
Best Practices
Assigning Roles
| Guideline | Reason |
|---|---|
| Start with Employee role | Principle of least privilege |
| Only HR staff need HR Manager | Limits sensitive data access |
| Limit Admin to 2-3 people | Reduces security risk |
| Assign Team Leader via teams | Automatic when leading a team |
Role Changes
If someone needs a different role:
- Employee → Team Leader: Assign them as team lead in Teams management
- Employee → HR Manager: Admin must change their role
- HR Manager → Admin: Admin must change their role
!!! tip "Role changes are logged" All role changes appear in the audit log for compliance tracking.
Common Questions
How do I know my role?
Check your profile or look at the navigation menu. If you see Settings, you're an Admin. If you see Employees, you're at least HR Manager.
Can someone have multiple roles?
No. Each user has one role. However, an employee or HR manager can also be a team leader (which adds permissions).
Can a Team Leader approve their own leave?
No. Team leaders cannot approve their own leave requests. Those go to HR or the team leader's manager.
What happens if a team has no leader?
Leave requests from that team go directly to HR managers for approval.