Roles & permissions

Every person in a workspace has one company role: Admin, Manager, or Member. Your role decides which parts of the app you can see and use. KManagement checks what you are trying to do(for example, “create a framework”), not just your job title — so access stays consistent everywhere.

Every company starts with three built-in roles, and an admin can add custom roles for people who do not fit them — see Custom roles below.

The three roles at a glance

• Admin — full control of the workspace: people, billing, company settings, and integrations. An admin can also do everything a manager can.
• Manager — runs KPIs company-wide: build frameworks, assign them, enter and sync measurements, calculate results, review teams, and export reports. Managers cannot change company-wide settings or billing.
• Member— sees their own performance, comments, and responds to reviews. Members can see teammates’ results only when the company setting allows it (see Settings).

What each role can do

Custom roles

Open Settings → Roles (visible to anyone who may view roles). The table lists the built-in roles and your custom ones with how many people hold each. Choose New role, give it a name, tick the permissions it should carry, and save. Then pick it from the Rolemenu when you invite someone or change a person’s role.

• Permissions are grouped by area (people, payroll, approvals…). Each one has a short explanation. Ones marked Owner-level are the most sensitive (company identity, credentials, billing, payroll money, editing roles).
• A permission that belongs to a module your company has switched off is shown dimmed. You can still tick it; it takes effect when the module is switched on.
• The built-in roles are fixed and cannot be edited or deleted. A custom role cannot be deleted while someone — or a pending invitation — still has it; move them to another role first.
• A role’s page shows who currently holds it, so you can see who an edit affects. An edit takes effect on that person’s next action.

Examples

• HR operator — payroll (view, prepare) and the people directory, but not frameworks or billing. They see Payroll and Team in the menu and nothing else of the admin area.
• Appraisal council — view KPI results and decide result approvals. They can approve, but cannot open frameworks or change anything.
• Outside accountant — view-only access to payroll for an external provider. Create a read-only role for them and keep an eye on who holds it.

Guardrails

To keep a workspace safe, a few actions are always blocked:

• You can only give what you hold. You can assign a role, or put a permission in a role, only if you hold every permission yourself. That is why a manager cannot create an admin-level role or promote anyone to admin, and why editing a role never raises anyone above the person editing it.
• You cannot act on (change the role of, suspend) someone whose role carries permissions you do not hold.
• You cannot change your own role or suspend yourself.
• The company must always keep at least one active member who can manage roles and the company; the last such person cannot be removed, demoted or suspended.