Team and account
Roles and permissions
VooHr has administrator and manager roles with different employee-data access. Permissions are enforced by the server for protected routes; the exact controls depend on the operation.
Administrators #
An administrator can access the organization-scoped employee roster and administrator-only actions such as employee deletion and manager invitations. New email sign-up creates an administrator account. Administrative access can include sensitive employee and account information, so use it only for people who need it.
Some administrator flows require time-based two-factor authentication. Role checks are performed server-side and do not rely only on hiding a button in the page.
| Action | Administrator | Manager |
|---|---|---|
| Access employee roster | Organization-scoped roster. | Linked employee and direct reports. |
| Delete an employee | Allowed through the administrator-only endpoint. | Not allowed through the employee-delete endpoint. |
| Invite a manager | Administrator-only action. | Not an administrator action. |
Managers #
A manager's employee queries are scoped to their linked employee record and direct reports. A missing or malformed manager link fails closed rather than widening access to the whole organization. Managers can access permitted records for their scope but cannot permanently delete employees through the employee-delete endpoint.
A manager should not assume they can see all organization conversations or survey records. Access rules apply in the APIs as well as in the interface; the data returned depends on the endpoint's scope checks.
Check access before sharing #
Do not share account credentials to work around a role restriction. Ask an administrator to review the user's role and linked employee record if the expected team list is missing.
Specific legal or contractual access commitments are not established by the role code alone. [CONFIRM: customer-specific role and data-access policy]
Use this guidance thoughtfully
This page describes the current product workflow; it is not an HR policy or a promise about every deployment. Before acting on information about an employee, verify the source record, consider context the system cannot see, and use your organization's process. If a control behaves differently from this guide, check the current workspace UI and confirm the saved result rather than assuming an action completed.