Roles and access rights
Vasco's access rights distinguish Staff, Foreman, full-access Admin, and limited Admin. Special Admin access is configured together with the Vasco team so each person only sees the modules they need.
Staff only access their own activity and data; a Foreman gets extra access to the related crew; an Admin can be full-access or limited per module. To create or change a special Admin role, send the Vasco team the list of users and modules.
Before you start
Have this ready
- Make a list of user names and their work responsibilities.
- Decide the minimum permissions within the subscribed modules, for example reading attendance, checking pay, recording cash advances, or changing Settings.
- Make sure there is one Owner/main Admin who keeps full access.
Done when
- Each user signs in with the right type of account.
- Sensitive access such as payroll and Settings is held only by authorized people.
- Access changes have a clear decision owner and a clear way to revoke them.
A practical role matrix
| Role | Main access | Not for |
|---|---|---|
| Staff | Their own schedule, own attendance, leave/cash advance requests, own pay and payslips | Viewing other staff's data or changing payroll |
| Foreman | All Staff access plus crew attendance on the related assignments/projects | Managing the whole company or viewing pay without other permissions |
| Limited Admin | The approved modules, for example Staff & Attendance or Cash advances | Modules not granted; menus may be hidden or denied |
| Full-access Admin | The modules included in the company's subscription | Sharing among several people |
| Owner | Full access and company policy decisions | Delegating the account/password to others |
The principle of least access
Grant access based on today's work, not possible future needs. Access can be added later; a leak of payroll or Settings data is much harder to recover from.
Plan access before onboarding
- 1
Group responsibilities
List who manages staff, attendance, schedules, leave, payroll, cash advances, and Settings.
Result: Access needs are shown per task, not just by job title. - 2
Separate the preparer from the reviewer
If your team allows it, keep the person who prepares the data separate from the person who reviews or approves payroll.
Result: Mistakes are easier to catch before the status becomes final. - 3
Send the role requirements to Vasco
Provide the user's name, the Admin account email, the modules they may access, and the access start date.
Result: The Vasco team can set up or adjust custom roles in a controlled way.To cancel / undo: If the request hasn't been applied yet, send a written correction. If it has already been applied, ask for a new change and don't delete the role yourself without moving the user first. - 4
Test with that account
Ask the user to sign in and open the menus they need. Also test that sensitive modules they weren't given really can't be accessed.
Result: Access is verified from the user's side, not just from the configuration list.
Change or revoke access safely
- Record the user's name, current access, new access, reason, and effective time.
- Make sure the user has no payroll, approvals, or uploads in progress.
- For a custom Admin, ask the Vasco team to move the user to the new role before the old role is deleted.
- For staff who leave, Archive the profile and reset the Staff code if there is a risk that others still know the code.
- After the change, test again from the affected account, and ask the user to sign out and back in if the old menus are still visible.
Don't delete a role that is still in use
Deleting a role configuration without moving its users can lead to unexpected access, including falling back to broader access in some configurations. Coordinate Admin role changes with the Vasco team.
Tell Admin accounts and Staff codes apart
| Situation | Action |
|---|---|
| Admin forgot their password | Use Forgot password on the Admin tab and follow the link in the email |
| Staff member forgot their code | An Admin opens the staff details and copies the active code |
| Staff code may have leaked | Reset the code; share the new code privately |
| Admin leaves the company | Revoke or change the Admin's access and make sure another company account still has full access |
| Lost phone | Staff: reset the code. Admin: change the password and review the account's access |
One person, one credential
Shared accounts or codes make the activity trail untrustworthy. Don't use a single Admin account for the whole team.
Questions and answers
Can an admin create custom roles on their own?
Custom Admin role configuration is currently coordinated with the Vasco team. Send the list of users and the minimum modules they need.
Does a Foreman automatically see the team's payroll?
No. The Foreman status is meant for supervising the attendance of the related crew, not for full payroll access.
Why is a menu hidden but the user still needs testing?
Hiding menus helps the user experience, but access must be verified from the account itself. Test that sensitive actions are also refused, not just that the menu is hidden.
What should you do when an Admin resigns?
Schedule the access revocation, make sure another full Owner/Admin exists, reassign the open processes, then verify that the old account can no longer access company modules.