This page is the reference grid: every permission a workspace role can hold. A new workspace starts with only the locked Workspace Admin role, which holds all of them; you build every other role from this list. Settings → Users & roles → Roles always shows your workspace's current roles. How roles work is explained in Roles and permissions.
Permission keys
Each module has view and act (act includes view; the Audit log has no act). Named permissions are never included by act.
| Module | Keys |
|---|---|
| Workforce Planning | planning.view, planning.act, planning.org_design |
| Functional Structure | structure.functional.view, structure.functional.act, structure.functional.select, structure.functional.jd_competencies, structure.functional.salary |
| Organizational Structure | structure.org.view, structure.org.act |
| Recruitment | recruitment.view, recruitment.act, recruitment.hiring.open, recruitment.offer.issue, recruitment.hire, recruitment.candidate.contact |
| Training | training.view, training.act |
| Development & Growth | development.view, development.act, development.evaluate |
| People | people.view, people.act, people.records.verify |
| Users & roles | users.view, users.act, users.invite |
| Settings & integrations | settings.view, settings.act, settings.integrations.manage, settings.aiprompts.manage |
| Audit log | audit.view, audit.export |
Most named permissions also open their module's View. Two don't: See candidate contact details (it changes what you see wherever candidates appear) and Edit a job description's competencies (a recruiting role can hold it while reading job descriptions through Recruitment view).
What each permission unlocks
Use this grid when you build a role. Workspace Admin holds every row, always, including permissions added later.
| Module | Permission | What it unlocks |
|---|---|---|
| Workforce Planning | View / Act | The planning platform, workload, unit requests, plan approval |
| Run org design studies | New-unit requests and structure assessments | |
| Functional Structure | View / Act | Job descriptions, competencies, positions as seats, pay scales |
| Change the selection | Adding and removing sub-sectors and job families. Removing an item deletes its job descriptions | |
| Edit JD competencies | A job description's competencies | |
| Edit pay scales and salaries | Pay scales and grades, and salaries in the position editor | |
| Organizational Structure | View / Act | Org units, the org chart, org import |
| Recruitment | View / Act | Openings, the hiring pipeline, interviews, referrals, offer and email templates. Recruitment view also lets a role read job descriptions and positions without Functional Structure access |
| Open / close hiring | Opening or closing hiring on a position | |
| Issue job offers | Sending an offer | |
| Hire candidates | The final hire step | |
| See candidate contact details | Unmasked email, phone and national ID wherever candidates appear | |
| Training | View / Act | Training positions and the trainer pipeline |
| Development & Growth | View / Act | Assessments, development plans, growth plans, team projects |
| Evaluate people | Reviewing assessments and setting individual growth plans | |
| People | View / Act | The people directory, profiles, credentials, people import |
| Verify credentials, override scores | Credential approval and skill score overrides | |
| Users & roles | View / Act | Members, invitations and roles; two-factor resets |
| Invite people and assign roles | Invitations and role changes, limited to roles within your own access | |
| Settings & integrations | View / Act | Workspace settings, hire settings, courses, work time |
| Manage integrations | The integrations pages | |
| Manage AI prompts | The AI prompts page | |
| Audit log | View | The Audit log and History panels |
| Export the audit log | CSV export |
A named permission under Settings & integrations is enough to open the settings index and the pages it covers, without Settings view.
For example roles (Talent Acquisition, Line Manager, Viewer and others) and what they might hold, see Roles and permissions. Workspaces created before roles became admin-built keep the roles they already have.
Data scope
My reporting line limits People and development plans to the holder's reporting tree: their own record plus direct and indirect reports, up to six levels deep, following each person's manager. Positions, candidates and the Functional Structure aren't limited. The holder's account must be linked to their person record; a role with this scope and no linked record sees no one.
Who receives notifications
Notifications go to whoever holds the matching permission, never to a fixed role:
- New referrals, CV screening results, new applications, interview re-proposal requests, a candidate deleting their account and completed hiring assessments: holders of Recruitment Act.
- Trainer CV screening and trainer stage moves: holders of Training Act.
- Other completed assessments and an employee changing their own target role: holders of Development & Growth Act across the workspace, plus line managers whose reporting line includes the person.
- A case study awaiting review: holders of Evaluate people across the workspace, plus line managers whose reporting line includes the person.
Super admins' hidden accounts and disabled members never receive notifications. The interviewer pickers offer Workspace Admins, roles with Recruitment view, and roles scoped to My reporting line.
Portal accounts
Employee, Candidate and Trainer aren't workspace roles. They use their own portals, see only their own data and can't hold workspace permissions.
What has no permission check
Public pages (the job board, apply forms, the candidate and trainer portals' sign-up) and each person's own self-service pages at /{slug}/me depend on who you are, not on a workspace role.
Auditing access
Every role change, assignment and invitation is in the Audit log, with the permissions added and removed.