Permission Management

General For All Users Role Permissions
Last updated: January 26, 2026 β€’ Version: 2.0
Table of Contents

Permission Management

Learn how to configure and manage permissions for different roles in your organization using MangoApps, ensuring users have appropriate access to features while maintaining security and data integrity.

Overview

The Permission Management system in MangoApps provides granular control over what actions users can perform and what data they can access. As an administrator, you can define permissions for different roles, ensuring each user has access to exactly what they needβ€”no more, no less. This article explains how to configure and maintain permissions across your organization.

Understanding the Permission System

MangoApps uses a Role-Based Access Control (RBAC) system where:

  1. Permissions are assigned to Roles (not directly to users)
  2. Users are assigned to Roles (which grants them the role’s permissions)
  3. System Modules control feature availability at the business level
  4. Navigation visibility is automatically controlled by permissions

The Three Factors of Access

Access to any feature requires all three conditions to be met:

graph TD A[User Requests Access] --> B{Role Level?} B -->|Manager or Above| C{System Module Enabled?} B -->|Member| D[Limited Self-Service Access] C -->|No| E[Access Denied] C -->|Yes| F{Has Permission?} F -->|Yes| G[Access Granted] F -->|No| E

Role Hierarchy and Permissions

Default Roles

MangoApps includes four Default Roles with preset permissions:

Role Level Permissions
Super Admin 1 All permissions (cannot be modified)
Administrator 2 Organization settings, user management, all operational features
Manager 3 Team operations, analytics, performance scores, EPMS features
Member 4 Self-service: own shifts, attendance, timesheets, profile

Custom Role Permissions

Custom roles can be assigned any combination of permissions, allowing you to create roles like:

  • Supervisor: Scheduling view + attendance manage
  • HR Coordinator: Users view + leave requests manage
  • Compliance Officer: Compliance manage only

Accessing Permission Management

To manage permissions:

  1. Log in with an Administrator account
  2. Navigate to Administration β†’ Roles & Permissions
  3. Find the role you want to configure
  4. Click the dropdown menu and select Manage Permissions

Configuring Role Permissions

Permission Categories

Permissions are organized by feature area:

Core Operations

Feature View Manage
Shifts See schedules and assignments Create, edit, delete shifts
Attendance View attendance records Manage exceptions, approve records
Timesheets View timesheet data Approve, edit timesheets
Leave Requests View leave requests Approve/deny requests

People Management

Feature View Manage
Users See user profiles Create, edit user accounts
Certifications View certifications Manage certifications

Analytics & Intelligence

Feature View Manage
Workforce Intelligence View dashboards β€”
Performance Scores View scores β€”
Analytics Access reports β€”

Administration

Feature View Manage
Compliance β€” Configure labor compliance
Organization Settings β€” Business configuration
System Configurations β€” System-wide settings
Settings β€” Business SuperAdmin features

Setting Permissions

For each feature:

  1. View Permission: Toggle ON to allow viewing data in this area
  2. Manage Permission: Toggle ON to allow creating, editing, and deleting

Note: Manage permission typically includes View permission automatically.

How Permissions Control Navigation

The permission system directly controls what appears in the sidebar:

The can_access Check

Each menu item uses a permission check like:

can_access('shifts', 'manage')     β†’ Shows Shift Scheduler
can_access('attendance', 'manage') β†’ Shows Attendance Tracker
can_access('compliance', 'manage') β†’ Shows Labor Compliance section

If the check fails, the menu item is hidden from the user.

Example: Manager Permissions

A Manager with default permissions sees:

Section Items Visible Why
Team Operations Shift Scheduler, Attendance Tracker, Timesheet Manager Has manage permissions
Insights & Analytics All analytics dashboards Has view permissions
Workforce Intelligence Performance Scores Has view permission
Administration ❌ Hidden No system_configurations permission
Organization Settings ❌ Hidden No organization_settings permission

See Understanding Navigation Visibility for complete details.

Location-Based Permission Scoping

Permissions are automatically scoped by location assignments:

  1. Users can only access data for their assigned locations
  2. Managers see data for their locations and subordinate locations
  3. Administrators see data for all locations in the business
  4. Super Admins have unrestricted access

Managing Default Role Permissions

Super Admin

  • Has all permissions automatically
  • Permissions cannot be modified
  • Use sparingly (2-3 users recommended)

Administrator

Default permissions include:

  • All organization settings
  • All user management
  • All operational features
  • All analytics

Manager

Default permissions include:

  • Team operations (shifts, attendance, timesheets)
  • Analytics and reporting
  • Performance scores
  • EPMS features (reviews, goals, feedback)

Note: Managers do NOT have default access to:

  • Organization Settings
  • System Configurations
  • Integrations

Member

Default permissions include:

  • View and manage own profile
  • View own shifts and schedule
  • Submit own attendance
  • View own timesheets
  • Request time off

Best Practices

Permission Design

  1. Start with Default Roles: Use built-in roles before creating custom ones
  2. Follow Least Privilege: Grant only necessary permissions
  3. Group Related Permissions: If a role needs shifts, they likely need attendance too
  4. Consider Workflow: Think through what users need to complete their tasks

Security

  1. Limit Super Admins: Keep to 2-3 trusted users
  2. Regular Audits: Review permissions quarterly
  3. Document Changes: Keep records of permission modifications
  4. Test New Roles: Verify permissions work before wide deployment

Maintenance

  1. Review on Role Changes: When job responsibilities change, update permissions
  2. Offboarding: Remove elevated permissions when users leave roles
  3. Periodic Review: Ensure permissions still match business needs

Troubleshooting Permission Issues

User Can’t Access a Feature

  1. Check their Role: What organizational role are they assigned?
  2. Check Role Permissions: Does their role have the permission enabled?
  3. Check System Module: Is the feature’s module enabled for the business?
  4. Check Location: Are they assigned to the relevant location?

User Sees Too Much

  1. Review Role Permissions: Remove unnecessary permissions from their role
  2. Consider Custom Role: Create a more restricted custom role
  3. Check for Multiple Roles: User may have permissions from multiple sources

Permission Change Not Working

  1. User May Need to Refresh: Some changes require page reload
  2. Check Save: Ensure changes were saved successfully
  3. Clear Cache: Have user clear browser cache

Auditing Permissions

To review current permission assignments:

  1. Navigate to Administration β†’ Roles & Permissions
  2. Click on each role to see its permissions
  3. Use Import/Export Permissions for a complete matrix
  4. Review users assigned to each role

This article should be updated when:

  1. New permission types or categories are added
  2. Default role permissions change
  3. The permission management interface is updated
  4. Navigation visibility rules change
  5. New feature areas requiring permissions are added
Article ID: permission_management
Related Articles
Role-Based Access Control
Learn how to control user access through customizable roles that grant specific permissions, ensuring employees can access only the features and data relevant to their responsibilities.
User Roles and Permissions
Learn how to effectively configure and manage user roles in MangoApps. This guide covers Organizational Roles (which control permissions and access), and Job Functions (which determine scheduling eligibility). Understand how to assign roles to users and optimize your organization's workflow with proper access control.
Understanding Navigation Visibility and Role-Based Access Control (RBAC)
Learn why different users see different menu items in MangoApps. This article explains the three factors that control navigation visibility: User Role Level, System Modules, and Permissions (RBAC). Understand how to configure access and troubleshoot when users can't see expected features.
Creating Custom Roles
Learn how to create and manage custom organizational roles in MangoApps, define their permissions, and establish hierarchical relationships to create a role structure that matches your organization's needs.