Permissions follow the work people do
Attendify uses named capabilities for worker management, attendance viewing, correction, approval, schedules, reports, administration and audit access. Seeded roles include Owner, HR Admin, HR Officer, Branch/Site Manager, Supervisor, Payroll, Auditor and Read-Only. Role names provide a starting point; the capabilities are what determine allowed actions.
A payroll reviewer may need to inspect and export hours without managing worker devices. A supervisor may need to see attendance and raise a correction. An auditor needs a read path to supported activity records. Plan those duties before granting broad administrative access.
Company boundaries and site scopes are different controls
Company-scoped data access separates tenants. Site scopes narrow supported views within a company. A user with an unscoped role grant can still have company-wide access, so adding a scoped grant does not automatically cancel broader permissions.
Branch and department fields organize workers, but their existence is not proof of complete branch/department access isolation. Site scopes are the control to rely on.
Review the current limitations before relying on them
Correction requests and decisions check tenant membership, the required capability and the site that owned the work date. A site-scoped manager can only correct attendance for their own sites. Branch- and department-only scopes are different: that helper still falls back to company-wide site access, so don't rely on branch or department grants for strict isolation today.
Correction and approval permissions can belong to the same user. The approval queue does not enforce an independent maker/checker or multiple approval levels. If contractual or internal requirements demand those controls, discuss the gap before rollout.
Test a role with real tasks
Create a review matrix covering worker visibility, site visibility, correction submission, correction decision, export and administration. Check both the screen and the relevant action using a consented demo tenant. A hidden button alone is not proof of an enforced permission.
Use the narrowest appropriate grants, document who owns role changes and revisit access when someone’s duties change. These operating practices complement the implemented controls; they are not automatic compliance certification.