Permissions follow the work people do
Attendify uses named capabilities for worker management, attendance viewing, correction, approval, schedules, reports, administration and audit access. Seeded roles include Owner, HR Admin, HR Officer, Branch/Site Manager, Supervisor, Payroll, Auditor and Read-Only. Role names provide a starting point; the capabilities are what determine allowed actions.
A payroll reviewer may need to inspect and export hours without managing worker devices. A supervisor may need to see attendance and raise a correction. An auditor needs a read path to supported activity records. Plan those duties before granting broad administrative access.
Company boundaries and site scopes are different controls
Company-scoped data access separates tenants. Site scopes narrow supported views within a company. A user with an unscoped role grant can still have company-wide access, so adding a scoped grant does not automatically cancel broader permissions.
Branch and department fields organize workers, but their existence is not proof of complete branch/department access isolation. Current scope enforcement is not uniform across every action.
Review the current limitations before relying on them
The correction request and decision functions enforce tenant membership and the required capability. They do not enforce a universal site restriction on those writes. The current branch/department-only scope helper also falls back to company-wide site access. Attendify should not be selected on the assumption that those paths provide strict hierarchical isolation today.
Correction and approval permissions can belong to the same user. The approval queue does not enforce an independent maker/checker or multiple approval levels. If contractual or internal requirements demand those controls, discuss the gap before rollout.
Test a role with real tasks
Create a review matrix covering worker visibility, site visibility, correction submission, correction decision, export and administration. Check both the screen and the relevant action using a consented demo tenant. A hidden button alone is not proof of an enforced permission.
Use the narrowest appropriate grants, document who owns role changes and revisit access when someone’s duties change. These operating practices complement the implemented controls; they are not automatic compliance certification.