There are 3 possible roles any user can have, and these roles determine what administrative permission people have access to:
- HR Admin
- HR Assistant
- Tech Admin
The HR Admin roles are more for managing people and feedback within the platform. The Tech Admin role is used to configure the SI integrations, security settings, and use the user import tool. And the HR Assistant role is like HR Admin “lite” – able to help out with some administrative functions, but with limited access to confidential information (through exports).
A user may have more than one role, and in that case, the permissions simply add up. The original system evaluator starts out with both HR Admin and Technical Admin permissions – what we refer to as the account “Super User” who has all permissions. Having the HR Admin and the HR Assistant roles is redundant. An HR Admin can do everything an HR Assistant can do, plus more.
Changing permissions
To grant HR Admin permissions, you’ll need HR and Tech admin permissions yourself first. If you have these permissions, you can grant HR Admin permissions to another colleague from the company directory.
After clicking “Edit Permissions” you’ll see the following dialog. Check the “HR Admin” checkbox and press “Save Permissions”.
HR Admins can appoint other HR Admins and they can appoint HR Assistants. Tech Admins can only be appointed by users who are both HR Admin and Tech Admin already. Someone with both HR Admin and Tech Admin permissions can assign any role to anyone.
Roles can be revoked as well, but there always needs to be at least one “Super User” in the system. You can’t revoke the last person’s roles, nor can you lock that person. In the event that all Admins have left the company, please contact SI support.
HR Admin
This role is very powerful. HR Admins can set up and manage review processes, change the reporting structure, and access confidential data like performance review content of almost every person in the company.
The key restriction is that even an HR Admin can’t access confidential data of a person above them in their reporting hierarchy.
You should try to limit the HR Admin role to 2 or 3 people in a small company of up 100 staff, and maybe 5-6 in a company of 500 to 800 staff. There’s no exact rule to determine the number. But the more people, the more to manage, so these considerations are important depending on your company’s size
One thing to consider: We recommend limiting the number of HR Admins and especially “Super Users” (HR + Tech Admin) as it is easier to identify who made major changes. If you just need cycle help, consider the HR Assistant role, detailed in the next section.
HR Assistant
While keeping the HR Admin role to only a handful people, the HR Assistant role can be assigned a bit more liberally. HR Assistants can create and edit review and 360 cycles, add reviewees to them, see the status of reviews, and send reminders to those who are running late. So they can be in charge of the majority of the process, but they are not able to access any confidential data. (Note that editing 360 cycles includes the ability to change visibility of feedback in that cycle, so the HR Assistant role is still quite influential. I.e. don’t assign it too liberally either.)
HR Assistants can create Pulse Surveys, if you have this feature enabled. They can view, edit, share, and export the data for any survey they have created. They do not have these permissions for other cycles.
The HR Assistant cannot delete cycles, even if they created them. Since they cannot view what data may have been recorded by users, only HR Admins can undertake this action. The role does not initially give permission to change the reporting structure, to change email addresses, or to reset user’s passwords.
However, if you are looking for an Assistant to have this ability but still be blocked from accessing confidential review or 360 content, there is a workaround: If you navigate the user settings in your admin overview, you can select the “Allow HR Assistant to pick a person’s manager” option.
Tech Admin
The Tech Admin role is usually assigned to someone with a technical background. This person is comfortable setting up integrations with other products or editing the company settings. This person will be able to help with many tasks in user management and the overall configuration of the system, but a technical admin will not have access to confidential data. For this reason, the Tech Admin role (like the HR Assistant) cannot perform certain actions like setting passwords or changing the reporting structure.
While a Tech Admin only has access to limited confidential user data (through exports), there’s still a risk of accidental misconfiguration of settings, for instance locking out the entire company by applying incorrect IP range restrictions or the like. Don’t assign the Tech Admin role to too many people. Don’t assign it to one person only either, since you wouldn’t have anyone to help when that person goes on vacation or leaves the company.
Limitations on HR Admins and Assistants
You may create a cycle with visibility settings that conflict with the HR Admin permission level. In these cases, the HR Admin or Assistant status will be disregarded. The key restriction is that even an HR Admin can’t access confidential data of a person above them in their reporting hierarchy.
Some examples:
- In 360s, when a manager cannot see feedback, an HR Admin will not see feedback about their direct reports.
- In 360s, if feedback is only visible to direct managers, an HR Admin cannot see feedback about themselves
- In Performance Reviews, HR Admins cannot access their supervisor’s review or the reviews of anyone in their management chain.
- In Objective cycles, private objectives are hidden from HR Admins, unless specifically granted visibility.
- In Objective cycles, HR Admins cannot see protected objectives of their own managers, even if HR creates the objective on their behalf.
Essentially, the visibility permissions of a cycle will supersede the HR Admin or Assistant permissions. If your HR Admin needs to see restricted cycle information, you can work around this limitation by creating a Super User outside of your company’s reporting structure.
Inaccessible features
In most cases we simply hide features that a specific role doesn’t have access to. If you can’t change someone’s password, then the dropdown menu on the user-management screen will simply lack an entry that says “change password”. We feel that less is more, at least on commonly used screens.
However, there is a major exception, and that’s the administration overview screen. On that screen, we always present all buttons, and the ones you can’t access are greyed out. We do this to highlight that more options exist, even if you can’t access them yet. We frequently encounter administrators who are unaware that SI is a very configurable system, since they simply didn’t know about the options they were missing out on. We feel that the admin overview is one of those places where showing the limitations of your current role (if any) makes sense.
Permissions Cheat Sheet
Here’s an overview of what permission is granted to each of the 3 roles.
| User Management | HR Admin | HR Assistant | Tech Admin |
|---|---|---|---|
| Invite users | √ | √ | √ (csv import) |
| Import users | √ | √ | |
| SFTP setup | √ | ||
| Send password reset instructions | √ | √ | √ |
| Deactivate/reactivate users | √ | √ | √ |
| Delete users | √ | ||
| Change passwords | √ | ||
| Change reporting structure | √ | (√ ) | |
| Performance reviews | HR Admin | HR Assistant | Tech Admin |
| Create and edit review cycles | √ | √ | |
| Track progress, send reminders | √ | √ | |
| Create reviews | √ | √ | |
| Delete reviews | √ | (√ ) | |
| Delete review cycles | √ | ||
| Access review content | √ | ||
| Export review statistics to Excel | √ | √ | |
| 360 feedback | HR Admin | HR Assistant | Tech Admin |
| Create and edit review cycles | √ | √ | |
| Track progress, send reminders | √ | √ | |
| Create feedback | √ | √ | |
| Delete feedback | √ | (√ ) | |
| Delete feedback cycles | √ | ||
| Access feedback content | √ | ||
| Export feedback to PDF | √ | ||
| Export feedback statistics to Excel | √ | ||
| Objectives | HR Admin | HR Assistant | Tech Admin |
| Create and edit objective cycles | √ | √ | |
| Nudge objective owners and managers into action | √ | √ | |
| View objectives only shared with the manager | √ | ||
| Praise & Private Notes | HR Admin | HR Assistant | Tech Admin |
| Manage Platforms & Message defaults | √ | √ | |
| Configure Badges | √ | √ | |
| Edit and delete messages | √ | √ | |
| Unveil anonymous writer | √ | √ | |
| Configure Praise Wall | √ | √ | √ |
| Automations | HR Admin | HR Assistant | Tech Admin |
| Create an automation | √ | √ | |
| Edit or disable an automation | √ | √ | |
| Delete an automation | √ | ||
| General administration | HR Admin | HR Assistant | Tech Admin |
| Change feature selection | √ | ||
| License details | √ | √ | |
| Email template setup | √ | √ | |
| Design editor | √ | √ | |
| Audit log access | √ | √ | |
| Date & Time settings | √ | √ | |
| Security settings | √ | ||
| Integrations | √ | √ | |
| Email bounce management | √ | ||
| Create and download XML export | (only if also Tech Admin) | ||
| User impersonation | (only if also Tech Admin) |
Always keep in mind that a person may have two roles, then the permissions simply add up. So if you feel that the Tech Admin role alone isn’t powerful enough, and envision your VP of Operations doing more than just setting up the integration, feel free to assign her also the HR Assistant or even HR Admin role.