> ## Documentation Index
> Fetch the complete documentation index at: https://help-empuls.xoxoday.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Access control
> Define what each admin can see and do in Empuls. Use built-in roles or create custom access roles with menu-level permissions.
Empuls uses role-based access control to govern who can configure programs, manage employees, view reports, or take admin actions. Every user is assigned exactly one access role; the role determines which menus appear and which actions are allowed. Four roles ship with every account and you can create additional custom roles for specialized teams — finance, communications, regional admins — without granting full Super Admin privileges.
## Before you start
* You must be a **Super Admin** to view, create, or edit access roles.
* Changes to an access role take effect the next time an assigned user signs in or refreshes the page.
* Access role names are limited to 25 characters.
## Built-in roles
| Role | What they can do |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Super Admin** | Full access — branding, org budgets, access roles, integrations, security settings, AI settings, and every menu under Admin Hub. Default group admin of the Townhall. |
| **General Admin** | Configurable access. By default, manages employees, programs, reports, and finance. A Super Admin can grant or revoke specific menus. |
| **Manager** | Team-scoped access — recognition and reports for direct reports, plus approval queues if configured. No platform-wide settings. |
| **User** | Standard employee access — recognition, surveys, rewards, social features, and personal profile. No admin menus. |
The four built-in roles cannot be deleted or renamed. Super Admin permissions cannot be reduced.
## How access control works
Every menu in the Admin Hub maps to a permission. Each role has one of those permissions enabled or disabled.
When you create or edit an employee, you pick their access role. The user inherits every permission of that role.
Menus the role doesn't have access to are hidden. Direct URL access to a restricted page redirects to the home dashboard.
If you change a role's permissions, assigned users see the new access the next time they reload or sign in.
## Review the permission matrix
Click your profile icon in the top-right and select **Manage Access Roles**, or navigate to the Manage Access Roles page from Admin Hub.
Click your profile icon in the top-right and select **Manage Access Roles**, or navigate to the Manage Access Roles page from Admin Hub.
The page shows a matrix: rows are menus (Manage Employees, Budgets, Surveys, AI Settings, and so on); columns are access roles. A check in a cell means that role can access that menu.
The page shows a matrix: rows are menus (Manage Employees, Budgets, Surveys, AI Settings, and so on); columns are access roles. A check in a cell means that role can access that menu.
For large permission lists, use the search to find a specific menu by name.
## Create a custom access role
From the Manage Access Roles page, click **Create Access Role**.
From the Manage Access Roles page, click **Create Access Role**.
Enter a **Role Name** (up to 25 characters). Use a descriptive name like "Finance Admin", "Regional HR", or "Communications Admin" so the matrix and employee profiles stay readable.
The role is created with no menu permissions enabled by default. It now appears as a new column in the matrix.\\
The role is created with no menu permissions enabled by default. It now appears as a new column in the matrix.
In the new role's column, check each menu the role should access. Save when complete.
Some menu permissions are "system" permissions that cannot be removed from Super Admin — for example, access role management itself. These cells appear locked in the matrix.
## Edit an existing role
On the Manage Access Roles page, locate the role in the matrix.
Click the **pencil icon** next to the role. Toggle menu permissions on or off.
Click **Submit** to save. Users assigned to this role see the updated access on next sign-in.
## Assign a role to a user
Role assignment happens on the employee record, not on the access role page.
Navigate to **Admin Hub → Employees → Manage Employees** and click the **pencil icon** next to the user.
Pick the new role from the dropdown — built-in or custom.
The user's access updates on their next sign-in.
You can also assign roles in bulk during CSV import. See [Manage employees](/admin/user-management/manage-employees) for the import flow.
## When to use custom roles vs delegation
| Use a custom role when… | Use delegation when… |
| ---------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| Several people need the same elevated scope (e.g., a regional HR team) | One person needs temporary cover for another (e.g., approvals during leave) |
| Access should persist over time | Access is short-term, often days or weeks |
| You want clear ownership and reporting per role | You want full account access without changing the user's permanent role |
See [User delegation](/admin/user-management/user-delegation) for short-term account access.
## Limits and gotchas
* A user can have only one access role at a time. To grant additional menus, edit the role itself or use delegation.
* Deleting a custom role requires first reassigning every user holding that role to a different role.
* Permission changes don't kick out active sessions; users see new access only after their next sign-in or page reload.
* The Super Admin role cannot be assigned to a brand-new user who hasn't accepted their invite — they must activate their account first.
## Related
Add users and assign access roles.
Grant temporary access to another user's account.
Combine access control with single sign-on for centralized identity.