How do I assign a role to someone?
Creating a role does nothing on its own. An assignment is where a role reaches a person, and there are three places to make one.
Before you begin
You need to be a company Owner or Admin. The roles you want to assign should exist first — see What do roles and permissions control?.
Admins restricted to a group cannot assign roles at all: "Group-scoped admins can't assign roles — ask a company admin to do it."
From the role
- Go to Settings → Admin → Roles & Permissions.
- Find the role you want to hand out.
- From its row menu, choose Assign role, then search for the people.
You can also open the role and use Assign role on its page, where Assigned members shows who already holds it. Roles above your own level do not offer Assign role — a plain Admin cannot hand out an Owner role.
From the person
Open the employee, go to the Groups tab, and use Assign role — or Change if they already have one — next to Company-wide role.
From a group
Open a group under Settings → General → Groups, select people in its members table, then Assign role. The dialog confirms how many.
A role assigned here applies to that group only: the person sees that group's data and nothing outside it. On the company's top-level group, it applies company-wide. Reporting-tree roles are not offered here, because a group cannot express a reporting tree; assign those from the role instead.
One option in that dialog matters more than it looks: Skip people who already have a role. It is off by default, so unless you turn it on, anyone who already holds a role for this group has it replaced. Their roles elsewhere are not touched.
Turn it on when you mean "give the new members a role" and leave it off only when you mean "reset everyone in this list". The dialog tells you how many of your selection already hold a role.
Bulk results are reported honestly rather than as a single success: you get "Assigned 8, 2 failed" when some fail, and "3 people were assigned before it stopped" if it aborts partway. Read the toast rather than assuming.
Reach
How far an assignment sees depends on two things:
- The role's reach: The whole company or Their reporting tree. This is set on the role, not chosen when you assign it.
- Where you assigned it: from a group, a company-wide role is limited to that group.
A person can hold one role per reach — a company-wide role, a reporting-tree role, and a role for each group they belong to.
Restriction is powerful and easy to underestimate. A restricted admin loses company-wide surfaces — Organization becomes unavailable to them — even though the role's permissions did not change.
Good to know
When does a role change take effect?
On their next request. There is nothing to re-run and no sync to wait for. Requests that were waiting because nobody could approve them are released as soon as a role change gives them an approver.
Why was I refused?
Three guards worth knowing. You cannot change your own role, you cannot assign a role above your own level, and a reporting-tree role cannot be assigned to a group. All are refusals rather than silent no-ops.
Can I give someone an exception without making a new role?
No. Permissions live on the role, not on the person. Create a custom role on the same base role as the one they hold, set the permissions they need, and assign it. Give it a name that says why it exists — "Team Lead (can order)" is easier to audit later than a second "Team Lead".
Can roles be assigned automatically?
One reporting-tree role per company can be set to Auto-assign, which gives it to everyone who manages people and keeps that up to date as the org chart changes. See What do roles and permissions control?.
Who can see that I changed this?
Every assignment, role change and scope change is recorded on the Activity Log tab with the actor's name.
They have the role but still cannot see the page
Check what the role actually grants, and check whether their assignment is restricted — to a group, or to their reporting tree. Those two account for most "the permission is on but nothing happened" reports. If the page is in Settings, check their base role too: only Owners and Admins can open Settings. See Who can change which settings?.
Do I assign roles for SSO users too?
Usually not. With single sign-on you can switch on JIT provisioning — short for just-in-time. It means Velory creates a person's login the first time they sign in through your identity provider, instead of you inviting them first. It only works for people who already have an employee record in Velory, for example from an HR system sync or a CSV import.
Those people get the Default role for new users you picked in the SSO settings, so you do not assign it by hand. That role cannot be Owner- or Admin-based, and cannot grant more than a Manager has by default.
Everyone who is not signing up through JIT needs an assignment. See How do I set up single sign-on?.
Was this article helpful?