How do I create a role?

Before you begin

You need to be a company Owner or Admin. You cannot create a role that is more powerful than your own: an Admin cannot create an Owner-based role, or give a role permissions they do not hold themselves.

Decide two things before you start, because they are hard to undo:

• Which base role it builds on. It cannot be changed after the role is created.
• How far it should see: the whole company, or the holder's reporting tree.

If you are unsure what these mean, read What do roles and permissions control? first.

Create the role

1. Go to Settings → Admin → Roles & Permissions.
2. Select Create Role.
3. Enter a Role Name — "Team Lead", for instance. Names must be unique; a duplicate is refused with "A role named … already exists".
4. Add a Description saying what the role is for. The next admin will thank you.
5. Choose the Reach:
   • The whole company — the holder sees every record their permissions allow.
   • Their reporting tree — the holder sees only the people who report to them, and everyone below those people.
6. Choose Inherit Permissions From: Owner, Admin, Manager or Employee. This sets the role's base role and switches on that base role's default permissions. It starts on Manager.
7. In Permissions, switch on or off what this role needs. See the permission categories for what each group covers.
8. Select Create Role.

The page has two Create Role buttons, one under the details and one under the permissions. Either one creates the whole role with everything you have filled in.

Choosing the base role

"Inherit Permissions From" lists base roles, not the roles you already have. You cannot copy an existing custom role; to make a variant of one, pick the same base role and set the same permissions by hand.

The choice matters more than its label suggests. The base role decides:

• Whether the holder can open Settings. Only Owner- and Admin-based roles can.
• How far the permissions can go. A role can be given permissions up to the defaults of the base role one level above it. An Employee-based role tops out at Manager's permissions; a Manager-based role can hold every admin permission.
• Who can be given the role by JIT (automatic sign-up through single sign-on). Only roles that are not Owner- or Admin-based, and grant no more than a Manager has by default, can be the default role for new SSO users.

Changing Inherit Permissions From resets the permission switches to that base role's defaults, so pick it before you adjust anything.

Choosing the reach

Most roles should reach The whole company. Choose Their reporting tree for roles about managing people — a team lead, a department head.

Two things follow from a reporting-tree reach:

• The role cannot be assigned from a group's members table. Assign it from the role, or from the person.
• It can be set to Auto-assign, so everyone who manages people gets it automatically.

You can change the reach later, and the change moves everyone who holds the role. See What do roles and permissions control?.

After you create it

The role appears in the list as Custom (fixed). Despite the label, you can edit and delete it.

Nobody holds it yet. See How do I assign a role to someone?.

Good to know

Can I start from an existing role, like Report Manager?

No. You can only start from a base role's defaults. Open the role you want to copy, note its permissions, and switch the same ones on in your new role.

Can I change the base role later?

No. Create a new role with the right base role, move people to it, and delete the old one.

Why was my Owner-based role refused?

Owner is listed for everyone, but only an Owner can create a role built on it. As an Admin, saving it is refused. Choose Admin instead.

Should I create a role for one person?

When one person needs something different, a role of their own is the only way — Velory has no per-person exceptions. Name it for the job, not the person, so it still makes sense when they leave.