Kelomo has five roles, and a person has one role at a time in one workspace. Roles are not stacked on top of each other. The role decides which sections are visible in the main menu and whose data the person sees.
The role is chosen when the user is added, and it can be changed later in user management.
The roles at a glance
| Role | Sees | Does not see |
|---|---|---|
| Employee | The My work section and their own reports | Other people’s data, the Team section, the Settings section |
| Manager | My work and Team (approvals, the team’s status) as well as projects. Of people, only their own reports | The Settings section at all. Other managers’ reports |
| Admin | Everything | – |
| Payroll | The reports, the payroll data export and some of the settings | The approval queue. The team’s absences and shifts |
| HR | The staff register, onboarding, recruitment and competences | The Settings section, payroll exports, the approval queue |
Settings is visible at the foot of the menu only to the admin and to payroll. The manager has no access to the rules and the settings.
Which role for whom
Choose the role based on what the person needs to do in Kelomo.
- Employee is the default. It is enough for everyone who only records their own working time.
- Manager for the person who approves other people’s working time and follows the team’s status.
- Payroll for the person who takes the payroll data onwards.
- HR for human resources, who look after the register, onboarding and recruitment without access to payroll exports.
- Admin for the person responsible for the rules and the settings.
HR cannot elevate roles
HR can create and change only the Employee and Manager roles. The admin, payroll and HR roles are in the admin’s hands alone. The HR role therefore cannot widen its own or anyone else’s permissions.
You cannot approve your own working time
Self-approval is blocked: nobody approves their own days, not even a manager. An admin can do it as a deliberate exception, and the exception is recorded in the log.
Everyone therefore needs to have a manager – including the manager themselves.
Substitution does not chain
When a manager is away, the substitute sees and approves their reports’ days over the chosen date range.
- A manager can set a substitute for themselves.
- An admin can set a substitute on behalf of someone else.
- Substitution does not chain: a substitute’s substitute does not inherit the permissions any further.
See Substitutions.
If something goes wrong
The manager does not see a person’s days. A manager sees only their own reports. Check in user management who has been marked as their report.
Payroll cannot find the approval queue. The approval queue does not exist for this role: approving belongs to the manager, and payroll only exports days that have already been approved.
A manager asks for access to the settings. The manager role does not see the Settings section at all. If they need a rule change, make it as an admin – or change their role.
HR cannot change a role to payroll. HR can change only the Employee and Manager roles. Ask an admin to make the change.