# Configure role permissions

## What are role permissions?

Every role in Pave includes a set of permissions that control two things:

* **What the user can do** (their authority): view data, edit data, or have no access
* **Who the user can see** (their scope): all employees, their reporting tree, only themselves, or a custom group

You configure permissions per product area. Each product area has a toggle to enable or disable it for the role, and individual permission settings underneath that control specific capabilities within that product.

To configure permissions, go to **Settings > Roles & Permissions**, select a role, and open the **Permissions** tab. For details on creating roles, assigning users, or managing the role list, see \[Create and manage roles\].

## Product sections

The Permissions tab displays an accordion with one section per Pave product. Each section has a toggle labeled **Enabled** or **Disabled** on the right side.

* **Enabled** gives users in this role access to that product. Expand the section to configure the specific permissions within it.
* **Disabled** blocks all access to that product for users in this role.

The product sections you see depend on which Pave products your company uses. Available sections include:

| Product section | What it controls |
|----|----|
| **Benchmarking** | Access to Market Data benchmarks, reports, peer groups, and inviting collaborators |
| **Compensation Planning** | Access to merit cycles, the planner worksheet, cycle dashboards, reward letters, and related configuration |
| **Connections** | Access to HRIS, ATS, and other integrations, data management, and the Pave API |
| **Reward Letters** | Access to view or manage reward letters outside of a compensation cycle |
| **Settings** | Access to company info, user management, authentication settings, notifications, and communication configuration |
| **Team View** | Access to the Team View dashboard, employee data, demographics, equity data, compensation bands, and analytics |
| **Total Rewards** | Access to Total Rewards statements, future equity modeling, promotion modeling, and the learning hub |
| **Visual Offer Letter** | Access to create and manage Visual Offer Letters for candidates |
| **Bands** | Access to the Market Pricing band viewer, band manager, and aggregated employee data |

## Set what a role can do

Each permission within a product section is displayed as a readable sentence that you can edit inline:

**"Can \[authority\] \[feature\] for \[scope\]"**

For example: "Can **view** the Live band set for **full roll-up**"

The first dropdown in each sentence controls the **authority**, which determines what action the user can take:

| Authority | What it means |
|----|----|
| **Not access** | The user cannot see or use this feature at all |
| **View** | The user can see the data but cannot make changes |
| **Edit** | The user can see and modify the data (this includes everything that view provides) |

Some permissions use more specific labels that map to the same authority levels. For example, "export" and "not export" for data downloads, "invite" and "not invite" for collaborator invitations, or "override" and "not override" for compensation controls.

## Set who a role can see

The second dropdown in each permission sentence controls the **scope**, which determines which employees or records the user can access. Not every permission has a scope dropdown. Permissions that are simple on/off toggles (like cycle configuration access) only have the authority dropdown.

When a scope dropdown appears, the available options depend on the permission. Common scope options include:

| Scope | What the user sees |
|----|----|
| **All employees** | Every employee at the company |
| **Full roll-up** | Everyone in the user's reporting tree (all levels below them). In Total Rewards, this also includes the user's own data. |
| **Direct reports** | Only people who report directly to the user. In Total Rewards, this also includes the user's own data. |
| **Themselves** | Only the user's own data |
| **Custom** | A specific group of employees defined by filters you configure (see below) |

Visual Offer Letter permissions use candidate-specific scopes: **all candidates** or **their candidates** (only candidates assigned to the user as recruiter or hiring manager).

## Configure custom scopes

When you select **Custom** as the scope, a filter panel appears below the permission sentence. This is where you define exactly which employees or records the user can access.

Filters use two levels of logic:

* **Within a filter group**, all conditions are combined with AND. The user only sees records that match every condition.
* **Between filter groups**, groups are combined with OR. The user sees records that match any group.

For example, to give a role access to Engineering employees in the US, plus Product employees in Canada, you would create two filter groups:

* **Group 1**: Department is Engineering AND Country is US
* **Group 2**: Department is Product AND Country is Canada

To build a custom filter, choose a field (such as Department, City, Country, or Person), an operator (such as "is" or "is not"), and one or more values. The available fields depend on what the permission controls. Employee permissions offer fields like Department, City, Country, Person, All reports of, and Direct reports of. Band permissions offer fields like Function, Ladder, Ladder Rank, and pay zone.

The filter panel displays a count of how many employees match your current configuration, so you can verify the scope before saving.

### Reusable filters

If you find yourself configuring the same filters across multiple roles or permissions, you can save them as a **reusable filter**. Changes to a reusable filter automatically apply everywhere it is used.

To create a reusable filter, click **Manage reusable filters** at the top of the Roles & Permissions page, then click **Create new reusable filter**. You can also convert an existing inline filter into a reusable one by clicking **Save as a reusable filter** at the bottom of the filter panel.

To attach a reusable filter, set a permission's scope to **Custom**, then select the filter from the search dropdown. The filter rules appear as a summary card showing the filter name and a description of its rules.

If you need to customize a reusable filter for one specific permission without affecting others, click the **Detach** icon on the filter card. This copies the rules into a standalone filter you can edit independently.

The management drawer shows all reusable filters, their rules, and how many roles and permissions use each one.

## Relative permissions for bands

When configuring band viewer or advanced band permissions in Compensation Planning, custom scopes support relative filter values that adjust automatically based on each user's position in your organization:

| Relative value | What the user sees |
|----|----|
| **Values of Direct Reports** | Bands matching the jobs of the user's direct reports |
| **Own Value** | Bands matching the user's own job |
| **All Reports** | Bands matching the jobs of everyone in the user's reporting tree |

These let you set a single permission configuration that automatically shows the right bands for each person, without creating a separate custom filter for every manager.

For example, a common configuration gives managers access to bands for their direct reports' roles and their own role, so they can discuss career progression without seeing the entire band set.

## How multiple roles combine

When a user has more than one role, permissions from all roles are combined. The user receives the most permissive access granted by any of their roles.

**Authority**: For each permission, the highest authority across all roles wins. If one role grants view access to Team View employees and another grants edit access, the user has edit access.

**Scope**: Scopes from each role are evaluated independently and the results are combined. If one role grants access to direct reports and another grants access to a custom-filtered group, the user sees employees from both. Each role's custom filters are applied on their own, then the results are merged. They do not combine into a single filter set.

**Product toggles**: If any role enables a product, the user has access to that product, even if another role has it disabled.

Because permissions are additive, you cannot use a second role to restrict access granted by a first role. To narrow someone's access, adjust the permissions on the role that grants the broader access.

### Examples

**HR Business Partner with a regional scope**: An HRBP supports the Engineering team in the US. They have the HRBP role with Team View scoped to a custom filter (Department is Engineering AND Country is US) and Compensation Planning scoped to the same group. They also have the default Employee role, which gives them view access to their own Total Rewards data. The result: they can see and manage compensation for US Engineering employees, and view their own Total Rewards statement.

**Manager who is also a recruiter**: A hiring manager has both the Manager role (Team View and Compensation Planning scoped to their full roll-up) and the Recruiter role (Visual Offer Letter scoped to their candidates). The result: they see their reporting tree in Team View and Compensation Planning, plus their own candidates in Visual Offer Letter.

**Two roles with different custom scopes**: A user has one role scoped to the Sales department and another scoped to the Marketing department. The result: they see employees in both Sales and Marketing. The filters do not merge. Each role's scope is applied separately and the results are combined.

You can preview the combined effect of a user's roles from the **Users** page in Settings. Click on a user to see their resolved permissions across all assigned roles.

## Things to know

* The **Admin** role cannot be edited. Users with the Admin role have full access to all Pave products and settings.
* The **Employee** role is assigned to every user by default and cannot be removed.
* Some permissions are only visible when your company has the corresponding product or feature enabled. If you do not see a permission listed in a product section, your company may not have access to that feature.
* To verify what a role looks like in practice, impersonate a user who has that role. See \[Impersonate a user\] for details.
* Some Pave products have additional permission controls beyond what you configure here. Compensation Planning has column-level permissions within each merit cycle, and Team View has its own visibility settings. Those are configured within each product, not from the Roles & Permissions page.
* Changes to a role's permissions affect every user assigned to that role, across all Pave products.

Configure role permissions

Create an account and log in

Set up single sign-on (SSO)

Account setup

Create and manage roles

Roles and permissions

Impersonate a user

Manage notifications

Complete your company profile

Manage company settings

Platform settings

Account & Permissions

Connect ADP

Connect BambooHR

Connect Dayforce

Connect Deel

Connect Gusto

Connect HiBob

Connect Workday

Connect Namely

Connect Paylocity

Connect Personio

Connect Rippling

Connect UKG Pro

Connect CharlieHR

Connect Humaans

Connect Justworks

Connect Sapling

Connect SAP SuccessFactors

Connect TriNet

Connect Zenefits

HRIS Integrations

Connect Carta

Connect ComputerShare

Connect Shareworks

Connect E*Trade

Connect Fidelity

Connect Global Shares

Connect Pulley

Connect Schwab

Connect Ledgy

EMS integrations

Connect Culture Amp

Connect Workday Performance

Performance integrations

Connect Ashby

Connect Greenhouse

Connect Lever

Connect Workday ATS

ATS integrations

Manage your connections

Upload custom reports

Pave API

Integrations

Team View Overview

Team View Column Configuration

Team View Customizations

Re-ordering Columns

Deleting Columns

Adding Columns

Team View Settings

Team View

Configurations overview

Cycle access permissions

Overview

Employee eligibility

Approval chains

Planning windows

Budgets

Recommendation logic

Adding non-integration data to your cycle

Reward letters

Cycle Setup

Columns

OTE planning

Writing formulas with Handlebars

Hourly and monthly pay

Columns and Formulas

Using the planner worksheet

Using the employee detail view

Cycle Progress dashboard

Budgets dashboard

Cycle Outcomes dashboard

Approval Statuses 

Worksheet Experience

Overview of smart features in compensation planning

Peer Comparison

Smart Flags

Priority Sort

Compensation Outliers

Manager Compression Flag

Vesting Drop Flag

Flags and Insights

Compensation Planning

How does Pave Work?

Intro to Pave

Contact Us

Pave 101

Getting Started

Grades

Setting up Company Job Architecture

Company Job Architecture

Job Architecture 101

Pay Zone Manager

Step 1: Build Foundation

Generate Bands from Market Data

Editing Bands

Calculated Columns

Bands Set Audit Log

Bulk & Manually Associate Market Data to Bands

Employee Distribution in Bands

How to duplicate band sets

Managing & Reordering Calculated Columns

Unmatched Employees

View changes

Pay Types: Calculated TDC, Annual Equity, and Refresh Equity

Manually Create New Band Sets

Band Sets

Upload/Download Bands

Step 3: Update Ranges

Advanced Filters

Compare Bands

Generate Bands for New Jobs in Your Job Architecture

Relative Permissions

Ongoing Management & Analysis

Edit and apply benchmarks

Set weights and logic

Map data sources to jobs

Supported survey providers

Manage Pave data sources

Manage survey data sources

Benchmarks overview

Survey aging

Step 2: Benchmarking

Market Pricing

Create and manage Peer Groups in Market Data

Create and manage Market Data reports

Equity data benchmarking

Explore data composition

Explore the Pave job catalog

Filter Market Data benchmarks

Get started with Market Data

Share Market Data externally

Market Data Benchmarks (Features & Workflows)

Understand Calculated Benchmarks

Understand Consistency Labels

Understand job matching

Understand Market Data methodology

Understand job levels

Market Data Methodology 

Explore Global Location Insights

Explore Equity Practices

Other Pave Market Data Products 

Market Data FAQ

FAQ's

Upgrade to Market Data Pro

Upgrades & Pricing 

Market Data

Understanding Equity in Total Rewards

Display Original Grant Value

Compensation Simulator Configurations

Compensation Simulator Overview

Learning Hub Configuration

Learning Hub Overview

Reward Letters

Accessing your Total Rewards portal

Total Rewards 101

Visual Offer Letters with Workday

Visual Offer Letters with Greenhouse

Visual Offer Letters with Lever

Visual Offer Letter as a Candidate

Previewing Visual Offer Letters

Visual Offer Letters with Ashby

Creating and sending Visual Offer Letters in Pave

Visual Offer Letter 101

Why is my equity different in the equity tab on the left hand side compared to the equity valuation on the graphs?

Why can't I view my own Total Rewards portal?

Total Rewards and Visual Offer Letter FAQ

How can I complete our Greenhouse connection if "API credential management" is not in my Greenhouse menu?