🔐 Role-Based Access (RBAC)

Now that your FlexPay workspace is active and your first payroll is ready to run, it’s time to set up user roles and access levels. FlexPay uses Role-Based Access Control (RBAC) to keep sensitive data secure while enabling collaboration across your team. This section explains how roles work, how to assign them, and how each role interacts with payroll, tax documents, and other admin tools.

RBAC is especially important now that you've ✅ finalized onboarding. As your team grows, you'll need to delegate tasks—like adding new hires, approving time, or reviewing benefits—without giving everyone full access to sensitive banking or tax settings.

---

👥 What is RBAC?

RBAC stands for Role-Based Access Control. It’s a security model that assigns permissions based on a user’s role in the company, not their identity alone. That means a person’s access is defined by their responsibilities, not by their title or login method.

In FlexPay, RBAC enables you to:

• Limit who can run payroll or view banking info

• Assign read-only access to auditors or HR assistants

• Grant team managers visibility into only their direct reports

• Keep financial and compliance tasks separated by role

This helps maintain security, compliance, and clarity within your payroll system.

💡 Hint: You set up roles after onboarding is complete, once your account is in “Live Mode.”

---

🔧 Built-in Roles in FlexPay

FlexPay offers several predefined roles, each with a specific set of permissions. These roles are ready to use but also fully customizable if your organization requires it.

Role	Access Scope
👑 Admin	Full access to all settings, payroll, tax forms, and user management
📊 Payroll Manager	Can run payroll, view pay stubs, manage banking but not change admin users
👤 HR Coordinator	Access to team profiles, onboarding flows, and compliance reminders only
🧾 Auditor (Read-Only)	Can view payroll history and reports but can’t make changes
🧑 Manager	Can view and approve direct reports’ time, PTO, and benefits
🙋‍♀️ Employee	Can view their own pay stubs, tax forms, and update personal info

Each user can only be assigned one primary role, but you can layer permissions through add-ons, such as “Can approve payroll” or “Can edit tax docs.”

---

🖼️ UI Overview: Managing Roles in Settings

Figure 1. The RBAC editor in FlexPay

The Settings → Team Access screen is where you’ll assign roles. You’ll see:

• A table of all current users

• Their assigned role and access logs

• Options to send invites, revoke access, or upgrade roles

• A summary panel showing what each role can do

⚠️ Security Tip: Only Admins can assign or change user roles. FlexPay logs all changes for compliance.

---

🔁 How This Builds on Previous Steps

RBAC ties directly into earlier parts of your setup:

• During Step 2: Add Company Info & Team, you entered names, emails, and roles for your initial team. Now, RBAC lets you fine-tune what those users can actually do.

• In Step 5: Finalize & Review, you ensured your data was accurate and approved. RBAC ensures that only authorized users can make changes going forward.

• Users who manage banking (Step 3) or tax (Step 4) data should not be the same people who run payroll — RBAC enforces these boundaries.

---

---

🧠 Key Takeaways

• RBAC defines what your users can do, helping separate responsibilities and secure sensitive data.

• FlexPay offers prebuilt role templates with clear boundaries—but they’re flexible if you need to customize.

• All roles and permission changes are audited for compliance and are visible to Admins.

• RBAC connects back to steps you’ve already taken during onboarding, tying together users, roles, and responsibilities.

---

🔗 What’s Next?

Now that you've secured your team structure, you're ready to explore the Admin Configuration in detail.

➡️ Head to Admin Configuration → Define Pay Schedules to learn how to define pay schedules, customize employee roles, and more.