People permissions and states
Reference People access, roles, sensitive-data grants, employment classifications, states, limits, and side effects.
People authorization combines workspace access, a linked person identity, row-level relationships, a People role, and separate sensitive-data grants. Passing one layer does not bypass the others.
Workspace access
| Condition | Result |
|---|---|
| Signed in, current non-guest organization member, People rollout enabled | Self-service People access. A linked person is still required for personal records. |
| Organization administrator without a People role | The same self-service access as another organization member; no automatic People management capability. |
| Per-user People rollout enabled | Opens People only for that user, while still requiring real membership in the requested organization. |
| Guest, no organization membership, or wrong organization slug | No People self-service for that organization. |
| People rollout disabled for both organization and user | The People route is unavailable. |
The workspace is organization-scoped at people.infra.one; an account cannot use a URL slug to cross into another organization.
People roles
| Role | Included access | Not included |
|---|---|---|
| No People role | Own Time off, Work time, My tasks, assigned Time-off approvals, read-only Settings, and own profile when an account is linked. | Directory, team calendar, legal entities, organization-wide decisions, workflow administration, or arbitrary profiles. |
| Time and absence manager | Everything above, plus Directory, Team calendar, Legal entities, every pending time-off request, and read-only review of every person’s work-time sheet. A linked person identity is required to decide a request. | Adding or editing people, arbitrary person profiles, employment administration, documents, workflows, compensation, or health data. |
| HR administrator | Everything in Time and absence manager, plus arbitrary person profiles, private HR details, person and employment administration, ordinary HR documents, and Workflows. | Compensation and health data unless their separate grants are present. |
People roles are grants, not organization roles. Organization administrators manage the grant from the organization’s Team settings: open Service access, find People, then choose Role and Sensitive data. The People Settings page itself is only a Roles and permissions and Sensitive data reference and has no save controls.
Row-level profile access
| Relationship to the person | Profile result |
|---|---|
| The linked person themself | Can open their own profile and see their own compensation, payroll, and health records. |
| Current direct manager | Can open the direct report’s standard profile and non-tiered documents. Employment administration, private HR details, compensation, and health remain separately protected. |
| Time and absence manager only | Can see the person in Directory, but cannot open an arbitrary profile solely because of that role. |
| HR administrator | Can open and administer profiles and employment records; sensitive-data grants still control compensation, payroll, and health. |
An extra such as See compensation does not by itself open a profile. The viewer must also pass the page and row-level profile check.
Sensitive-data grants
| Grant | Effect |
|---|---|
| See compensation | View compensation records and payroll-class documents where profile access already exists. |
| Manage compensation | Includes compensation viewing and permits adding compensation records where profile access already exists. |
| See health data | View health-class data, including Sick note documents, where profile access already exists. An HR administrator with this grant can also file sick notes. |
No People role implies any of these grants. An HR administrator with no sensitive-data selections sees neither compensation nor health data. A person’s access to their own data is the self-service exception.
Employment classifications
| Classification | Time off | Work time |
|---|---|---|
| Employee | Eligible when an active employment covers the request’s First day. | Required; missing scheduled records can be listed. |
| Free service contract | Not eligible. | Optional and accepted. |
| Contractor | Not eligible. | Not recorded in People. |
Directory and employment states
| Directory state | Meaning |
|---|---|
| Active | At least one employment is active today. |
| Leaving | An active employment has a recorded future final day; the date appears with the state. |
| Starting | The earliest employment begins in the future; the start date appears with the state. |
| Former | The person has employment history but no current or future employment. |
| No status | The person has no employment record. |
An employment amendment starts a new version on Effective from and ends the previous version one day earlier. Termination treats End date as the final employed day. Adding and terminating employment can trigger active workflow templates. If an automatic workflow start fails, People logs the failure internally, creates no failed workflow instance, shows no in-app alert, and does not roll back the employment change. Confirm the saved employment change, then start the workflow manually.
Time-off states and effects
| State | Meaning and allowed transition |
|---|---|
| Requested | Waiting for approval. The requester can cancel it. |
| Approved | Approval is complete or was not required. Usage is booked, and the requester can cancel it. |
| Declined | The request was refused and no usage is booked. It cannot be cancelled. |
| Cancelled | The request is closed. If it was approved, a reversing adjustment restores the booked balance. |
People calculates Days from the effective working schedule and holidays. Half day is valid only for a single-day request. When an entitlement exists, submission enforces that policy’s negative-balance limit. An approval-required request with no current manager remains Requested until a Time and absence manager or HR administrator decides it.
Work-time rules
Only the linked person can create or delete entries on their sheet. Time and absence managers and HR administrators can select and review another person, but cannot change that person’s entries.
The current AZG checks emit warning tags at these thresholds:
| Check | Warning condition |
|---|---|
| Daily maximum | Net working time exceeds 10 hours in one day. |
| Break | Total net working time for the day exceeds 6 hours and total recorded break time for that day is shorter than 30 minutes. |
| Rest | Rest from an entry on the previous calendar day to the current entry is shorter than 11 hours. |
| Weekly maximum | Net working time exceeds 50 hours in one week. |
Warnings never block saving. A break must be nonnegative and shorter than the entry span. An End at or before Start is treated as an overnight entry ending on the following day.
Field and value limits
| Field | Current limit |
|---|---|
| Person First name and Last name | Required; at most 200 characters each. |
| Legal-entity name | At most 200 characters. |
| Workflow template and template-task names | Required; at most 200 characters. |
| Employment Weekly hours | Greater than 0 and no more than 80. |
| Employment FTE | Greater than 0 and no more than 2. |
| Compensation amount | Effective-dated euro amount from €0 through €1,000,000,000, entered with at most two decimal places and stored as integer cents. |
| Document display name | At most 1,024 characters. |
Workflow and task states
Templates use Manual, Employment started, or Employment terminated triggers and can be Active or Inactive. Employment events automatically start only matching active templates.
Workflow instances are Running, Completed, or Cancelled. Each template task has one of five types: To-do, Data collection, Document, Approval, or Communication. Its assignee is resolved as Employee, Manager, or Specific person when the instance starts.
- Due offset (days) is relative to the instance’s trigger date and can be negative.
- Depends on can reference an earlier task in the same template; the dependency must be Completed or, when optional, Skipped before the dependent task can complete.
- Optional tasks can be Skipped. Mandatory tasks cannot.
- Completing the last open mandatory task marks the instance Completed.
- A person data-collection task can update only Phone, Personal email, Nationality, or Birth date. An employment data-collection task changes Weekly hours or FTE by creating an effective-dated employment amendment for today.
- A document task uploads to the workflow subject’s profile. If task completion fails after upload, People removes the newly created archive row so the assignee can retry without creating duplicate visible rows. The stored file remains retained for audit.
- A template referenced by any workflow instance cannot be deleted.
Compensation states
Compensation records use Base salary, Allowance, or Bonus target with Monthly (12×), Monthly (14×), Hourly, or Annual frequency. Adding a new record of the same type closes the prior open record on the day before the new Effective from date; overlapping effective periods are rejected.
Document limits and effects
- Person and legal-entity uploads accept one file at a time, up to 250 MB (250,000,000 bytes).
- A Document workflow task accepts one PDF, DOC, DOCX, PNG, JPG, or JPEG file, up to the same limit.
- Payroll requires compensation access. Filing Sick note requires both HR administrator and See health data.
- Deleting a profile or legal-entity document removes its visible archive row; the stored file is kept for audit.