Custom roles

Create custom roles to tailor permissions to your organization’s needs.

Overview

Every workspace comes with standard roles (Admin, Employee, Manager, Developer) that cover common permission needs. Custom roles let you go further by:

• Creating new roles with exactly the permissions you need (e.g., “Team Lead” or “HR Assistant”)
• Adjusting standard roles to add or remove specific permissions without creating a brand-new role

Standard roles

These built-in roles are available in every workspace:

Creating a custom role

1. Go to Admin › Roles
2. Click Create Role
3. Enter a name and optional description
4. Optionally select a role to Copy from — this pre-fills the permissions from an existing role as a starting point
5. Configure the role settings (see below)
6. Select the permissions you want to grant
7. Click Save

Copy from

When creating a new role, you can copy permissions from an existing role. This is useful when you want a role that is similar to an existing one but with some adjustments. The original role is not affected.

Editing a role

Customizing a standard role

To adjust the permissions of a standard role (e.g., give Managers access to sensitive employee data):

1. Go to Admin › Roles
2. Click on the standard role you want to customize
3. Adjust the permissions as needed
4. Click Save

This creates a custom override that replaces the standard role’s permissions for your workspace. The role keeps its original name.

Reverting a customized standard role

If you’ve customized a standard role and want to go back to the default permissions:

1. Open the customized role
2. Click Revert to standard
3. Confirm the action

This removes all your customizations and restores the original permissions.

Duplicating a role

To create a new role based on an existing one:

1. Open the role you want to duplicate
2. Click the copy icon in the top-right corner
3. Give the new role a name
4. Adjust permissions as needed
5. Click Save

Role settings

Permissions

Permissions control what users with a role can see and do. Each permission has three parts:

• Resource — what the permission applies to (e.g., employees, time off, presence)
• Action — what the user can do (e.g., read, create, update, delete, approve)
• Scope — how broadly the permission applies:
  • All — access everything in the workspace
  • Managed — access only direct reports
  • Self — access only own data
  • Unit — access colleagues in the same team

Inheritance

When a role inherits from another role, it automatically receives all of that role’s permissions. This is useful for building roles that extend existing ones — for example, a “Senior Manager” role that inherits from “Manager” and adds extra permissions.

Inherited permissions are shown separately from directly assigned permissions, so you can always see where each permission comes from.

Roles managed by your identity provider

When SCIM provisioning is turned on, groups in your identity provider map to roles. Roles bound to an IdP group show a Managed by IdP group badge in the roles list: their members are granted and revoked by the IdP, and manual membership changes are realigned on the IdP’s next sync. What the role is allowed to do always stays in mTime — the IdP can never change permissions.

To let the IdP manage membership of a role that already exists (including standard roles like Admin), open the role and add provisioning under Can be assigned by. The Owner role can never be managed this way.

Deleting a custom role

1. Go to Admin › Roles
2. Click the actions menu on the role you want to delete
3. Select Delete
4. Confirm the deletion