Roles and Permissions

Roles and permissions help you control access to different areas of your ZestNexus workspace.

Instead of configuring access for every employee individually, create roles based on responsibilities—such as Administrator, HR, Manager, or Employee—and assign the appropriate permissions to each role.

How roles work

A role defines:

1. Which modules the user can access
2. What level of access the user has in each module

ZestNexus provides three permission levels:

• Read: View information without making changes.
• Write: View and modify information.
• Admin: Full access to the module, including administrative actions where supported.

For example, an employee may have Read access to certain company information, while an HR user may have Write access to employee records.

Creating a role

To create a role:

1. Open Users.
2. Go to Roles and Permissions.
3. Select Create Role.
4. Enter a recognizable Role Name.
5. Select the modules the role should be able to access.
6. Choose the appropriate permission level for each module.
7. Save the role.

You can then assign the role to employees based on their responsibilities.

Permission levels

Read

Read permission allows users to view information without modifying it.

Use Read access when a user needs visibility into a module but should not be able to make changes.

For example:

• A manager can view employee information.
• An employee can view relevant company documents.
• A team member can view project information.

Write

Write permission allows users to view and modify records within the module.

Use Write access for users who are responsible for day-to-day operations.

For example:

• HR can add and update employee information.
• Recruiters can manage candidates and applications.
• Managers can update relevant team or project information.

Write access should be assigned only when users need to make changes.

Admin

Admin permission provides the highest level of access to a module.

Use Admin access for users responsible for managing the module and its configuration.

For example, an HR administrator may need Admin access to HR-related modules, while regular HR team members may only need Write access.

Because Admin access provides broad control, assign it only to users who require it.

Module access

Permissions are configured for individual ZestNexus modules.

Depending on your workspace configuration, modules may include:

• Organization
• Users
• Attendance
• Leave Management
• Payroll
• Recruitment
• Projects
• CRM
• Assets
• Documents
• Performance
• Reports
• Support

A role can have different permission levels across different modules.

For example:

The exact permissions should depend on your organization's responsibilities and access requirements.

Recommended roles

Administrator

Use this role for users who manage the ZestNexus workspace and require broad access.

Typical access:

• Admin access to required modules
• Organization and workspace configuration
• Employee and HR management
• Reports and operational modules

Limit this role to trusted users.

HR Manager

Use this role for HR users responsible for managing employee operations.

Typical access:

• Admin: HR configuration and sensitive HR modules
• Write: Employee operations, attendance, leaves, recruitment, and other day-to-day HR processes
• Read: Modules where HR only needs visibility

Reporting Manager

Use this role for managers responsible for their teams.

Typical access:

• Read: Employee and team information
• Write: Attendance, leave requests, projects, or performance information where applicable
• Avoid Admin access unless the manager is responsible for managing that module

Employee

Use this role for regular employees.

Typical access:

• Read: Relevant company and personal information
• Write: Features employees are expected to update, such as leave requests or attendance-related actions
• Avoid Admin access

Choosing the right permission

When assigning a permission, consider what the user actually needs to do.

A simple rule is:

Read → View

Write → View + Modify

Admin → Full module access

Best practices

Follow least-privilege access

Give users only the access they need to perform their responsibilities.

For example, an employee who only needs to view company documents should not receive Write or Admin access to the Documents module.

Use roles based on responsibilities

Create roles around job responsibilities rather than creating a separate role for every employee.

Common examples include:

• Administrator
• HR Manager
• HR Executive
• Reporting Manager
• Recruiter
• Employee

Limit Admin access

Admin permissions provide broad control over a module. Assign them only to users who are responsible for managing that area.

Review roles regularly

Review roles when:

• An employee changes responsibilities
• Someone becomes a manager
• A new module is introduced
• Responsibilities are transferred between teams
• An employee leaves the organization

Field reference

• Role name: A recognizable name for the access group.
• Module access: The ZestNexus areas the role can open.
• Read: Allows the user to view information.
• Write: Allows the user to view and modify information.
• Admin: Provides full access to the module, including administrative actions where supported.

Tip: Start with a small number of clearly defined roles and assign the lowest permission level that allows each user to do their work effectively.