[{"data":1,"prerenderedAt":1059},["ShallowReactive",2],{"navigation":3,"\u002Fsecurity\u002Froles-and-permissions":395,"\u002Fsecurity\u002Froles-and-permissions-surround":1056},[4,23,53,78,107,142,166,202,238,277,306,361],{"title":5,"path":6,"stem":7,"children":8,"icon":22},"Getting Started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Usage","\u002Fgetting-started\u002Fusage","1.getting-started\u002F3.usage","i-lucide-sliders",{"title":18,"path":19,"stem":20,"icon":21},"Signing in on the mobile app","\u002Fgetting-started\u002Fmobile-app-sign-in","1.getting-started\u002F4.mobile-app-sign-in","i-lucide-smartphone",false,{"title":24,"icon":22,"path":25,"stem":26,"children":27,"page":22},"Billing & Plans","\u002Fbilling","10.billing",[28,33,38,43,48],{"title":29,"path":30,"stem":31,"icon":32},"Plans","\u002Fbilling\u002Fplans","10.billing\u002F1.plans","i-lucide-credit-card",{"title":34,"path":35,"stem":36,"icon":37},"Limits & Usage","\u002Fbilling\u002Flimits-and-usage","10.billing\u002F2.limits-and-usage","i-lucide-gauge",{"title":39,"path":40,"stem":41,"icon":42},"Managing Your Subscription","\u002Fbilling\u002Fmanaging-your-subscription","10.billing\u002F3.managing-your-subscription","i-lucide-receipt",{"title":44,"path":45,"stem":46,"icon":47},"Add-ons","\u002Fbilling\u002Fadd-ons","10.billing\u002F4.add-ons","i-lucide-puzzle",{"title":49,"path":50,"stem":51,"icon":52},"Integrations","\u002Fbilling\u002Fintegrations","10.billing\u002F5.integrations","i-lucide-plug",{"title":54,"icon":22,"path":55,"stem":56,"children":57,"page":22},"Settings","\u002Fsettings","11.settings",[58,62,66,70,74],{"title":59,"path":60,"stem":61},"General","\u002Fsettings\u002Fgeneral","11.settings\u002F1.general",{"title":63,"path":64,"stem":65},"Leave Types","\u002Fsettings\u002Fleavetype","11.settings\u002F2.leaveType",{"title":67,"path":68,"stem":69},"Carry Forward","\u002Fsettings\u002Fcarryforward","11.settings\u002F3.carryForward",{"title":71,"path":72,"stem":73},"Department Management","\u002Fsettings\u002Fdepartments","11.settings\u002F4.departments",{"title":75,"path":76,"stem":77},"Public Holidays","\u002Fsettings\u002Fpublicholiday","11.settings\u002F5.publicholiday",{"title":79,"path":80,"stem":81,"children":82,"page":22},"Mcp","\u002Fmcp","12.mcp",[83,88,92,97,102],{"title":84,"path":85,"stem":86,"icon":87},"Overview","\u002Fmcp\u002Foverview","12.mcp\u002F1.overview","i-lucide-bot",{"title":89,"path":90,"stem":91,"icon":52},"Connecting","\u002Fmcp\u002Fconnecting","12.mcp\u002F2.connecting",{"title":93,"path":94,"stem":95,"icon":96},"Tools Reference","\u002Fmcp\u002Ftools","12.mcp\u002F3.tools","i-lucide-wrench",{"title":98,"path":99,"stem":100,"icon":101},"Security","\u002Fmcp\u002Fsecurity","12.mcp\u002F4.security","i-lucide-shield",{"title":103,"path":104,"stem":105,"icon":106},"Integrating Your Own MCP Client","\u002Fmcp\u002Fcustom-client","12.mcp\u002F5.custom-client","i-lucide-code",{"title":108,"icon":22,"path":109,"stem":110,"children":111,"page":22},"Leave Management","\u002Fleave-management","2.leave-management",[112,117,122,127,132,137],{"title":113,"path":114,"stem":115,"icon":116},"Leave Management Overview","\u002Fleave-management\u002Foverview","2.leave-management\u002F1.overview","i-lucide-palmtree",{"title":118,"path":119,"stem":120,"icon":121},"Requesting Leave","\u002Fleave-management\u002Frequesting-leave","2.leave-management\u002F2.requesting-leave","i-lucide-calendar-plus",{"title":123,"path":124,"stem":125,"icon":126},"Leave Balances","\u002Fleave-management\u002Fleave-balances","2.leave-management\u002F3.leave-balances","i-lucide-wallet",{"title":128,"path":129,"stem":130,"icon":131},"Group Booking","\u002Fleave-management\u002Fgroup-booking","2.leave-management\u002F4.group-booking","i-lucide-users",{"title":133,"path":134,"stem":135,"icon":136},"Editing and Cancelling Leave","\u002Fleave-management\u002Fediting-and-cancelling","2.leave-management\u002F5.editing-and-cancelling","i-lucide-pencil",{"title":138,"path":139,"stem":140,"icon":141},"Leave Troubleshooting","\u002Fleave-management\u002Ftroubleshooting","2.leave-management\u002F6.troubleshooting","i-lucide-life-buoy",{"title":143,"icon":22,"path":144,"stem":145,"children":146,"page":22},"Approvals","\u002Fapprovals","3.approvals",[147,152,157,161],{"title":148,"path":149,"stem":150,"icon":151},"Approvals Overview","\u002Fapprovals\u002Foverview","3.approvals\u002F1.overview","i-lucide-check-check",{"title":153,"path":154,"stem":155,"icon":156},"Leave Approvals","\u002Fapprovals\u002Fleave-approvals","3.approvals\u002F2.leave-approvals","i-lucide-calendar-check",{"title":158,"path":159,"stem":160,"icon":42},"Expense Approvals","\u002Fapprovals\u002Fexpense-approvals","3.approvals\u002F3.expense-approvals",{"title":162,"path":163,"stem":164,"icon":165},"Time Approvals","\u002Fapprovals\u002Ftime-approvals","3.approvals\u002F4.time-approvals","i-lucide-clock-9",{"title":167,"icon":22,"path":168,"stem":169,"children":170,"page":22},"Time tracking & monitoring","\u002Ftime-tracking","4.Time Tracking",[171,176,181,186,190,194,198],{"title":172,"path":173,"stem":174,"icon":175},"Clocking In & Location","\u002Ftime-tracking\u002Fclock-in-and-location","4.Time Tracking\u002F5.clock-in-and-location","i-lucide-map-pin",{"title":177,"path":178,"stem":179,"icon":180},"Overtime & Pay-Period Lockdown","\u002Ftime-tracking\u002Fovertime-and-lockdown","4.Time Tracking\u002F6.overtime-and-lockdown","i-lucide-lock",{"title":182,"path":183,"stem":184,"icon":185},"Geofencing","\u002Ftime-tracking\u002Fgeofencing","4.Time Tracking\u002F7.geofencing","i-lucide-map",{"title":187,"path":188,"stem":189},"Time & Projects","\u002Ftime-tracking\u002Ftimeandprojects","4.Time Tracking\u002FTime&Projects",{"title":191,"path":192,"stem":193},"Time Tracking","\u002Ftime-tracking\u002Ftime-tracking","4.Time Tracking\u002FTime-tracking",{"title":195,"path":196,"stem":197},"Timeboard","\u002Ftime-tracking\u002Ftimeboard","4.Time Tracking\u002FTimeBoard",{"title":199,"path":200,"stem":201},"Timesheets","\u002Ftime-tracking\u002Ftimesheets","4.Time Tracking\u002FTimesheets",{"title":203,"icon":22,"path":204,"stem":205,"children":206,"page":22},"Expenses","\u002Fexpenses","5.expenses",[207,211,215,219,223,228,233],{"title":208,"path":209,"stem":210},"Expense Claims","\u002Fexpenses\u002Foverview","5.expenses\u002F1.overview",{"title":212,"path":213,"stem":214},"Add & Manage Purchases","\u002Fexpenses\u002Fpurchases","5.expenses\u002F2.purchases",{"title":216,"path":217,"stem":218},"Travel & Mileage Entry","\u002Fexpenses\u002Ftravelentries","5.expenses\u002F3.travelentries",{"title":220,"path":221,"stem":222,"icon":32},"Company Card Expenses","\u002Fexpenses\u002Fcompany-cards","5.expenses\u002F4.company-cards",{"title":224,"path":225,"stem":226,"icon":227},"Per Diems","\u002Fexpenses\u002Fper-diems","5.expenses\u002F5.per-diems","i-lucide-utensils",{"title":229,"path":230,"stem":231,"icon":232},"Receipt Scanning","\u002Fexpenses\u002Freceipt-scanning","5.expenses\u002F6.receipt-scanning","i-lucide-scan-line",{"title":234,"path":235,"stem":236,"icon":237},"Statuses & Submission","\u002Fexpenses\u002Fstatuses-and-submission","5.expenses\u002F7.statuses-and-submission","i-lucide-git-pull-request-arrow",{"title":239,"icon":22,"path":240,"stem":241,"children":242,"page":22},"Documents & E-Signatures","\u002Fdocuments","6.documents",[243,247,252,257,262,267,272],{"title":84,"path":244,"stem":245,"icon":246},"\u002Fdocuments\u002Foverview","6.documents\u002F1.overview","i-lucide-folder-open",{"title":248,"path":249,"stem":250,"icon":251},"Uploading Documents","\u002Fdocuments\u002Fuploading","6.documents\u002F2.uploading","i-lucide-upload",{"title":253,"path":254,"stem":255,"icon":256},"E-Signatures","\u002Fdocuments\u002Fe-signatures","6.documents\u002F3.e-signatures","i-lucide-pen-tool",{"title":258,"path":259,"stem":260,"icon":261},"Audit Trail & Certificate","\u002Fdocuments\u002Faudit-trail","6.documents\u002F4.audit-trail","i-lucide-file-check",{"title":263,"path":264,"stem":265,"icon":266},"Templates & Bulk Send","\u002Fdocuments\u002Ftemplates-and-bulk-send","6.documents\u002F5.templates-and-bulk-send","i-lucide-layout-template",{"title":268,"path":269,"stem":270,"icon":271},"Onboarding","\u002Fdocuments\u002Fonboarding","6.documents\u002F6.onboarding","i-lucide-user-plus",{"title":273,"path":274,"stem":275,"icon":276},"Offboarding","\u002Fdocuments\u002Foffboarding","6.documents\u002F7.offboarding","i-lucide-user-minus",{"title":278,"icon":22,"path":279,"stem":280,"children":281,"page":22},"People & HR","\u002Fpeople","7.people",[282,286,291,296,301],{"title":283,"path":284,"stem":285,"icon":131},"Directory & Profiles","\u002Fpeople\u002Fdirectory-and-profiles","7.people\u002F1.directory-and-profiles",{"title":287,"path":288,"stem":289,"icon":290},"Managing Users","\u002Fpeople\u002Fmanaging-users","7.people\u002F2.managing-users","i-lucide-user-cog",{"title":292,"path":293,"stem":294,"icon":295},"HR Records","\u002Fpeople\u002Fhr-records","7.people\u002F3.hr-records","i-lucide-folder-archive",{"title":297,"path":298,"stem":299,"icon":300},"Performance","\u002Fpeople\u002Fperformance","7.people\u002F4.performance","i-lucide-target",{"title":302,"path":303,"stem":304,"icon":305},"Training","\u002Fpeople\u002Ftraining","7.people\u002F5.training","i-lucide-graduation-cap",{"title":307,"icon":22,"path":308,"stem":309,"children":310,"page":22},"Features","\u002Ffeatures","8.features",[311,315,319,324,329,333,337,341,345,349,353,357],{"title":312,"path":313,"stem":314},"Dashboard","\u002Ffeatures\u002Fdashboard","8.features\u002F1.dashboard",{"title":316,"path":317,"stem":318},"SMTP troubleshoot","\u002Ffeatures\u002Fsmtp-troubleshoot","8.features\u002F10.smtp-troubleshoot",{"title":320,"path":321,"stem":322,"icon":323},"Notifications","\u002Ffeatures\u002Fnotifications","8.features\u002F11.notifications","i-lucide-bell",{"title":325,"path":326,"stem":327,"icon":328},"Reports","\u002Ffeatures\u002Freports","8.features\u002F12.reports","i-lucide-bar-chart-3",{"title":330,"path":331,"stem":332},"Calendar & Leave Overview","\u002Ffeatures\u002Fcalendar","8.features\u002F2.calendar",{"title":334,"path":335,"stem":336},"Calendar Integration","\u002Ffeatures\u002Fcalendar-integration","8.features\u002F3.calendar-integration",{"title":338,"path":339,"stem":340},"Schedules","\u002Ffeatures\u002Fschedules","8.features\u002F4.schedules",{"title":342,"path":343,"stem":344},"Project Management","\u002Ffeatures\u002Fprojects","8.features\u002F5.projects",{"title":346,"path":347,"stem":348},"Expense Settings","\u002Ffeatures\u002Fexpense-settings","8.features\u002F6.expense-settings",{"title":350,"path":351,"stem":352},"Auth0 SSO Integration","\u002Ffeatures\u002Fauth0-integration","8.features\u002F7.auth0-integration",{"title":354,"path":355,"stem":356},"Password & Authentication Policy","\u002Ffeatures\u002Fpolicies","8.features\u002F8.policies",{"title":358,"path":359,"stem":360},"Email Configuration (SMTP)","\u002Ffeatures\u002Femail-configuration","8.features\u002F9.email-configuration",{"title":362,"icon":22,"path":363,"stem":364,"children":365,"page":22},"Security & Privacy","\u002Fsecurity","9.security",[366,371,376,380,385,390],{"title":367,"path":368,"stem":369,"icon":370},"Security Overview","\u002Fsecurity\u002Foverview","9.security\u002F1.overview","i-lucide-shield-check",{"title":372,"path":373,"stem":374,"icon":375},"Authentication","\u002Fsecurity\u002Fauthentication","9.security\u002F2.authentication","i-lucide-log-in",{"title":377,"path":378,"stem":379,"icon":21},"Two-Factor & Devices","\u002Fsecurity\u002Ftwo-factor-and-devices","9.security\u002F3.two-factor-and-devices",{"title":381,"path":382,"stem":383,"icon":384},"Audit & Monitoring","\u002Fsecurity\u002Faudit-and-monitoring","9.security\u002F4.audit-and-monitoring","i-lucide-scroll-text",{"title":386,"path":387,"stem":388,"icon":389},"Account Deletion & Privacy","\u002Fsecurity\u002Faccount-deletion-and-privacy","9.security\u002F5.account-deletion-and-privacy","i-lucide-user-x",{"title":391,"path":392,"stem":393,"icon":394},"Roles & Permissions","\u002Fsecurity\u002Froles-and-permissions","9.security\u002F6.roles-and-permissions","i-lucide-key-round",{"id":396,"title":391,"body":397,"description":1049,"extension":1050,"links":1051,"meta":1052,"navigation":1053,"path":392,"seo":1054,"stem":393,"__hash__":1055},"docs\u002F9.security\u002F6.roles-and-permissions.md",{"type":398,"value":399,"toc":1033},"minimark",[400,404,421,431,436,500,504,533,536,543,573,580,609,612,634,637,644,668,672,689,701,705,715,719,933,939,954,958],[401,402,391],"h1",{"id":403},"roles-permissions",[405,406,407,408,412,413,416,417,420],"p",{},"Every user in BookYourPTO has exactly one ",[409,410,411],"strong",{},"role"," that determines what they can see and do. Two additional mechanisms refine access: the ",[409,414,415],{},"isApprover"," flag and ",[409,418,419],{},"department scoping",". This page explains all three so admins can assign access correctly and users understand what they're allowed to do.",[422,423,425],"callout",{"color":424,"icon":101},"blue",[405,426,427,430],{},[409,428,429],{},"The server is authoritative."," Every permission shown in the UI is re-checked and enforced on the backend. Hiding a button is a convenience, not a security boundary — the API rejects an action the caller isn't entitled to.",[432,433,435],"h2",{"id":434},"the-four-roles","The four roles",[437,438,439,452],"table",{},[440,441,442],"thead",{},[443,444,445,449],"tr",{},[446,447,448],"th",{},"Role",[446,450,451],{},"In one line",[453,454,455,466,480,490],"tbody",{},[443,456,457,463],{},[458,459,460],"td",{},[409,461,462],{},"Employee",[458,464,465],{},"Manages their own leave, time, and expenses.",[443,467,468,473],{},[458,469,470],{},[409,471,472],{},"Department Head",[458,474,475,476,479],{},"An employee who can also approve and manage their ",[409,477,478],{},"own department",".",[443,481,482,487],{},[458,483,484],{},[409,485,486],{},"Administrator",[458,488,489],{},"Manages the whole organization except executive-exclusive actions.",[443,491,492,497],{},[458,493,494],{},[409,495,496],{},"Executive",[458,498,499],{},"Everything an admin can, plus audit\u002Fsign-in logs, security\u002Fbranding, and org deletion.",[501,502,462],"h3",{"id":503},"employee",[505,506,507,515,518],"ul",{},[508,509,510,511,514],"li",{},"Create and manage their ",[409,512,513],{},"own"," leave, time entries, and expenses.",[508,516,517],{},"View their own data and edit personal settings (password, two-factor, profile).",[508,519,520,528,529,532],{},[409,521,522,523,527],{},"Cannot cancel their own ",[524,525,526],"em",{},"approved"," leave"," — they must submit a ",[409,530,531],{},"cancellation request"," for an approver to action.",[501,534,472],{"id":535},"department-head",[405,537,538,539,542],{},"Everything an employee can, ",[409,540,541],{},"scoped to their own department",", plus:",[505,544,545,548,557,563],{},[508,546,547],{},"View users.",[508,549,550,553,554,479],{},[409,551,552],{},"Approve \u002F reject \u002F cancel"," leave, expenses, and time for users ",[409,555,556],{},"in their department",[508,558,559,560,479],{},"Create leave for ",[409,561,562],{},"themselves and same-department users",[508,564,565,566,569,570,572],{},"Author ",[409,567,568],{},"employee notes"," and see the ",[409,571,297],{}," tab.",[405,574,575,576,579],{},"A department head ",[409,577,578],{},"cannot",":",[505,581,582,589,595,600],{},[508,583,584,585,588],{},"Approve ",[409,586,587],{},"their own"," requests.",[508,590,591,594],{},[409,592,593],{},"Edit compensation"," (admin\u002Fexecutive only).",[508,596,597,479],{},[409,598,599],{},"Create administrators or executives",[508,601,602,605,606,479],{},[409,603,604],{},"Publish schedules"," or ",[409,607,608],{},"override pay-period lockdown",[501,610,486],{"id":611},"administrator",[505,613,614,620,626,631],{},[508,615,616,617,479],{},"Manage ",[409,618,619],{},"users, departments, leave types, org settings, reporting structure, group bookings, and locked dates",[508,621,622,625],{},[409,623,624],{},"Approve \u002F cancel any"," leave (not just one department).",[508,627,628,479],{},[409,629,630],{},"Manage billing",[508,632,633],{},"Everything except the executive-exclusive actions below.",[501,635,496],{"id":636},"executive",[405,638,639,640,643],{},"Everything an administrator can do, ",[409,641,642],{},"plus"," the exclusive abilities to:",[505,645,646,656,661],{},[508,647,648,651,652,655],{},[409,649,650],{},"View and export audit logs and sign-in logs"," (see ",[653,654,381],"a",{"href":382},").",[508,657,616,658,479],{},[409,659,660],{},"branding and security settings",[508,662,663,651,666,655],{},[409,664,665],{},"Delete the entire organization",[653,667,386],{"href":387},[432,669,671],{"id":670},"the-isapprover-flag","The isApprover flag",[405,673,674,677,678,681,682,685,686,688],{},[675,676,415],"code",{}," is a ",[409,679,680],{},"per-user flag",", independent of role. It grants ",[409,683,684],{},"approve \u002F reject \u002F queue"," access — even to a plain ",[409,687,462],{}," — without changing their role.",[422,690,692],{"color":424,"icon":691},"i-lucide-info",[405,693,694,697,698,700],{},[409,695,696],{},"Use it for"," a senior team member who should approve requests but shouldn't gain admin powers. Flip ",[675,699,415],{}," on instead of promoting them.",[432,702,704],{"id":703},"department-scoping","Department scoping",[405,706,707,708,710,711,714],{},"A ",[409,709,472],{},"'s reach is bounded to users who share their department. They can only view and act on people in the ",[409,712,713],{},"same department"," — the server enforces this on every department-scoped action.",[432,716,718],{"id":717},"capability-matrix","Capability matrix",[437,720,721,739],{},[440,722,723],{},[443,724,725,728,731,734,737],{},[446,726,727],{},"Capability",[446,729,462],{"align":730},"center",[446,732,733],{"align":730},"Dept Head",[446,735,736],{"align":730},"Admin",[446,738,496],{"align":730},[453,740,741,755,771,789,809,822,834,847,859,875,888,903,918],{},[443,742,743,746,749,751,753],{},[458,744,745],{},"Manage own leave\u002Ftime\u002Fexpenses",[458,747,748],{"align":730},"Yes",[458,750,748],{"align":730},[458,752,748],{"align":730},[458,754,748],{"align":730},[443,756,757,762,765,767,769],{},[458,758,759,760,527],{},"Cancel own ",[409,761,526],{},[458,763,764],{"align":730},"No (request it)",[458,766,764],{"align":730},[458,768,748],{"align":730},[458,770,748],{"align":730},[443,772,773,778,783,785,787],{},[458,774,775,776],{},"Approve in ",[409,777,478],{},[458,779,780,781],{"align":730},"If ",[675,782,415],{},[458,784,748],{"align":730},[458,786,748],{"align":730},[458,788,748],{"align":730},[443,790,791,797,802,805,807],{},[458,792,584,793,796],{},[409,794,795],{},"any"," department",[458,798,780,799,801],{"align":730},[675,800,415],{},"*",[458,803,804],{"align":730},"No",[458,806,748],{"align":730},[458,808,748],{"align":730},[443,810,811,814,816,818,820],{},[458,812,813],{},"View users",[458,815,804],{"align":730},[458,817,748],{"align":730},[458,819,748],{"align":730},[458,821,748],{"align":730},[443,823,824,826,828,830,832],{},[458,825,593],{},[458,827,804],{"align":730},[458,829,804],{"align":730},[458,831,748],{"align":730},[458,833,748],{"align":730},[443,835,836,839,841,843,845],{},[458,837,838],{},"Create admins\u002Fexecs",[458,840,804],{"align":730},[458,842,804],{"align":730},[458,844,748],{"align":730},[458,846,748],{"align":730},[443,848,849,851,853,855,857],{},[458,850,604],{},[458,852,804],{"align":730},[458,854,804],{"align":730},[458,856,748],{"align":730},[458,858,748],{"align":730},[443,860,861,863,865,867,871],{},[458,862,630],{},[458,864,804],{"align":730},[458,866,804],{"align":730},[458,868,869],{"align":730},[409,870,748],{},[458,872,873],{"align":730},[409,874,748],{},[443,876,877,880,882,884,886],{},[458,878,879],{},"Manage org settings",[458,881,804],{"align":730},[458,883,804],{"align":730},[458,885,748],{"align":730},[458,887,748],{"align":730},[443,889,890,893,895,897,899],{},[458,891,892],{},"View\u002Fexport audit & sign-in logs",[458,894,804],{"align":730},[458,896,804],{"align":730},[458,898,804],{"align":730},[458,900,901],{"align":730},[409,902,748],{},[443,904,905,908,910,912,914],{},[458,906,907],{},"Branding & security settings",[458,909,804],{"align":730},[458,911,804],{"align":730},[458,913,804],{"align":730},[458,915,916],{"align":730},[409,917,748],{},[443,919,920,923,925,927,929],{},[458,921,922],{},"Delete the organization",[458,924,804],{"align":730},[458,926,804],{"align":730},[458,928,804],{"align":730},[458,930,931],{"align":730},[409,932,748],{},[405,934,935,936,938],{},"* ",[675,937,415],{}," grants approval access according to how the approver is assigned; department heads remain bound by department scoping.",[422,940,942],{"color":941,"icon":32},"amber",[405,943,944,951,952,479],{},[409,945,946,947,950],{},"Billing is admin ",[524,948,949],{},"or"," executive"," — not executive-only. Either role can manage the subscription. See ",[653,953,29],{"href":30},[432,955,957],{"id":956},"troubleshooting","Troubleshooting",[437,959,960,973],{},[440,961,962],{},[443,963,964,967,970],{},[446,965,966],{},"Symptom",[446,968,969],{},"Cause",[446,971,972],{},"Fix",[453,974,975,986,997,1008,1019],{},[443,976,977,980,983],{},[458,978,979],{},"\"Request cancellation\" instead of a Cancel button on approved leave",[458,981,982],{},"Employees\u002Fdept heads can't cancel their own approved leave.",[458,984,985],{},"Submit a cancellation request for an approver to action.",[443,987,988,991,994],{},[458,989,990],{},"A dept head can't see a user",[458,992,993],{},"The user is in a different department.",[458,995,996],{},"Department scoping limits heads to their own department; an admin must act, or move the user.",[443,998,999,1002,1005],{},[458,1000,1001],{},"Settings → Security returns 403",[458,1003,1004],{},"Audit\u002Fsign-in logs are Executive-only.",[458,1006,1007],{},"Ask an executive, or have your role reviewed.",[443,1009,1010,1013,1016],{},[458,1011,1012],{},"Can't edit a salary field",[458,1014,1015],{},"Compensation is admin\u002Fexecutive only.",[458,1017,1018],{},"An administrator or executive must make the change.",[443,1020,1021,1024,1027],{},[458,1022,1023],{},"An employee needs to approve requests",[458,1025,1026],{},"They're an employee without approval rights.",[458,1028,1029,1030,1032],{},"Set their ",[675,1031,415],{}," flag instead of promoting them.",{"title":1034,"searchDepth":1035,"depth":1036,"links":1037},"",1,2,[1038,1045,1046,1047,1048],{"id":434,"depth":1036,"text":435,"children":1039},[1040,1042,1043,1044],{"id":503,"depth":1041,"text":462},3,{"id":535,"depth":1041,"text":472},{"id":611,"depth":1041,"text":486},{"id":636,"depth":1041,"text":496},{"id":670,"depth":1036,"text":671},{"id":703,"depth":1036,"text":704},{"id":717,"depth":1036,"text":718},{"id":956,"depth":1036,"text":957},"The four BookYourPTO roles — Employee, Department Head, Administrator, Executive — what each can do, the isApprover flag, and department scoping.","md",null,{},{"icon":394},{"title":391,"description":1049},"tNkbO4OZ96nvGBMFctkwdx5cdYyFgEX7zGWkb_pRXxk",[1057,1051],{"title":386,"path":387,"stem":388,"description":1058,"icon":389,"children":-1},"GDPR\u002FCCPA controls in BookYourPTO — delete your account or organization with an emailed code, export your data, opt out of third-party syncs, and understand anonymization.",1781157135169]