Roles and permissions

Access in Sandly comes from roles, and each role is given for a scope: the whole organization, a unit (with or without the units below it), or a project. Someone who is Team lead for the Backend team approves that team’s hours and leave, and nobody else’s.

Give and remove roles under Admin → Users and access: open a person, then Give a role. Their panel lists What they can do, every permission with where it applies. A grant can have an end date, for an acting lead during someone’s leave. Removing a grant stops its access at once; it stays in their history and the audit log.

The default roles

Role	For	Can be given for
Employee	Every active user: logs their own time and requests their own leave	Everyone has it
Team lead	Approves a team’s hours and leave; sees its people and reports	A unit
Project manager	Approves hours and manages assignments on their projects; sees bill rates	A project (automatic for its manager)
HR	Employee records, contracts, compensation, leave policies and balances, reopening hours, equipment	The organization or a unit
Finance	Rates and costs, margins, month close, exchange rates, contractor invoices, the month-end package	The organization
Management	Company-wide utilization, bench, and margins; assignments; the skill catalog	The organization
Admin	Settings, structure, users, roles, integrations, the equipment register. No salaries by default	The organization

A project’s manager is its Project manager without a grant, and a project sub-team’s lead approves their members’ hours on that project the same way.

Admin and Employee are protected: they can’t be deleted. The last admin’s account stays active even when their employment ends, so the organization is never locked out.

Your own roles

Default roles are templates. Under Admin → Roles, edit one, or Copy it and adjust the copy: say, an IT role with only the equipment register. Choose what it can be given for and tick its permissions. Saving a role with sensitive permissions (salaries, personal data, sick leave) says so, so it isn’t done by accident.

Deactivating a role takes its permissions away from everyone who has it until you activate it again.

Every permission

Permission	What it allows
timesheet.log	Log and edit own time
timesheet.approve	Approve or reject timesheets in scope
timesheet.reopen	Reopen approved timesheets in scope
period.lock	Close and reopen months for time entry
leave.request	Request own leave
leave.approve	Approve or reject leave requests in scope
leave.sensitive.view	View sensitive leave details (e.g. sick leave)
leave.policy.manage	Manage leave types, policies, and public holidays
employee.view	View employee profiles (non-sensitive)
employee.edit	Edit employee records and contracts
employee.anonymize	Anonymize people who have left (cannot be undone)
compensation.view	View salary and cost rates
rates.bill.view	View bill rates
project.manage	Manage clients and projects
assignment.manage	Manage assignments and allocation
skill.manage	Manage the skill catalog
equipment.manage	Keep the equipment register: hand out and take back laptops and other equipment
report.hours.view	View hours reports
report.utilization.view	View utilization reports
report.finance.view	View margin and finance reports
report.payroll.view	View and download the month-end package: hours and absences per employee
finance.rates.manage	Enter the monthly exchange rates the margin report converts with
invoice.manage	Review and pay contractor invoices
audit.view	View the audit log
organization.manage	Manage organization settings and structure
admin.users.manage	Manage users and role grants
admin.roles.manage	Manage roles
admin.integrations.manage	Manage integrations

Sensitive data is guarded twice: seeing a salary needs compensation.view, seeing sick leave as sick leave needs leave.sensitive.view, and each time someone looks at another person’s salary or personal data, the audit log records it.