About roles and permissions
Roles let you delegate parts of the payroll process to administrative users in your company without granting everyone full access to the books. Each role has a distinct set of permissions — or points of systematic access to company information and administrative actions — that are either enabled or disabled in OnPay.
Administrative users in OnPay will have one of the following roles:
- Owner
- HR Manager
- Approver
- Controller
- Outside Collaborator
This article details what each role can — and can't — do in OnPay.
IMPORTANT: Permissions are assigned to roles, roles are assigned to users
When assigning roles to administrators in OnPay, they are granted instant access to all permissions associated with that role.
This lets you control some pretty important things, like exactly who can see who's compensation information, who can run payroll, hire outside accountants or consultants run your payroll, and much more.
What we'll cover
Company Menu
The Company menu is where you do things like add users and adjust company settings, or set up pay items, workplaces, accruals, and even integrations with accounting and timekeeping software.
Summary of Company permissions by role
Owner
An Owner has full view and edit access to the company profile. They can see the company bank account, and verify test debits and credits.
HR Manager
While an HR Manager doesn’t have access to the company section, they can still enter payroll for the employees they supervise. They cannot finalize payroll.
Approver
An Approver can do just about anything the Owner can do, except:
- Add or remove users
- See the company bank account
- Verify test debits and credits
Controller
A Controller also has near-full access to everything, including entering payroll, but cannot:
- Add or remove users
- Change company preferences
- Finalize payroll
Outside Collaborator
An Outside Collaborator is an administrative user who is not an employee of the company, but has access to manage payroll on the company's behalf. This is often a member of an accounting firm, but this role can be used for anyone who a company wishes to grant access to part or all of their company account. The Outside Collaborator's access will vary depending on how they are added to the company.
If the company is enrolled in OnPay by the Outside Collaborator:
- Can add or remove other Outside Collaborators
- Can run payroll
- Can not add or remove company-level users
See all Company permissions by role
Role |
Owner |
HR Manager |
Approver |
Controller |
Outside Collaborator |
Company Menu |
✓ |
No Access |
✓ |
✓ |
✓ |
Add/Remove Users |
✓ | No Access | No Access |
No Access |
No Access |
Integrations |
✓ |
No Access |
✓ |
✓ |
✓ |
Taxes |
✓ | No Access | ✓ | ✓ | ✓ |
Pay Items |
✓ | No Access | ✓ | ✓ | ✓ |
Worker Deductions |
✓ | No Access | ✓ | ✓ | ✓ |
Loc/Dep/Pos |
✓ | No Access | ✓ | ✓ | ✓ |
Role |
Owner |
HR Manager |
Approver |
Controller |
Outside Collaborator |
Workers' Comp |
✓ | No access | ✓ | ✓ | ✓ |
Accrual Policies |
✓ | No access | ✓ | ✓ | ✓ |
Payment History |
✓ | No access | ✓ | ✓ | ✓ |
Bank Transactions* |
✓ | No access | ✓ | ✓ | ✓ |
Company Preferences |
✓ | No access | ✓ | No access | ✓ |
Full Payroll |
✓ | Can't finalize | ✓ | Can't finalize | ✓** |
Tax Filings |
✓ | No access | ✓ | ✓ | ✓ |
* Bank Transactions are the debits and credits resulting from payroll ACH. Once a company bank account has been verified, it can only be changed by contacting OnPay. This is to protect your account.
**If allowed by the company Owner. See how→
HR Menu
In the HR menu, you can approve PTO requests, view the employee directory, create file checklists, and more.
Summary of HR permissions by role
Owner
An Owner has full view and edit access to the HR menu.
HR Manager
An HR Manager does not have access to the HR menu.
Approver, Controller, Outside Collaborator
These roles have full view and edit access to the HR menu.
See all HR permissions by role
Role |
Owner |
HR Manager |
Approver |
Controller |
Outside Collaborator |
HR Menu |
✓ |
No access |
✓ | ✓ | ✓ |
Approve PTO |
✓ | No access | ✓ | ✓ | ✓ |
View Org Chart |
✓ |
No access |
✓ | ✓ | ✓ |
View Employee Directory |
✓ | No access | ✓ | ✓ | ✓ |
View Employee Offers | ✓ | No access | ✓ | ✓ | ✓ |
Create File Checklists |
✓ | No access | ✓ | ✓ | ✓ |
Edit File Audit |
✓ | No access | ✓ | ✓ | ✓ |
Complete File Reviews |
✓ | No access | ✓ | ✓ | ✓ |
Role |
Owner |
HR Manager |
Approver |
Controller |
Outside Collaborator |
Create Personnel Task |
✓ | No access | ✓ | ✓ | ✓ |
Onboarding Tasks |
✓ | No access | ✓ | ✓ | ✓ |
Templates |
✓ | No access | ✓ | ✓ | ✓ |
Task Templates |
✓ | No access | ✓ | ✓ | ✓ |
Custom Forms |
✓ | No access | ✓ | ✓ | ✓ |
Worker Files |
✓ | No access | ✓ | ✓ | ✓ |
Company Files |
✓ | No access | ✓ | ✓ | ✓ |
Engagement |
✓ | No access | ✓ | ✓ | ✓ |
Reports
With Reports, you can analyze expenses and make better business decisions. While our report designer lets you include any information you want, we also have all the built-in reports you need every day ready to go. Our reports even adapt automatically to include items that are specific to your business.
Summary of Reports permissions by role
Owner
An Owner has access to all reports.
HR Manager
An HR Manager will have limited reporting for assigned employees only, with no access to employee or location summaries, accrual listings and retirement exports.
Approver, Controller, Outside Collaborator
These roles have access to all reports.
See all Reports permissions by role
Role |
Owner |
HR Manager |
Approver |
Controller |
Outside Collaborator |
Reports |
✓ |
Assigned employees |
✓ | ✓ | ✓ |
Payroll Listing |
✓ | Assigned employees | ✓ | ✓ | ✓ |
Earnings Summary |
✓ |
Assigned employees |
✓ | ✓ | ✓ |
Payroll Register |
✓ | Assigned employees | ✓ | ✓ | ✓ |
Payroll Summary | ✓ | Assigned employees | ✓ | ✓ | ✓ |
Employee Summary |
✓ | No access | ✓ | ✓ | ✓ |
Loc/Dep/Pos summary |
✓ | No access | ✓ | ✓ | ✓ |
Role |
Owner |
HR Manager |
Approver |
Controller |
Outside Collaborator |
GL Summary |
✓ | Assigned employees | ✓ | ✓ | ✓ |
Accrual Listing |
✓ | No access | ✓ | ✓ | ✓ |
WC Listing |
✓ | Assigned employees | ✓ | ✓ | ✓ |
WC Summary |
✓ | Assigned employees | ✓ | ✓ | ✓ |
Retirement Listing |
✓ | Assigned employees | ✓ | ✓ | ✓ |
Retirement Summary |
✓ | Assigned employees | ✓ | ✓ | ✓ |
Retirement Export |
✓ | No access | ✓ | ✓ | ✓ |
Notifications
Notifications keep everyone updated on things like the progress of tasks, new deadlines, or actions taken in OnPay by other users. What notifications you receive can depend on your role, managed settings, or the notification's relevance to your employees.
Summary of Notifications permissions by role
Owner
An Owner will receive all notifications.
HR Manager
An HR Manager will only receive paycheck confirmation notifications.
Approver
An Approver will receive all notifications, except for paycheck confirmation.
Controller
A controller will only receive paycheck confirmation notifications.
Outside Collaborator
An Outside Collaborator will receive almost all notifications.
Employee
An employee will only receive paycheck notifications.
See all Notifications permissions by role
Role |
Owner |
HR Manager |
Approver |
Controller |
Outside Collaborator |
Employee |
Payroll is due |
✓ | ✗ | ✓ | ✗ |
Limited |
✗ |
Employee direct deposit is changed |
✓ | ✗ | ✓ | ✗ |
✗ |
✓ |
Employee address changed |
✓ | ✗ | ✓ | ✗ |
✓ |
✓ |
Employee Tax Withholding |
✓ | ✗ | ✓ | ✗ | ✓ | ✗ |
Employee PTO request | ✓ | ✗ | ✓ | ✗ | ✓ |
✗ |
Employee invitation is complete |
✓ | ✗ | ✓ | ✗ | ✓ | ✗ |
You’ve been paid! |
✓ | ✗ | ✗ | ✗ | ✗ | ✓ |
Login from a new browser |
✓ | ✓ | ✓ | ✓ | ✓ |
✓ |
Employee Portal
Employees have a different dashboard than other roles in the company, called the Employee Portal. There, they can edit their personal info, see their paycheck and pay history, complete HR tasks assigned to them, even print their own W-2s. There are some things an employee can't do here, like change their own address without approval. These restrictions ensure employee tax withholdings and W-2s are processed correctly.
Note: Employees have lifetime access to this portal, ensuring their year-end forms and documents available to them forever, so you don't have to.
See all employee Portal permissions for employees
Access |
Employee can view |
Employee can edit |
View Pay Stub |
✓ | Download and print only |
Assigned HR tasks |
✓ | Can mark as completed |
Personal Info |
✓ | Name, number, birthdate, or SSN if approved by a supervisor |
Job |
✓ | Changes to FIT or SIT must be approved by a supervisor |
Bank Account | ✓ | New bank accounts must be approved by a supervisor |
Request PTO |
✓ | Time off requests must be approved by a supervisor |
Company Files |
✓ | Can upload files |
W-2 |
✓ | Download and print only |
Partner Dashboard
The Partner Dashboard allows accountants to manage all their client's payroll in one place. There are two levels of access within the firm: Members and Administrators.
Summary of Partner Dashboard permissions by role
Members
A member is an employee of the firm who can only access the accounts they manage. They do not have the ability to add or change user access.
Administrators
An Administrator can view all accounts and manage user access in OnPay. There can be multiple administrators on a dashboard.
See all Partner Dashboard permissions by role
Access |
Members |
Administrators |
Enroll new accounts in the dashboard |
✓ | ✓ |
Add and Remove client-level users |
Limited* | Limited* |
Access companies they are assigned to |
✓ | ✓ |
Add/remove other firm-level members to an account as an outside collaborator |
✗ | ✓ |
Access to the FULL partner dashboard |
✗ | ✓ |
Create offices for the firm dashboard | ✗ | ✓ |
Add/remove members to the dashboard |
✗ | ✓ |
*Outside Collaborators:
- Can only add Owners to accounts they've enrolled
- Can add up to three client users at the Owner level
- To remove Owners, email partners@onpay.com
Employee information
In OnPay, Employee information is used for everything from printing checks to withholding taxes, and includes private information like their home address, social security number, and pay rate. This means that access to employee information is restricted, based on your access level and your connection to the employee.
Summary of Employee information permissions by role
Owner
An Owner has full access to the profile
HR Manager
An HR Manager can only manage the payroll of the employees assigned to them. They have no access to the email builder used to invite an employee to complete their onboarding process. However, they can manually hire employees. Note: HR Managers can not finalize payroll or view reports.
When viewing assigned employees, HR Managers can:
- Enter hours
- Update HR information in employee profiles
- Send email invitation to the Employee Portal
- Manage checklists
- File Audit - Create personnel task
- View personnel files and upload documents
- Create new Notes
- Start conversations
- View custom forms
Approver
An Approver has full access to the profile
Controller
A Controller has full access to the employee profile except their bank account
Outside Collaborator
✱An Outside Collaborator can run and approve payroll if this access is granted by the Owner. All Outside Collaborators have full access to the employee profile, with the exception of their bank account.
See all Employee information access by role
Role |
Owner |
HR Manager |
Approver |
Controller |
Outside Collaborator |
Home Address |
✓ | ✓ | ✓ | ✓ | ✓ |
Run Payroll |
✓ | Enter hours only | ✓ |
Can't finalize |
✱ |
Add Compensation |
✓ | ✓ | ✓ | ✓ | ✓ |
Add Deductions |
✓ | ✓ | ✓ | ✓ | ✓ |
Withholding | ✓ | ✓ | ✓ | ✓ | ✓ |
Bank account |
✓ | ✗ | The ✓ | ✗ | ✗ |
Emergency Info |
✓ | ✓ | ✓ | ✓ | ✓ |
Role |
Owner |
HR Manager |
Approver |
Controller |
Outside Collaborator |
Create a task for the employee |
✓ | ✓ | ✓ | ✓ | ✓ |
Assign Time off Policies | ✓ | ✓ | ✓ | ✓ | ✓ |
Hire worker send an offer letter |
✓ | ✗ | ✓ | ✓ | ✓ |
Add an employee |
✓ | ✓ | ✓ | ✓ | ✓ |
Add a contractor |
✓ | Invite only | ✓ | ✓ | ✓ |
View checks / w-2 |
✓ | ✓ | ✓ | ✓ | ✓ |
Audit Log |
✓ | ✓ | ✓ | ✓ | ✓ |
v6.22