The problem it solves: Users with only the Viewer role were logged out of PAC as soon as they opened the Payroll tab on a continuous payroll. To let them see results, admins had to grant the Manager role – which also lets them run payroll. Separately, role management read employee roles and role groups from two different places, so groups for newer modules weren’t shown and some group names weren’t translated.
What we built: The Viewer role now has the read access the Payroll tab needs – view-only users can open it and see results, reports and interface files, while generating custom continuous-payroll reports now needs a higher role. And role management now reads everything from one source: role groups load for every legal entity (including those with custom modules), every group has a translated name, and the same groups appear in the employee drawer, the roles table and the activity log.
What this means for your team
Right-sized access
give reporting-only users read access without payroll-running rights
No over-granting
stop using the Manager role as a workaround just to let someone see results
One consistent set of roles
the same complete, translated roles appear wherever you manage access
Audience at a glance
| Role | Primary action |
|---|---|
| Administrator | Assign Viewer to reporting-only users for read access; move Manager-workaround users back to Viewer; manage roles from one consistent place. |
India