Manage permissions and access control

Control which flair features and Salesforce records each user can access. This guide covers flair permission sets, permission set groups, visibility scopes, targeted permission sets, custom permissions, and Admin Monitoring.

Who can use this?

Salesforce Admins who manage users, licenses, permission sets, objects, and sharing access in Salesforce Setup.

Before you begin

• Assign each user a flair license.
• Review the user's Salesforce profile and existing permission sets before adding access.
• Use flair's maintained permission sets or permission set groups when they cover the required role.

Review flair permission sets

flair provides permission sets for different HR and Recruiting roles. Each set grants View or Modify access to selected Salesforce objects.

1. In Salesforce Setup, open Permission Sets.
2. Find sets with the Flair prefix.
3. Read each description to understand its intended role.

To inspect the exact object access in a set:

1. In Salesforce, open Setup.

   

   

2. In Quick Find, enter Permission.

   

3. Open Permission Sets.

   

4. Select a set, such as Flair Engagement Manager.

   

5. Click View Summary.

   

6. Click Object Permissions.

   

The summary shows Read, Create, Edit, Delete, View All, and Modify All access. Use it to review assignments, troubleshoot access, plan changes, or document your security configuration.

Choose the right permission set

Use these tables to pick the flair permission set for a role. Names match the Label shown in Setup → Permission Sets.

HR and administration

Permission set	Intended for	What it unlocks
Flair Manager	Full HR admins	All HR features, including most tiles on the HR Admin page, the Doctor tab, and the Employee Hub Login as this employee action. View All access to most flair records, so visibility scopes don't restrict it.
Flair Manager Bundle	Full HR admins	A permission set group that contains only Flair Manager. Assign it when you manage access through groups.
Flair Employee Management	HR admins whose access you want to restrict	Employee data and most HR features, with the same custom permissions as Flair Manager except Flair Manager Hub Login, Pay Transparency Manager, Delete Compensation Review, and Revert Compensation Review.
Flair Absence Manager	Absence administrators	Absence Categories and Policies on the HR Admin page, and the absence sections on employee records.
Flair Attendance Manager	Time-tracking administrators	Managing employee attendance. Adds Workload Templates, Workload Flexible Week Templates, Time Frameworks, and Batch Create Holiday Calendars on the HR Admin page.
Flair Documents Manager	Document administrators	Managing employee documents, company documents, and document templates. Adds Document Builder Templates on the HR Admin page.
Flair Engagement Manager	Engagement administrators	Engagement features such as feedback cycles and skills. Adds Tags on the HR Admin page.
Flair Expenses	Expense administrators	Expenses, expense groups, and merchants. Adds Merchants, Expense Categories, Expense Rules Templates, and Tax Manager on the HR Admin page.
Flair Workflows	Onboarding and offboarding administrators	Workflows, workflow templates, and evaluation templates, and the workflows section on employee records.
Flair Onboarding	Onboarding administrators	Creating new employees from a candidate and assigning a workload, position, and workflow.
Flair Inventory	Inventory administrators	Creating and managing employees' inventory.
Flair Ticketing Manager	HR help desk agents	Tickets and ticket policies in the HR help desk.
Flair Shift Planner Manager	Shift planning administrators	The shift-planning configuration on employee records, shifts, and employee availability.
Flair Scheduler Admin	Scheduling administrators	Creating and managing schedulers, and creating shifts in any scheduler.
Flair Scheduler Manager	Shift planners	Viewing schedulers and creating shifts in any scheduler.
Flair Kiosk Manager	Time-tracking administrators	Managing kiosks.
Flair LMS Manager	Learning administrators	Courses, employee courses, and the learning tabs on employee records.
Flair Advanced Development Manager	Performance administrators	The Advanced Development feature: objectives and calibration.
Flair Position-Job Management	Organization designers	Roles, role families, career levels, and worker categories, the Company Structure tab, and read access to positions.
Flair Projects	Project administrators	The Projects feature.
Flair Visibility Scope Management	Security administrators	Creating, editing, and deleting every Employee Visibility Scope record.
Flair Doctor	HR admins who run Doctor tools	Access to the Apex classes behind the tools on the HR Admin → Doctor tab. Must be assigned explicitly. See Use Flair Doctor.

Compensation and payroll

Permission set	Intended for	What it unlocks
Flair Payroll Manager	Payroll administrators	Sensitive salary, bonus, and additional compensation data, with View All access to salary and payroll records. Adds Payroll Territories and Cost Centers on the HR Admin page.
Flair Payroll Management	Payroll administrators you want to restrict	Sensitive salary, bonus, and additional compensation data, like Flair Payroll Manager, but without View All access to salary and payroll records. Adds Payroll Territories and Cost Centers on the HR Admin page.
Flair Salary Manager	Compensation administrators	Individual salary, bonus, and additional compensation figures. On the Budgets reporting page, it also reveals per-salary amounts and the uncovered-salaries list.
Flair Budget Manager	Budget owners	Creating and managing budgets, and the Budgets reporting page with totals, forecast, and coverage. Shows sums only, never individual salaries. Pair it with Flair Salary Manager for per-salary figures.
Flair Compensation Management Edit	Compensation administrators	Editing pay configurations and related compensation management data.
Flair Compensation Management Read	Compensation reviewers	Reading pay configurations and related compensation management data.

Recruiting

Permission set	Intended for	What it unlocks
Flair Recruiter	Recruiters	Managing jobs, candidates, talents, and career page settings, with View All access to recruiting records.
Flair Recruitment Management	Recruiters you want to restrict	Managing jobs, candidates, talents, and career page settings, without View All access to candidates and jobs.
Flair Hiring Manager	Hiring managers	Jobs, candidates, evaluations, and the recruiting inbox.
Flair Job Advertising	Recruiters who publish job ads	The job advertising feature.

Integration users and special sets

Assign these only to the user the permission set is designed for:

Permission set	Intended for	What it unlocks
Flair Hub Integration	The Employee Hub integration user	Permissions for the connected Employee Hub user.
Flair Career Portal Integration	The career portal integration user	Permissions for the career portal integration.
Flair Beta	Testing only	Upcoming features. Don't use it in production or base business decisions on it.
Flair Employee Self Service	Not applicable	Ships empty in the current package and grants no access.

Custom permissions

flair features also check custom permissions. The permission sets in the previous tables already include the custom permissions they need; add a custom permission to your own permission set only when you build a custom role.

Custom permission	What it unlocks	Included in
HR Manager	HR admin features across flair, including the Dictionaries, Request Forms, and Integrations tabs on the HR Admin page	Flair Manager, Flair Employee Management
Absences Manager	Absence Categories and Policies on the HR Admin page, and absence sections on employee records	Flair Manager, Flair Employee Management, Flair Absence Manager
Attendance Manager	Workload and time-framework tiles on the HR Admin page, and workloads on employee records	Flair Manager, Flair Employee Management, Flair Attendance Manager
Documents Manager	Document Builder Templates on the HR Admin page, and documents on employee records	Flair Manager, Flair Employee Management, Flair Documents Manager
Create Document Templates	Creating new document templates	Flair Manager, Flair Employee Management
Engagement Manager	Tags on the HR Admin page	Flair Manager, Flair Employee Management, Flair Engagement Manager
Expenses Manager	Expense tiles on the HR Admin page, and the expenses card on employee records	Flair Manager, Flair Employee Management, Flair Expenses
Workflows Manager	Workflows on employee records and the HR home page	Flair Manager, Flair Employee Management, Flair Workflows
Shift Planner Manager	Shift-planning sections on employee records	Flair Manager, Flair Employee Management, Flair Shift Planner Manager
Payroll Manager	Payroll Territories and Cost Centers on the HR Admin page, and compensation related lists on employee records	Flair Payroll Manager, Flair Payroll Management
Salary Manager	Individual employee salary figures	Flair Salary Manager
Budget Manager	The Budgets reporting page and budget management, without individual salary amounts	Flair Budget Manager
Pay Transparency Manager	The Equity Audits page: running, reading, and exporting a company pay gap analysis	Flair Manager, Flair Salary Manager, Flair Budget Manager
Delete Compensation Review	Deleting Compensation Review Setups, their reviews, and single Compensation Reviews	Flair Manager
Revert Compensation Review	Reverting an executed Compensation Review, which restores previous salaries	Flair Manager
Use Doctor Tools	The Doctor tab on the HR Admin page	Flair Manager, Flair Employee Management
Flair Manager Hub Login	Login as this employee on an employee record (enforced on the server). It also shows the Send login link to private email button, but doesn't block that action. See Control who can log in as an employee.	Flair Manager
LMS Manager	The learning tabs on employee records	Flair LMS Manager
Advanced Development Manager	Objective time periods in the feedback cycle form	Flair Advanced Development Manager
Job Advertising	Advertising jobs	Flair Job Advertising
Flair Position-Job Management	Job features on the position management page	Flair Position-Job Management
Can Update Locked Payroll Run	Adding deductions to a locked Payroll Run. See Assign custom permissions.	None; assign it yourself
Update Time Entries After Payroll Run Is Completed	Updating time entries after a payroll run is completed	None; assign it yourself
Delete Employee with Related Records	Deleting an employee and its related records	None; assign it yourself
Flair Import Employee Data and Build the Company Hierarchy	Migrate Employees to Position Management Structure on the HR Admin page, and editing the employee fields that position management otherwise locks	None; assign it yourself

Create and assign a permission set group

Permission set groups combine modular permission sets for a role or persona. For example, a group for an HR manager who also handles payroll can combine Flair Manager and Flair Payroll Manager.

flair is moving new features to new modular permission sets and permission set groups. Existing permission sets remain unchanged for backward compatibility. Assign permission set groups for future feature access; a user can receive more than one group when roles overlap.

Permission set groups have these Salesforce constraints:

• Permission set groups must be enabled before a subscriber installs or uninstalls a package that contains them.
• Groups installed from managed packages do not count against the maximum number of groups created. Limits for created and installed groups vary by Salesforce edition.
• Some Salesforce editions cannot create or customize groups, but they can install and use groups from managed packages.
• A managed-package group uses the package namespace to avoid a naming collision with a local group.
• To delete a group from a managed package, uninstall the package.
• You can add and remove local permission sets in a group installed from a managed package.

warning

Do not duplicate and modify a maintained flair permission set. The copy does not receive flair permission updates and can become outdated.

Salesforce provides more information about permission set groups, and this video demonstrates the workflow:

Create the group

1. In Salesforce, click the setup gear.

2. Select Setup.

3. In Quick Find, enter permission set groups.

4. Open Permission Set Groups.

5. Click New Permission Set Group.

   

6. Enter a Label and Description.

7. Click Save.

   

Add permission sets to the group

1. In the group, click Permission Sets in Group.

2. Click Add Permission Set.

   

3. Select the permission sets to include.

4. Click Add.

   

Assign the group

1. In Permission Set Groups, select the group.

2. Click Manage Assignments.

   

3. Click Add Assignment.

4. Select the user.

5. Click Next.

6. Choose whether the assignment expires.

7. Click Assign.

   

Create a muting permission set

A muting permission set removes selected access only within one permission set group. It does not change the individual sets. For example, mute Delete access when HR managers can view payroll details but must not delete them.

1. Open the permission set group.

2. Click Muting Permission Sets in Group.

   

3. Click New.

4. Enter a Label.

5. Click Save.

   

Choose permissions to mute

1. Open the muting permission set.

2. Click Object Settings.

   

3. Select the object to restrict.

   

4. Review Tab Settings, Object Permissions, and Field Permissions.

5. Click Edit.

   

6. Select Muted next to each permission to restrict.

7. Click Save.

   

8. In the permission set group, open Object Settings to confirm that the muted access overrides the original permission.

   

Configure visibility scopes

Visibility scopes restrict records by department, location, or entity after permission sets grant object access.

warning

Visibility scopes do not restrict users with View All or Modify All access. This includes Flair Manager, Flair Payroll Manager, Flair Recruiter, and users with the System Administrator profile.

Connect a Salesforce user to an employee

1. In Staff or Employees (or the legacy Staff & Docs tab), open the employee record.

2. In Salesforce User, select the matching Salesforce user.

3. Click Save.

   

   

Create and assign an entity

An entity can represent a division or another employee group.

1. In the App Launcher (⋮⋮ grid icon), open Entities.

   

2. Click New.

3. Enter a name.

4. Click Save.

   

   

5. Open an employee record.

6. In the contract section, select the entity in Entity.

7. Click Save.

   

8. Optional: Assign jobs and candidates to the entity.

   

Create the visibility scope

1. In the App Launcher (⋮⋮ grid icon), open Employee Visibility Scopes.

2. Click New.

   

   

3. Enter a name.

4. Select the employee or employee group that receives the scope.

5. Under Scopes, select the entity to share.

6. Optional: Select Can See Own Entity to give a user access to their own entity and another selected entity. For example, a manager can access company headquarters and their work location.

   

7. Under Access, select the objects in the scope.

8. For each object, select Read/Write or Read Only. Clear an object to hide it entirely.

   

9. Click Save. An Apex batch job creates the sharing records.

10. To review or edit the scope, open its name and check the sharing-rule processing status.

    

Grant a scope access to any employee for signatories, hiring managers, and evaluators

Selecting a signatory for an e-signature request, or a hiring manager or default evaluator for a job, normally requires the same record-level read access as viewing that employee anywhere else in flair. A visibility scope that hides an employee also removes them from these pickers. Three checkboxes on the Employee Visibility Scope record let a user search for and select any employee for one of these actions, without widening their general visibility scope.

1. Open or create an Employee Visibility Scope record.
2. Under Scopes, next to Can See Own Entity, select the checkbox for the picker to open up:
   • Can Create Sign Request for Any Employee — search for and select any employee as a signatory when creating an e-sign request.
   • Can Add Any Employee as Hiring Manager — search for and select any employee as a job's hiring manager.
   • Can Add Any Employee as Evaluator — search for and select any employee as a job's default evaluator.
3. Click Save.

Each checkbox is cleared by default and affects only the matching search and selection step — it does not grant the user general read access to the employee record elsewhere in flair.

Share employee records with managers automatically

Two separate flair mechanisms share an employee's record with a manager's Salesforce user, independent of visibility scopes. Both grant Edit access, and both share only with a manager whose Salesforce user is active.

• Additional Manager sharing is always on. When an employee has an entry in their Additional Managers related list with HR Manager selected, flair shares the employee record with that additional manager's Salesforce user. Clearing HR Manager or removing the additional manager removes the share.
• Direct Manager sharing shares the employee record with the Salesforce user of the employee's direct manager — the Manager field on the employee record. It's off by default; turn it on per organization.

Turn on direct manager sharing

1. In Salesforce Setup, in Quick Find, enter Custom Settings.
2. Open Custom Settings.
3. Next to Flair Employee Settings, click Manage.
4. Click New, or click Edit if an organization-level default already exists.
5. Select Enable Direct Manager Sharing.
6. Click Save.

flair shares each employee with Edit access to their direct manager's Salesforce user, and updates the share when the Manager field changes or is cleared. Additional Manager sharing does not use this setting and cannot be turned off per organization.

Share up the whole manager hierarchy line

Direct manager sharing reaches only the employee's immediate manager. To let every manager above an employee in the reporting chain see and edit that employee's record — not only the direct manager — turn on manager hierarchy sharing. flair shares each employee with Edit access to the Salesforce user of every manager in the line above them, following the Manager field up the reporting chain.

1. In Salesforce Setup, in Quick Find, enter Custom Settings.
2. Open Custom Settings.
3. Next to Flair Employee Settings, click Manage.
4. Click New, or click Edit if an organization-level default already exists.
5. Select Enable Manager Hierarchy Sharing.
6. Click Save. flair shares each employee with Edit access to every manager above them in the reporting chain, and updates the shares when a manager changes anywhere in the line.

Manager hierarchy sharing works only while Enable Direct Manager Sharing is also selected. Access travels downward only: a manager never gains access to their own manager or to a parallel reporting line. The share covers the employee record only, not salaries, absences, or documents.

Neither setting changes existing shares when you select or clear it. Selecting it doesn't share employees retroactively, and clearing it doesn't remove shares that already exist. Both settings apply only to employees created, or whose manager changes, afterward.

warning

Manager hierarchy sharing widens record access to every manager above an employee, not only their direct manager. Review how far your reporting chains extend before turning it on.

Limit a user to company documents

Combine a visibility scope with Flair Employee Management when a user must see company documents but no other HR data.

1. Assign Flair Employee Management to the user.
2. Create or edit an Employee Visibility Scope.
3. Under Access, clear every object except Company Document.
4. Click Save.

The user can see company documents only within the assigned scope.

Create an Inventory Manager permission set

Create a dedicated permission set when a user needs access only to these Inventory objects:

• Inventory.
• Inventory Attachments.
• Inventory Items.
• Inventory Templates.
• Inventory Template Associations.

Create the permission set

1. Open Salesforce Setup.

   

   

2. In Quick Find, enter permission.

   

3. Open Permission Sets.

   

4. Click New.

   

5. In Label, enter Inventory Manager.

   

6. Select API Name to fill it automatically.

   

7. Click Save.

   

Configure Inventory access

1. In the permission set, click Object Settings.

   

2. Search for and select Inventory.

   

3. Click Edit.

   

4. Under Tab Settings, select Visible.

   

5. Configure Read, Create, Edit, Delete, View All, and Modify All access as required.

6. Configure the required field permissions.

7. Click Save.

8. Repeat the object and field setup for Inventory Attachments, Inventory Items, Inventory Templates, and Inventory Template Associations.

9. For Inventory Items, make the tab available and configure record-type assignments when required.

Assign the permission set

1. In the permission set, click Manage Assignments.

   

2. Click Add Assignment.

   

3. Select the users.

   

4. Click Next.

5. Click Assign.

6. Click Done.

Enable Developer Console access

Developer Console gives a user access to debug, test, and develop Salesforce code or applications.

Create the permission set

1. Open Salesforce Setup.

   

2. Under Users, open Permission Sets.

3. Click New.

   

4. Enter a Label, API Name, and Description.

5. Click Save.

   

6. Under System, click System Permissions.

   

7. Click Edit.

   

8. Enable Author Apex and View All Data.

9. Click Save.

   

Assign the permission set

1. In Salesforce Setup, open Users.

2. Select the user.

   

3. Click Edit Assignments.

   

4. Add the new set, such as For Dev Console, from Available Permission Sets.

5. Click Save. The user can open Developer Console.

   

   

Assign custom permissions

Assign flair.Can Update Locked Payroll Run to the payroll integration user so an external payroll system can add deductions when a Payroll Run is locked in a status such as Submitted.

Add the locked Payroll Run permission

1. In Salesforce Setup, enter Permission Sets in Quick Find.

2. Open Permission Sets.

3. Click New. If the payroll integration user already has a custom permission set, open that set instead.

4. In Label, enter a name such as Flair Payroll Deduction.

5. Keep the generated API Name.

6. Click Save.

   

7. Under Apps, click Custom Permissions.

   

8. Click Edit.

9. Move flair.Can Update Locked Payroll Run from Available Custom Permissions to Enabled Custom Permissions.

10. Click Save.

    

Assign the permission set to the integration user

1. In Salesforce Setup, find the payroll integration user.

2. Under Permission Set Assignments, click Edit Assignments.

   

3. Move the permission set from Available Permission Sets to Enabled Permission Sets.

4. Click Save.

   

Control who can log in as an employee

The Employee Hub card on an Employee record shows Login as this employee and Send login link to private email in its actions menu. Login as this employee opens the employee's Employee Hub session directly; Send login link to private email emails the employee a Hub login link. The flair.Flair Manager Hub Login custom permission enforces Login as this employee on the server, so a user without it cannot open another employee's Hub session. For Send login link to private email, the custom permission only controls whether the button appears in the actions menu — removing it hides the button but does not by itself prevent the underlying action, so it should not be relied on as the sole control for that action.

The Flair Manager permission set enables flair.Flair Manager Hub Login by default, so assigning Flair Manager already enables Login as this employee and shows the Send login link to private email button. To grant the same access without assigning the full Flair Manager permission set:

1. In Salesforce Setup, enter Permission Sets in Quick Find.
2. Open Permission Sets.
3. Click New, or open an existing permission set for the user.
4. Under Apps, click Custom Permissions.
5. Click Edit.
6. Move flair.Flair Manager Hub Login from Available Custom Permissions to Enabled Custom Permissions.
7. Click Save.
8. Assign the permission set to the user.

warning

flair.Flair Manager Hub Login grants Employee Hub impersonation for every employee record the user can already open, not only their own reports. Grant it only to roles that need to log in as employees for support.

Configure Admin Monitoring

Admin Monitoring is a free flair integration. It continuously checks assigned licenses, lets you allow or block Salesforce users, and alerts administrators about license changes or unauthorized access attempts.

1. In the flair HR app, open HR Admin → Integrations.

2. Select Admin Monitoring.

   

3. Click Connect Via Integration Service.

   

4. Under Settings, enter each notification email address. Separate multiple addresses with commas.

5. Under Users allow to use flair, use the toggles to allow or block users.

6. Use the search field to find a user who is not listed.

7. Click Enable.

   

Troubleshooting

A user cannot see Employee Documents or Employee Visibility Scopes

1. In Salesforce Setup, open the user.
2. Confirm that the user has a flair license.
3. Review the user's profile and default organization permissions.
4. Confirm that a permission set grants Read access to Employee Documents.
5. Confirm that the user can view and manage Employee Visibility Scopes.
6. Confirm that the Employee Visibility Scope object is enabled and accessible in the Salesforce organization.

Related articles

• Create a custom permission set for Comments
• Install and update flair in Salesforce
• Manage flair licenses
• Configure Employee Hub email notifications