There are 3 possible roles any user can have, and these roles determine what administrative permission people have access to:

The HR Admin roles are more for managing people and feedback within the platform. The Tech Admin role is used to configure the SI integrations, security settings, and use the user import tool. And the HR Assistant role is like HR Admin “lite” – able to help out with some administrative functions, but with limited access to confidential information (through exports).

A user may have more than one role, and in that case, the permissions simply add up. The original system evaluator starts out with both HR Admin and Technical Admin permissions – what we refer to as the account “Super User” who has all permissions. Having the HR Admin and the HR Assistant roles is redundant. An HR Admin can do everything an HR Assistant can do, plus more.

To grant HR Admin permissions, you’ll first need HR and Tech Admin permissions. If you have these permissions, you can grant HR Admin permissions to another colleague from the company directory.

After clicking “Edit Permissions,” you’ll see the following dialog. Check the “HR Admin” checkbox and press “Save Permissions”.

HR Admins can appoint other HR Admins and they can appoint HR Assistants. Tech Admins can only be appointed by users who are both HR Admin and Tech Admin already. Someone with both HR Admin and Tech Admin permissions can assign any role to anyone.

Roles can be revoked as well, but there always needs to be at least one “Super User” in the system. You can’t revoke the last person’s roles, nor can you lock that person. In the event that all Admins have left the company, please contact Small Improvements support.

This role is very powerful. HR Admins can set up and manage review processes, change the reporting structure, and access confidential data, such as performance review content, for almost every person in the company.

The key restriction is that even an HR Admin can’t access the confidential data of a person above them in their reporting hierarchy.

You should try to limit the HR Admin role to 2 or 3 people in a small company of up 100 staff, and maybe 5-6 in a company of 500 to 800 staff. There’s no exact rule to determine the number. But the more people, the more to manage, so these considerations are important depending on your company’s size

One thing to consider: We recommend limiting the number of HR Admins and especially “Super Users” (HR + Tech Admin) as it is easier to identify who made major changes. If you need cycle help, consider the HR Assistant role, detailed in the next section.

While keeping the HR Admin role to only a handful people, the HR Assistant role can be assigned a bit more liberally. HR Assistants can create and edit review and 360 cycles, add reviewees to them, see the status of reviews, and send reminders to those who are running late. So they can be in charge of the majority of the process, but they are not able to access any confidential data. (Note that editing 360 cycles includes the ability to change visibility of feedback in that cycle, so the HR Assistant role is still quite influential. I.e. don’t assign it too liberally either.)

HR Assistants can create Pulse Surveys, if you have this feature enabled. They can view, edit, share, and export the data for any survey they have created. They do not have these permissions for other cycles.

The HR Assistant cannot delete cycles, even if they created them. Since they cannot view what data may have been recorded by users, only HR Admins can undertake this action. The role does not initially give permission to change the reporting structure, to change email addresses, or to reset user’s passwords.

However, if you are looking for an Assistant to have this ability but still be blocked from accessing confidential review or 360 content, there is a workaround: If you navigate the user settings in your admin overview, you can select the “Allow HR Assistant to pick a person’s manager” option.

The Tech Admin role is usually assigned to someone with a technical background. This person is comfortable setting up integrations with other products or editing the company settings. This person will be able to help with many tasks in user management and the overall configuration of the system, but a technical admin will not have access to confidential data. For this reason, the Tech Admin role (like the HR Assistant) cannot perform certain actions like setting passwords or changing the reporting structure.

While a Tech Admin only has access to limited confidential user data (through exports), there’s still a risk of accidental misconfiguration of settings, for instance locking out the entire company by applying incorrect IP range restrictions or the like. Don’t assign the Tech Admin role to too many people. Don’t assign it to one person only either, since you wouldn’t have anyone to help when that person goes on vacation or leaves the company.

You may create a cycle with visibility settings that conflict with the HR Admin permission level. In these cases, the HR Admin or Assistant status will be disregarded. The key restriction is that even an HR Admin can’t access confidential data of a person above them in their reporting hierarchy.

Some examples:

Essentially, the visibility permissions of a cycle will supersede the HR Admin or Assistant permissions. If your HR Admin needs to see restricted cycle information, you can work around this limitation by removing your own manager to put yourself outside the reporting line. Add your manager back when you're done.

In most cases we simply hide features that a specific role doesn’t have access to. If you can’t change someone’s password, then the dropdown menu on the user-management screen will simply lack an entry that says “change password”. We feel that less is more, at least on commonly used screens.

However, there is a major exception, and that’s the administration overview screen. On that screen, we always present all buttons, and the ones you can’t access are greyed out. We do this to highlight that more options exist, even if you can’t access them yet.

We frequently encounter administrators who are unaware that SI is a very configurable system, since they simply didn’t know about the options they were missing out on. We feel that the admin overview is one of those places where showing the limitations of your current role (if any) makes sense.

Here’s an overview of permission granted to each of the 3 roles.

Always keep in mind that a person may have two roles, then the permissions simply add up. So if you feel that the Tech Admin role alone isn’t powerful enough, and envision your VP of Operations doing more than just setting up the integration, feel free to assign her also the HR Assistant or even HR Admin role.