Roles

Every account has exactly one role. Klokk checks what it may see and change on every request — including that nobody looks into another company.

The roles

Role	Task	Records time	Two-factor
Super admin	runs the installation: companies, settings, licence, extensions, error log — across all companies	no	mandatory
Admin	manages a company: users, departments, requests, accounts, month-end closing, company calendar, travel time	no	mandatory
Manager	decides the requests of the departments they lead and sees their times	yes	configurable
User (employee)	records their times, makes requests	yes	configurable
Auditor	reads the company’s time analysis, time and vacation accounts, monthly records, project report, shift audit and audit log — changes nothing there	yes	mandatory

Whether managers and users need two-factor sign-in, super admins set under Admin → Settings → Security Settings.

Who assigns roles

• Admins assign the roles user, manager, auditor and admin — in their company.
• Only super admins make someone a super admin.
• Klokk never locks out the last active super admin.

Every role change is recorded in the audit log.

Managers and departments

Managers decide for the people of the departments they lead. Without a department manager the company’s admins decide, otherwise the super admins — see notifications. Nobody decides their own requests.

Admin accounts record no time

So that nobody works day to day with an admin account, super admins and admins have no dashboard, clock, own entries, absences or requests. They do not appear in lists of working time (time analysis, bulk entry, shift plan, on-call). Admins edit other people’s entries in the time analysis with Edit.

Working and managing

Whoever records their own time and also manages uses two accounts: an ordinary one (user or manager) for their own working time, and the admin account only for managing. Times already recorded on an admin account are kept.