Setting Access to a Specific Field on a Record

Issues: Users are not able to view a specific field on a screen--or users are able to view a field that they should not have access to view.

Troubleshooting Tips:

Access to certain fields within in a record can be limited. This feature can be used to prevent users from viewing sensitive data, such as employee pay rates or dates of birth.

1. Check the Employee record>TCS screen>Employee Authorization Information Card to view the policies assigned to an employee, and to determine the role granting access to that policy (screen).

   The Employee Authorization Information card displays the policies and roles assigned to an employee. This card is found in the TCS screen in the employee record.

   Note: If this card is not visible, it can be added to the TCS by going under the Preferences section>My Preferences card>Time Card Screen and dragging the Employee Authorization Information card to the Selected column.

   • The Policy tab displays the policies (e.g. access to sections, cards, screens, functions) assigned to the employee and the role(s) that grant the employee that policy.
   • The Role tab displays the roles assigned to the employee and whether the role has been assigned directly to the employee (though the employee Roles in the employee record) or indirectly through an organization unit role. If the role is assigned indirectly, the organization unit where the role is assigned is listed in the Organization Unit column.

     Click a role to be taken to the role's configuration screen or click its assignment to be taken to the employee's role screen (Direct) or the organization unit's role screen (Indirect).

2. If a user does not have the proper access to a specific field:
   • The user can be assigned to another role to grant or deny the required field access. More About Adding An Employee Role
     • To find which roles provide the required authorization capabilities, run the Authorization Control report, found in the Reports section>System card.
     • Assign the appropriate role to the employee through the Employee record>Roles screen. See the instructions on Steps for Adding an Employee-Level Role.
   • An existing non-standard role can be updated to grant or deny the field access. More About Updating an Existing Role
     • Remember that any changes to a role will update the access for ALL employees assigned to that same role.
     • Standard roles cannot be edited--a new role must be created and modified.

   • A new role can be created which has the required access and assigned to the user. More About Creating New Roles

     New roles can be created by adding a role or by replicating an existing role that has most of the required attributes, and then modifying it to change the access.

     • For more information on creating a new role, see Steps for Creating a New Role.
     • A replicated role can also be replicated again, and modified to create another role with different attributes. For more information on replicated roles, see Steps for Replicating a Role.

Setting Field Access in a Record:

1. From the Configuration section>System card, open the Roles screen.
2. Search for and open the record to be updated, or create a new role.
3. Click on the Authorization Controls button in the left pane.
4. Expand the folders in the Authorization Policy Hierarchy to find the screen to be updated. Note: In order to access a specific screen, the user must grant access to each of the levels above the selected screen. More About Setting up Access to Parent Structure Levels

   The steps to set up the access to parent structure levels are as follows:

   1. From the Configuration section>System card>Roles screen, locate and open the Role record to update.
   2. Select the Authorization Controls button in the left pane to access the Authorization Policy Hierarchy tree.
   3. In the Authorization Policy Hierarchy tree, highlight the Root level. The Section options are displayed in the right pane.
   4. For the parent Section record, click on the Add button to add this policy to the role. The button action is changed to Remove. In the example below, the Configuration Section is made accessible to this role.

      

   5. In the Authorization Policy Hierarchy tree in the left pane, highlight the parent Section option. The related Card options are displayed in the right pane.
   6. For the parent Card record, click on the Add button to add access to this card to the role. The button is changed to Remove. In the example below, the Assignments Card is made accessible to users in this role.

      

   7. In the Authorization Policy Hierarchy tree, highlight the parent Card of the policy to be viewed. The related Screen options are displayed in the right pane.
   8. For the parent Screen record, click on the Add button to add access to this card to the role. The button is changed to Remove. In the example below, the Holiday screen is made accessible to users in this role.

      

5. Click the card arrow on the record to open and access the tabs.
6. When an access level is set on the General tab, all the fields listed on the Field tab inherit the setting. Access to individual fields can be changed on the Field tab. For example, if the Edit option is set to Yes on the General tab, all the fields on the Field tab are automatically checked to be editable. Certain fields can be changed to be not editable by removing the Edit check mark for that field. Note: A function access level must be set to Yes on the General screen in order to be able to update the field actions in the Field screen. For example, in order to be able to Edit access to the individual fields, the Edit access must be set to Yes. If it is set to No, access to the Edit fields are not enabled on the Field tab.
7. Click on the Field tab to open it. From this screen, place a check mark in the fields to indicate whether the users should have Read, Create and/or Edit access to a particular field. The setting in this screen will override the default screen setting on the General tab. Clicking on the box alternately checks and un-checks the access level.
   • Check the Read box to allow users to be able to view this field
   • Check the Create box to allow users to enter a value when creating a new record.
   • Check the Edit box to allow users to update the value that is in the field of a saved record.
8. Save the record.