Payroll Roles and Permissions

Payroll access is permission-driven. The frontend checks permissions before showing pages, sections, and row actions. The backend also restricts list/detail visibility.

Common permission patterns

Permission pattern	What it controls
`payroll.view_<model>`	Ability to view records for a Payroll area.
`payroll.add_<model>`	Ability to create records.
`payroll.change_<model>`	Ability to edit records.
`payroll.delete_<model>`	Ability to delete records.
`payroll.can_view_all_<model>`	Ability to view all records for a model instead of only owned records.
`payroll.can_calculate_salary`	Ability to run salary calculation.
`payroll.can_finalize_salaryrecord`	Ability to finalize salary records.
`payroll.can_change_payment_status_salaryrecord`	Ability to change salary payment status.
`payroll.can_change_tax_status_salaryrecord`	Ability to change tax paid status.
`payroll.can_exempt_from_tax`	Ability to mark salary division details as tax exempt.

Verified examples

Area	Example permissions
Salary Records	`payroll.view_salaryrecord`, `payroll.change_salaryrecord`, `payroll.delete_salaryrecord`, `payroll.can_view_all_salaryrecord`
Salary Profiles	`payroll.view_salaryprofile`, `payroll.add_salaryprofile`, `payroll.change_salaryprofile`, `payroll.can_view_all_salaryprofile`
Income Tax	`payroll.view_incometaxyear`, `payroll.add_incometaxyear`, `payroll.change_incometaxyear`
Retention Bonus	`payroll.view_retentionbonuspolicy`, `payroll.add_retentionbonusenrollment`, `payroll.change_retentionbonuswithdrawal`
Asset Finance	`payroll.view_assetfinancepolicy`, `payroll.add_assetfinanceagreement`, `payroll.change_assetfinanceagreement`
Extra Salary Bonus	`payroll.view_extrasalarybonuspolicy`, `payroll.add_extrasalarybonuspayment`, `payroll.change_extrasalarybonuspayment`

Own records vs all records

Users without all-record access are filtered to their own records. For salary records, non-admin users can only view their own finalized salary records.

Superusers bypass these permission checks.