---
title: "Roles & Access Model"
space: "Industrial Relations Documentation"
url: "http://www.buff0k.co.za/ir-docs/roles-access-model"
updated: "2026-08-17"
---

# Roles & Access Model

## The three IR roles

| Role | Intended for |
| --- | --- |
| **IR Manager** | Senior Industrial Relations users - the broadest operational access, including managing IR Role Restrictions itself. |
| **IR Officer** | IR practitioners who create and manage cases within whatever scope they're permitted. |
| **IR User** | Restricted or read-oriented access, typically the most limited of the three. |

A user can hold more than one of these - when they do, the **highest role wins** (Manager beats Officer beats User) for every restriction check described in **IR Role Restrictions**. There's no way to combine roles for a wider or narrower effective scope; only the single highest one is used.

## Other functional roles

| Role | Purpose |
| --- | --- |
| **Training Manager / Training Administrator / Training Facilitator** | Separate management, administration, and facilitation responsibilities for the Training & Induction module. |
| **Anonymous Report Investigator** | The only role that receives Anonymous Report notifications - a deliberately separate, role-gated model (see **Anonymous Report**), since that doctype carries no accused-employee designation/branch to restrict on the normal way. |
| **HR Manager / HR User, Payroll Manager / Payroll User** | Not IR-specific, but referenced by several workspace and permission rules alongside the IR roles. |

`System Manager` has full administrative access on top of all of the above, and is the only role that can directly cancel a submitted Disciplinary Action, Incapacity Proceedings, Poor Performance, or Appeal Against Outcome (every other role must go through a formal Appeal - see **Appeal Against Outcome**).

## What "restricted" actually means

Holding IR Manager/Officer/User doesn't by itself limit anything - the three roles just establish *which* restriction bucket applies to a user. The actual restrictions - which designations they can't see, which branches they're limited to - are configured separately, per user, in one place: **IR Role Restrictions**. A user with an IR role but no rows configured for them there sees everything their role would otherwise allow.

Restrictions are enforced consistently in three places:

- **List views and reports** - a restricted designation or branch is filtered out of what the user can query at all.
- **Direct document access** - opening a specific record's URL directly is blocked the same way, not just hidden from lists.
- **Notification emails** - the weekly digests and case-creation alerts narrow their content per recipient using the same rules, so a restricted user never receives in an email what they can't open in the app.

Next: **IR Role Restrictions - Designation Limits & Branch Limits**.