In Diwan, access comes from roles, and each role works over a scope: the whole company, a branch, or a department. Without a role, a user sees nothing but themselves.
Built-in roles
- Employee: their own file and requests. Line manager: their team and its approvals.
- HR: employees, structure, attendance and leave. Recruiter: vacancies and candidates.
- Finance: approving, locking and paying the payroll run. IT.
- Executive: for the general manager and their approvals. System admin: users and roles.
- Internal audit: sees everything and changes nothing.
Under «Users & access → Roles» you can open any role and read its permissions in plain words, edit it, «Copy to a new role», or «Reset to default».
How to assign a role
- Open «Users & access → Users». No account yet? Press «New user» and enter the name and at least an email or a mobile; the message saying the account is ready goes there.
- Open the user and press «Add a role».
- Choose the «Role» and «Over whom»: the whole company, a «Branch», or a «Department». The role works only on the employees in this scope.
- Press «Assign the role».
To remove a role, press «Revoke» next to it. It takes effect now, and the line stays in the record.
Payroll access: a separate step
Payroll permissions in a role do nothing until you turn them on from the user's page, in the «Payroll access» section, and choose «What they see»: «Totals only» (totals by department and branch, no line for any employee), «Without names», or «Full» (needed for the bank and Sham Cash payment files). Someone allowed to open payroll for others does this, and every grant and revoke is logged.
Watch out
- Give «Executive» to the general manager on day one, or approvals that need the general manager will find nobody to approve them.
- Anyone who sees payroll or sensitive data should turn on two-step verification.
Related articles
- How to add a new employee
- How to import employees from Excel
- How to set the work location and punch radius
- Help center
These steps describe Diwan as of 10 October 2026. The product keeps improving, so if a name on screen differs from this page, the screen is right.
