Permissions & Roles
Who can see and do what. The module has just two permission keys and one master toggle — but the way they combine gives you a clean split between “everyone sees their own numbers” and “managers run the show”.
The master toggle
Everything hangs off module_kpi_matrix (Settings → Manage Modules). When it's off, the
sidebar group, the profile tab, the permissions and the APIs all disappear — as if the module weren't
installed.
The two permissions
| Key | Label | Type | Grants |
|---|---|---|---|
kpi_matrix | Access | member-scope dropdown (Disable / All / Specific) |
Viewing other people's KPIs (within scope) — the profile tab on a colleague's profile, and the read-only self-service API. Every employee can already see their own KPIs without it. |
kpi_matrix_manage | Manage | on / off | The whole manager workspace — Overview, Team Matrix, Templates, Review Cycles, Recommendations — and every create/edit/delete/calculate/approve action. This single key gates all management. |
Grant them in Settings → Roles, under the Staffing: KPI Matrix group (visible only while the module is on).
kpi_matrix_manage
key, which is simpler and less error-prone.
Member scoping (the “Specific” option)
Because kpi_matrix is a member-scope dropdown, you choose how far a holder's view
reaches:
With Specific, viewing a colleague's KPIs requires that the target is in the viewer's allowed members list — otherwise they're blocked (forbidden).
Who sees what
| Person | Own KPIs tab | Others' KPIs | Manager workspace | Approve salary |
|---|---|---|---|---|
| Employee (no keys) | ✅ always | — | — | — |
Team Lead (kpi_matrix = Specific) | ✅ | ✅ own team | — | — |
Manager / HR (kpi_matrix_manage) | ✅ | ✅ (via workspace) | ✅ | ✅ |
| HR (all-access) (both, Access = All) | ✅ | ✅ everyone | ✅ | ✅ |
| System Admin | ✅ | ✅ | ✅ | ✅ |
How the profile tab decides access
The “KPIs” tab on a Team Member profile follows a simple rule:
Your own profile
You can always see your own KPIs tab — no permission needed (
self_visible).Someone else's profile
You need the
kpi_matrixpermit and, unless your access is “All”, the person must be in your allowed members. Otherwise the tab is hidden / blocked.Module off
The tab doesn't render at all.
Built-in protection
Typical role mapping
These are conventions, not hard-coded roles — grant the matching keys to whichever roles fit your organisation.
kpi_matrix_manage + Access = All: cycles, recommendations, org analytics.kpi_matrix_manage, scoped to their team.kpi_matrix = Specific: view their reports' KPIs.