Most HR tools start their access model with two roles: admin and everyone else. That's fine for a 20-person company where the admin is also the only person who needs to see payroll data. It stops being fine somewhere between 100 and 300 employees, when regional managers, department heads, and finance all need overlapping but distinct views into the same data.
The Client Should Never Decide Who Sees What
A common shortcut is to filter data in the frontend — hide the salary column if the logged-in user isn't an admin. This is not access control, it's UI decoration. Anyone who can read network requests can see the unfiltered data. Real scoping has to happen on the server, on every request, based on who the caller actually is and where they sit in the org.
Scope From The Hierarchy You Already Have
The most maintainable version of this ties access scope to the same reporting hierarchy that already exists in your employee data — a manager's scope is their subtree, an employee's scope is themselves, and admins see everything. No separate permission table to keep in sync, because the hierarchy already is the permission table.
What Server-Side Scoping Looks Like
Access enforced server-side from the org hierarchy — the client is never trusted with scope — so a rep, a manager and an admin see three different, correctly scoped views of the same underlying data, with no separate permission table to maintain.
Explore more from BizzField HRMS
Frequently asked questions
It's fine at 20 people, but stops working between 100 and 300 employees, when regional managers, department heads and finance all need overlapping but distinct views into the same data.
No. Filtering data in the frontend is UI decoration, not access control — anyone who can read network requests can see the unfiltered data. Real scoping has to happen on the server, on every request.
The most maintainable approach ties access scope to the same reporting hierarchy that already exists in employee data — a manager's scope is their subtree, an employee's scope is themselves, and admins see everything.
WRITTEN BY
Shivam Gupta
Brand Manager
Brand Manager with 8+ years of experience in building brands, developing growth strategies, and creating impactful marketing campaigns that drive business success.
Connect on LinkedIn