Xoxoday Empuls supports role-based access control (RBAC) with a granular permission model that lets administrators define and enforce access at the organisation, department, team, or individual user level.
How the permission model is structured
Permissions in Xoxoday Empuls operate across multiple tiers. At the broadest level, organisation-wide roles govern platform-level actions such as programme configuration and budget management. Below that, permissions can be narrowed to a specific department, a single team, or even an individual user. This layered approach means that a regional HR manager, for example, can be granted edit rights over recognition programmes within their geography while remaining unable to view or modify records belonging to other business units. Within each role, administrators can control the specific actions a user may perform: view, create, edit, or approve. A programme approver in one workflow can hold read-only access in another, keeping operational boundaries clean without requiring separate accounts.A practical example
Consider an organisation running Xoxoday Empuls alongside Darwinbox for HRMS and Microsoft Teams for day-to-day collaboration. The IT security team can assign a dedicated Empuls administrator role to the HR business partners in Darwinbox-synced departments, while restricting finance-adjacent approval workflows to a separate role held only by compensation leads. Managers in Teams receive a narrower role that lets them nominate peers for spot awards but blocks access to budget dashboards or reward redemption reports. This kind of separation ensures that data visible in the context of performance or compensation stays appropriately siloed—a requirement that frequently surfaces during ISO 27001 gap assessments and SOC 2 Type II audits.Security and the least-privilege principle
Xoxoday Empuls enforces the least-privilege principle throughout its permission model. Roles are not inherited by default when an employee moves between teams or departments; access changes must be explicitly provisioned. This reduces the risk of privilege creep—a common audit finding in platforms that auto-inherit permissions through org-chart changes synced from systems like SAP SuccessFactors or Workday. Administrators can review and audit role assignments at any time from the platform settings console, and changes to high-privilege roles generate an audit trail that supports compliance reporting requirements.Operational flexibility without compromising governance
Because role definitions are modular, Xoxoday Empuls adapts to flat organisations with a handful of roles as comfortably as it supports enterprises with dozens of distinct permission profiles across multiple legal entities. Custom roles can be created from scratch or built by cloning and adjusting an existing template, reducing the administrative overhead of maintaining a large access matrix. Learn more: [Xoxoday Empuls Help Centre — General](How does Empuls manage users, teams, roles, and approvals?
Learn how to create, edit, and deactivate user accounts and assign admin roles across your Xoxoday Empuls workspace.
Does Xoxoday Empuls have ISO 27001, SOC 2, and GDPR compliance?
Understand how Xoxoday Empuls protects your data through encryption, audit logs, and certifications including ISO 27001 and SOC 2 Type II.