What are permission profiles?
Without permissions profiles, the Employees and Pay Ranges sections of the tool are admin only. Permission profiles let admins control which employees and pay ranges a user can see in Comprehensive. Once a user has access to these sections of the tool, they'll see the same tables as admins, but filtered based on their access rules.
Profiles are additive - if someone is on multiple profiles, they get the combined access of all of them.
Creating a profile
Go to Settings → Permissions → Permission Profiles and click Create Profile. Each profile has three tabs: Initial Setup, Employee Permissions, and Pay Range Permissions.
Tab 1: Initial setup
This is where you name the profile, add a description, and assign members. To add people to the profile, you have two options:
Transfer list - browse the list of employees on the left and move them to the right to assign them to the profile. You can search by name to find people quickly.
Bulk email paste - click the clipboard/paste icon button next to the employee selector. This lets you paste a list of email addresses (one per line or comma-separated) to add multiple people at once. This is great when you have a list of managers from a spreadsheet and want to assign them all in one go.
Tab 2: Employee permissions
This controls which employees profile members can see. You'll select one option that defines the scope of visibility - for example, "Direct reports" means they'll only see people who report directly to them, while "Direct and indirect reports" means they'll see their entire reporting tree (reports of reports, and so on).
There are also options for HRBP-style access (scoped to the leaders they support), a fully custom list of specific employees, or "None" which means the profile doesn't grant any employee visibility on its own.
If your company has the Total Rewards Dashboard enabled, you'll also see a toggle to let profile members preview the dashboard for their visible employees.
Tab 3: Pay range permissions
This controls which pay ranges profile members can see. There are three independent filters - a range must pass all three to be visible:
Levels - controls how high in the seniority ladder they can see. You can scope this relative to the user's own level, their reports' levels, or set a custom list. The "+1" options give one level of context above the scoped group.
Job families - controls which job families' ranges are visible. Can be scoped to the user's own family, their reports' families, a custom list, etc.
Zones - controls which geographic zones' ranges are visible. Same scoping options as job families.
Each filter has similar scope options (all, self, direct reports, direct & indirect reports, HRBP variants, custom, or none).
Setting a profile live
Once you've added employees to the list of users that currently have access to this profile and save changes, the profile is live. No notifications nor emails go out.
If you'd like to check your work, you can look at the access granted to individuals by using our impersonation feature. If you want to actively notify employees added to a permission profile, you'll have to do so outside of Comprehensive.