The scope matrix

A key’s permissions are set as a Read/Write checkbox per row, one row per resource type. Under the hood each checkbox maps to a “scope”; a key is denied anything it wasn’t explicitly granted (default-deny, exact match — read never implies, say, salary/personal-ID access automatically).

Full list of resources (matrix row → what Read/Write grants):

Employees — read employee records (minimized; salaries/personal IDs need the separate “Include salaries / personal IDs” checkbox below the row) / create and update employee records.
Surveys — read surveys and aggregate results / create and update surveys.
Settings — read organization settings / update organization settings.
Users — read user accounts / manage user accounts.
Roles — read role definitions / manage role definitions.
Analytics — read computed pay-gap analytics (no write scope exists). The classification is anonymity-gated exactly as in the app: a role or group below your minimum group size is returned as hidden, with no salaries.
DEI & engagement — read the DEI dashboard and attrition-risk signal, anonymity-redacted aggregates (no write scope exists).
EU Pay Transparency — read the EU Pay Transparency Directive report (no write scope exists).
Org chart — read the organization’s department hierarchy (no write scope exists).
HR metric — read joiners/leavers reports (no write scope exists).
OKR — read OKR cycles, objectives, key results, and check-ins / create and manage them.
Benefits — read the custom benefits catalog and assignment rules / manage them.
360 feedback — read 360 feedback cycles, nominations, and reports / create and manage cycles and nominations (does not send invite emails).
Quiz — read quizzes (answer keys never included) and attempt results / create, update, and archive quizzes.
Saved views — read the org’s shared saved employee-list filter views / create and delete them.
Onboarding — read checklist templates and per-employee instances / create templates/instances and update checklist item status.
Documents — read employee document metadata (file name/type/size/category — never file bytes) / delete a document (metadata + its underlying file).
Training records — read employee training records/certifications (never evidence file bytes) / create, update, and delete them.
Departments, Teams & Offices — read the org’s Departments/Teams/Offices hierarchies / create, rename, move, and delete them.
Legal entities — read the org’s Legal Entities (registered companies/subsidiaries) / create, update, and delete them.
Equal work groups — read job-evaluation criteria (skill/effort/responsibility/working conditions) / create, update, and delete them.
Pay-equity action plan — read pay-equity justifications and correction plans — PII-sensitive (ALWAYS also requires “Include salaries / personal IDs”) / create/update them and link a correction plan to an action-plan item.
Keeper Test — read assessment history, team status, and the org-wide overview / submit a new assessment (append-only — no update/delete).
9-Box grid — read 9-Box cycles, manager assessments, the calibration matrix, and development plans / create cycles, assessments, HR/Admin calibrations, and development plans.
Wellness — read welfare benefits, the org wellness overview, balances, and the bookkeeping export (never receipt file bytes) / create, update, and archive welfare benefits.
Webhooks — read outbound webhook subscriptions (secret never included) and their delivery history. Read-only — no write scope exists.
Salary review — read salary revision cycles (the list is aggregate-only; the per-cycle overview and export ALWAYS also require “Include salaries / personal IDs” since they include per-employee current/proposed salary). Read-only.
SCIM 2.0 provisioning (HRIS sync) — one combined capability (no separate read/write) that makes the key usable as the bearer token for SCIM-based employee sync (list/create/update/deactivate) from e.g. Workday, BambooHR, or HiBob.