---
title: "The scope matrix"
description: "The scope matrix"
---

A key's permissions are set as a Read/Write checkbox per row, one row per resource type. Under the hood each checkbox maps to a "scope"; a key is denied anything it wasn't explicitly granted (default-deny, exact match — read never implies, say, salary/personal-ID access automatically).

**Full list of resources (matrix row → what Read/Write grants):**

- **Employees** — read employee records (minimized; salaries/personal IDs need the separate "Include salaries / personal IDs" checkbox below the row) / create and update employee records.
- **Surveys** — read surveys and aggregate results / create and update surveys.
- **Settings** — read organization settings / update organization settings.
- **Users** — read user accounts / manage user accounts.
- **Roles** — read role definitions / manage role definitions.
- **Analytics** — read computed pay-gap analytics (no write scope exists). The classification is anonymity-gated exactly as in the app: a role or group below your minimum group size is returned as hidden, with no salaries.
- **DEI & engagement** — read the DEI dashboard and attrition-risk signal, anonymity-redacted aggregates (no write scope exists).
- **EU Pay Transparency** — read the EU Pay Transparency Directive report (no write scope exists).
- **Org chart** — read the organization's department hierarchy (no write scope exists).
- **HR metric** — read joiners/leavers reports (no write scope exists).
- **OKR** — read OKR cycles, objectives, key results, and check-ins / create and manage them.
- **Benefits** — read the custom benefits catalog and assignment rules / manage them.
- **360 feedback** — read 360 feedback cycles, nominations, and reports / create and manage cycles and nominations (does not send invite emails).
- **Quiz** — read quizzes (answer keys never included) and attempt results / create, update, and archive quizzes.
- **Saved views** — read the org's shared saved employee-list filter views / create and delete them.
- **Onboarding** — read checklist templates and per-employee instances / create templates/instances and update checklist item status.
- **Documents** — read employee document metadata (file name/type/size/category — never file bytes) / delete a document (metadata + its underlying file).
- **Training records** — read employee training records/certifications (never evidence file bytes) / create, update, and delete them.
- **Departments, Teams & Offices** — read the org's Departments/Teams/Offices hierarchies / create, rename, move, and delete them.
- **Legal entities** — read the org's Legal Entities (registered companies/subsidiaries) / create, update, and delete them.
- **Equal work groups** — read job-evaluation criteria (skill/effort/responsibility/working conditions) / create, update, and delete them.
- **Pay-equity action plan** — read pay-equity justifications and correction plans — PII-sensitive (ALWAYS also requires "Include salaries / personal IDs") / create/update them and link a correction plan to an action-plan item.
- **Keeper Test** — read assessment history, team status, and the org-wide overview / submit a new assessment (append-only — no update/delete).
- **9-Box grid** — read 9-Box cycles, manager assessments, the calibration matrix, and development plans / create cycles, assessments, HR/Admin calibrations, and development plans.
- **Wellness** — read welfare benefits, the org wellness overview, balances, and the bookkeeping export (never receipt file bytes) / create, update, and archive welfare benefits.
- **Webhooks** — read outbound webhook subscriptions (secret never included) and their delivery history. Read-only — no write scope exists.
- **Salary review** — read salary revision cycles (the list is aggregate-only; the per-cycle overview and export ALWAYS also require "Include salaries / personal IDs" since they include per-employee current/proposed salary). Read-only.
- **SCIM 2.0 provisioning (HRIS sync)** — one combined capability (no separate read/write) that makes the key usable as the bearer token for SCIM-based employee sync (list/create/update/deactivate) from e.g. Workday, BambooHR, or HiBob.