> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paypunch.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & Permissions

> How PayPunch decides who can do what — bookkeeper admin roles, client company roles, and PIN-based employee access.

PayPunch grants access at three levels that mirror the [hierarchy](/get-started/how-paypunch-works):
**bookkeeper admins**, **client users**, and **employees**. Each has its own roles and its own
sign-in path.

## Bookkeeper admins

Admin users belong to a bookkeeper org and manage the whole tenant. There are three admin roles:

| Role             | Can do                                                                                                                                 |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| **SUPER\_ADMIN** | Full control of the org — every client company, every employee, all settings, branding, holidays, user invitations, and impersonation. |
| **ADMIN**        | Day-to-day management: client companies, employees, time entries, the payroll workflow, and IIF export.                                |
| **VIEWER**       | Read-only access across the org. Cannot edit data or run exports.                                                                      |

<Note>
  Admins sign in at **`/login`** with an email and password. A SUPER\_ADMIN or ADMIN can invite
  more admin users to the org — see [Users & invitations](/admin/users-and-invitations).
</Note>

## Client users (company owners & managers)

Client users belong to a single client company and only ever see that company's data. There are
three client roles:

| Role        | Can do                                                                                                                            |
| ----------- | --------------------------------------------------------------------------------------------------------------------------------- |
| **OWNER**   | Full access to their company: employees, timesheets, reviewing and submitting payroll, company users, and settings.               |
| **MANAGER** | Reviews and approves their team's time and submits payroll, but has limited access to company-level settings and user management. |
| **VIEWER**  | Read-only access to their company's timesheets and reports.                                                                       |

<Note>
  Client users sign in at **`/login`** with an email and password — the same unified page admins
  use. PayPunch routes them to their company dashboard automatically.
</Note>

## Employees

Employees don't manage anything — they record their own time. Instead of a password, each
employee has a **4–6 digit PIN** used to clock in and out, typically on a shared **time clock**
device.

* Employees identify themselves by **Employee ID, email, or phone**, then enter their PIN.
* They can clock in/out, take breaks, request time off, view their own timesheet, and correct or
  resubmit rejected entries.
* They cannot see other employees, other companies, or any admin settings.

<Warning>
  A PIN is a credential. Employees should keep it private and never share it — clock-ins are
  recorded against whoever's PIN was used.
</Warning>

## Impersonation (admins only)

A bookkeeper admin can temporarily **impersonate** a client user to troubleshoot or help with
setup. Impersonation is time-limited and fully audited; while impersonating, the admin is
restricted to the client's view and cannot reach admin-only routes. See
[Impersonation](/admin/impersonation).

## Next step

Know your role? Head to [Logging in](/get-started/logging-in) to find the right sign-in URL.