Case Management uses role-based access to control what people can see and do. Assign roles based on a person's responsibilities, following the principle of least privilege; give people only the access they need to perform their work.
Most people need only one role, but a person can hold multiple roles when their responsibilities span different areas of Case Management.
For a detailed list of permissions for each role, see Authorization role matrix.
How access works
Access is determined by a combination of:
- Role, such as Case Agent or Case Manager.
- Team membership, which controls access to team-owned work.
- Case relationships, such as requester, collaborator, or CC.
For example, a Case Manager can manage every case belonging to the teams they oversee, while a Case Collaborator can access only the individual cases they've been invited to.
Choose the right role
The following table helps you decide which role to assign.
| If someone needs to... | Assign... |
| Configure Case Management for the organization | Case Administrator |
| Lead one or more HR service teams | Case Manager |
| Resolve employee requests | Case Agent |
| Review cases for compliance or audit | Case Audit |
| Contribute to a small number of specific cases | Case Collaborator |
| Raise and track HR requests | Employee (no additional Case Management role required) |
Case Administrator
Case Administrators configure and manage Case Management for the entire organization.
Typical responsibilities include:
- Configuring Case Setup.
- Managing teams and routing.
- Configuring service levels and notifications.
- Managing lifecycle settings.
- Resolving configuration or access issues.
Assign this role only to administrators responsible for configuring or governing Case Management.
Case Manager
Case Managers oversee one or more HR service teams.
Typical responsibilities include:
- Monitoring team queues.
- Assigning and reassigning work.
- Completing manual triage.
- Balancing workloads.
- Monitoring service levels.
Management permissions apply only to the teams the manager oversees.
Assign this role to team leaders or supervisors rather than individual case workers.
Case Agent
Case Agents resolve employee requests.
Typical responsibilities include:
- Working assigned cases.
- Communicating with employees.
- Claiming unassigned work.
- Updating case details.
- Creating cases on behalf of employees when required.
Assign this role to HR advisors, specialists, and other people responsible for resolving employee requests.
Case Audit
Case Audit provides read-only access for compliance, governance, and quality assurance activities.
Auditors can review cases and their history without changing any information.
Assign this role only to people who need visibility into case records without participating in case work.
Case Collaborator
Case Collaborators participate in individual cases without becoming members of a team.
Use collaborators when someone needs to contribute specialist knowledge or review a case without receiving access to the team's wider workload.
Depending on how they're invited, collaborators may have either read-only or contributor access to the case.
Employee
Employees don't require a Case Management role to use the employee portal.
Employees can:
- Raise new requests.
- Track their own cases.
- Reply to case updates.
- Complete close surveys.
Employees can't view internal notes, routing information, or other internal case data.
Multiple roles
Some people perform more than one function.
For example:
| Responsibilities | Recommended roles |
| HR advisor who also manages a team | Case Agent and Case Manager |
| System owner who also manages cases | Case Administrator and Case Agent |
| Compliance manager who administers the system | Case Administrator and Case Audit |
When multiple roles are assigned, the user receives the combined permissions of those roles.
Role assignment best practices
Follow these recommendations when assigning roles:
- Grant the lowest level of access required.
- Assign Case Manager instead of Case Administrator whenever team-level management is sufficient.
- Use Case Collaborator instead of adding occasional contributors to a team.
- Review role assignments regularly to ensure they continue to reflect people's responsibilities.
- Remove team memberships and elevated roles when responsibilities change.