You can organize your teams and workflows more effectively in Payhawk by using built-in roles and role extensions. Each comes with specific permissions to align with your company’s structure, responsibilities, and internal policies, enabling robust segregation of duties and granular access controls for enhanced security and oversight.
When inviting employees to your Payhawk account, you must assign a specific Payhawk role to each individual.
Permissions
Permissions refer to the available rights for a Payhawk role or role extension. For example, an employee with the built-in Payhawk Employee role has the permission to view the expenses they’ve submitted, but they won't be able to view all company expenses.
Roles for group accounts
Roles and their associated permissions can be viewed at the group level.
The assignment of roles to employees is performed via the Employee app (at the group and individual level).
The inclusion of a role in a workflow is conducted at the individual entity level, provided that entity-specific settings are enabled at the group level.
Roles for single-entity accounts
Single-entity Payhawk accounts (not part of a group) cannot view the permissions of Payhawk roles, but can still assign any of them to employees and include them in approval workflows at the account level.
Built-in Payhawk roles
The built-in (default) Payhawk roles:
Come out of the box with a predefined set of permissions that establish the core access levels and responsibilities for these global roles.
Do not allow for modifying their set of permissions.
By default, Payhawk Accountants and Administrators can review expenses. All other roles must be explicitly added to the review step in your company’s workflows.
Built-in Payhawk role | Permissions |
Employee | Cardholders of company-issued Payhawk cards. Can submit and categorize their expenses, and view details related to their cards and subscriptions. |
Accountant | Includes all Payhawk Employee permissions, plus the ability to manage and review expenses, edit extracted data, and export expense information for reporting or accounting. |
Administrator | Includes all Payhawk Accountant permissions, plus full access to issue and deactivate cards, adjust limits, configure spend policies, manage cash withdrawals, invite employees, and handle billing and administrative settings. |
IT Administrator | Includes a limited set of Payhawk Administrator permissions that are focused on system configuration. The IT Administrator role allows managing the initial setup, security settings, and integrations (for example, viewing, connecting, or disconnecting ERP systems) without access to sensitive areas like account settings, expenses, or financial data. The role is ideal for separating system configuration tasks from financial controls. |
Senior AP Specialist | Includes a limited set of Payhawk Accountant permissions, such as selected administrative settings. The Senior AP Specialist role separates access to payment data and confirmation rights, offering a middle ground between the full Payhawk Administrator and Payhawk Accountant roles. The role is ideal for employees who need to manage accounting settings. |
Auditor | Includes all Payhawk Administrator permissions, but with read-only access. The role allows employees to view all settings and data, but not to make changes. The role is ideal for auditors, consultants, or team members who need oversight of system configurations without the ability to modify them. |
Viewing Payhawk roles and permissions
You can view the built-in Payhawk roles from Group Dashboard > Settings > Roles and permissions.
The full list of permissions enabled for a role can be viewed by selecting the desired role or role extension in Group Dashboard > Settings > Roles and permissions.
Viewing the history log for Payhawk roles
You can view all activities related to Payhawk roles, such as role changes and assignments, updates of permissions, and invites.
Go to the Group Dashboard and navigate to Settings > Roles and permissions.
Click on the three-dot menu and select View history log.
On the next screen, select any of the following options:
Role change to view updates to any of the role permissions and settings.
User roles to view updates in the role assignment to a specific user.
All to view both types of updates.