User Maintenance

1. What is a ‘Layered’ Security Group?
   From within the User Maintenance, access the Groups tab to see the assigned Group Security Roles for the User. The User displayed below has both the Manager and Employee groups assigned to them.
   
   
   
   These two groups are ‘layered’ so LightWork will use the highest level of security access for each securable. For our example User, if they have ‘Full Access’ to a securable such as ‘Profiles – Journals’ as part of the Manager Group but are assigned ‘No Access’ from the Employee Group they will still see the Journals section of the Employee Profile as the Manager layer provides them access.
   
   Note: The only trump card for layered security group assignment is the ‘Deny Access’. The ‘Deny Access’ access level acts as a security 'trump card' safeguard. If this is enabled, the User will NOT see this component even if another one of their assigned Role(s) or Groups would provide any level of access.

2. How do I choose the correct Employee access option for a new User?
   There are many choices when selecting what kind of employee access a User will have. Review the information below for details on each option:

   • None
     Leaves the Employee access for Managers blank.

   • All Employees
     Gives Managers access to all Employees.

   • Organization Level Filters
     Bases Employee access for Managers on the Organization Levels.
     Note: This must be continually maintained.

   • Primary Manager Hierarchy
     Bases Employee access for Managers on the hierarchy system.

   • Specific Employees
     Gives Managers access to specific Employees.
     Note: This must be continually maintained.

   • Specific Managers
     Gives Managers access to specific Managers.
     Note: This must be continually maintained.

   • Self Only
     Gives User access to their self-only.

   • Company
     Gives User access to the company Employees.

   • Direct Reports Only
     Gives User Employees access to their Direct Reports only.

   What happens when I create a new Username and assign an Employee who was previously assigned to an old Username?
   The history of that Employee does follow the new User, the only change that this would affect is having a different User linked to the Employee record, nothing else changes in regards to this. The Appraisals, Goals & Journals are tied specifically to the Employee and have nothing to do with the User, so we would have to investigate via the data to identify why they aren’t seeing them to figure out what’s going on here. When the new User is linked to the Employee, the original User’s association is removed, and nothing else changes.
   
   Note: If they are not seeing Appraisal History or other items that are believed to be associated with the Employee, there is something else at play here. Check that the Employee’s Unique Identifier (SSN) did not change. If so, that would cause a new Employee record to have been created and thus cause an issue. If this problem does occur HR will need to join the two Employees into one. If there still seems to be an issue, please contact clientcare@lightworksoftware.com.