---
title: Roles
section: reference
summary: 'A role is the bundle of access you assign to a user. Permissions belong to roles, never to individual users, so a user sees exactly what their roles allow.'
tags:
  - reference
  - permissions
  - access
updated: '2026-08-12'
---

> A **role** is the named bundle of access you assign to a user. Permissions belong to roles rather than to individual people, so what a user can see and do in Cockpit follows entirely from the roles on their record.

## Overview

Access in Cockpit has three layers, and you only ever work with the last one:

1. A **permission** is one allowed action on one resource, such as listing call flows or creating queues. There are several hundred of them and they are fixed by the platform.
2. A **role** collects permissions into something meaningful, such as "can administer this PBX".
3. A **user** holds roles. They inherit every permission of every role they hold, and nothing else.

You never grant a permission to a person directly. To change what someone can do, change their roles. Roles are assigned on the user record, under **Permissions** on the [user](../telephony/users.md) form.

## The roles you can assign

Two roles are offered on the user form, and HR appears only when the PBX has Tempus enabled.

| Role | What it grants |
|---|---|
| **Voxbi Cockpit Admin** | Full administration of the PBX: every permission in the Telephony module, including the ability to sign in to Cockpit. |
| **HR** | Access to the Tempus module. It carries no Telephony permissions of its own. |

A user can hold both. Holding both means full Telephony administration plus Tempus, and they land on the Telephony home page after signing in rather than the Tempus dashboard.

> [!IMPORTANT]
> There is no partial Telephony administrator. Voxbi Cockpit Admin is all of Telephony or none of it, so treat it as a decision about who administers the phone system, not as a set of capabilities to tune per person. Restricting what one person can reach is not something roles express today.

## Who can sign in

Signing in to Cockpit needs two things: the user must be enabled, and they must hold a role that grants entry. Voxbi Cockpit Admin grants it through the login-access permission; HR grants it because Tempus needs it.

A user with no role cannot sign in at all, whatever else is on their record. This is the normal state for most people on a PBX: they have an extension, a phone, and a place in call flows, and they never open the admin panel. Adding a role is what turns a person on the phone system into someone who administers it.

> [!NOTE]
> The two roles decide which module a user reaches, not what they see inside it. Tenant scoping is separate and always applies: a user only ever sees records belonging to their own PBX, including an administrator.

## HR and the Tempus module

The HR role is a module gate rather than a permission bundle. Every Tempus page checks for it, so granting HR opens Tempus and revoking it closes Tempus, with nothing in between.

HR can be granted in two places: on the user form alongside Voxbi Cockpit Admin, and from the PBX's Tempus settings in the partner portal, where you pick the HR users for a PBX as a list.

> [!WARNING]
> The HR role never grants access on its own while Tempus is deactivated for the PBX. Switching Tempus off asks what should happen to the role: keep it on the users who hold it, so they simply lose access until Tempus returns, or strip it from every user of the PBX. See [PBXs](../partner/partner_pbxes.md).

Approving requests in Tempus is not driven by roles. Who may approve a holiday request, a home office request, or a time-point correction comes from [validator rules and approval chains](../tempus/validator_rules.md), which name [employees](../tempus/tempus_employees.md) directly. A Tempus validator does not need the HR role, and holding the HR role does not make someone an approver.

## Internal Voxbi roles

Alongside the two you assign, the platform defines roles for Voxbi and partner staff: a super administrator, and two Nexus roles for platform administration and support. The support role is limited to listing and viewing records, with no permission to change anything.

These are not offered on the user form and are not yours to assign. They exist so support staff can work on a tenant without an administrator having to hand out their own credentials.

## See also

- [Users](../telephony/users.md) - where roles are assigned, under the Permissions tab.
- [PBXs](../partner/partner_pbxes.md) - enabling Tempus for a PBX, and what happens to the HR role when it is switched off.
- [Validators and managers](../tempus/validator_rules.md) - who approves Tempus requests, which roles do not control.
- [Team members](../partner/partner_team.md) - the separate role model for partner-portal staff, which has its own set of roles.
- [Glossary](glossary.md) - the terms used across these guides.