HR Admin

As we poke-around a bit more pre-launch, we're realizing that Workfront has quite a few features for timesheets, billing, money management, etc. that HR-like activities that have certain privacy issues around them whereby the SysAdmin has no business knowing about the information.

Such information needs to be managed by an HR-like, or payroll-like capacity and by-and-large is not a "Workfront user" in the sense that they never manage projects, send messages, etc. They need to set pay rates, get billing/payroll data, etc.

To this end, this role would need specialized access to Workfront...admin-level for personnel and associated issues, but zero access to other Setup items (layouts, custom forms, etc.). At the same time, some personnel items like accounts, role assignment, team assignment, etc. would be shared: accessible to the HR person, but also accessible to the SysAdmin (for basic account and functionality items).

Right now, you can't really pull this off entirely which leaves us in a messy situation of SysAdmins seeing the info they shouldn't and the HR/payroll role getting SysAdmin access and all the pitfalls that come with it.