Hierarchical Security

Hierarchical security in Altamira is a key tool to ensure that each user can access data only if authorized, based on their role and position within the organizational structure.
Practically speaking, it allows you to configure which information about other employees a user can view, edit, or manage within the various modules of the platform.

This approach guarantees confidentiality, traceability, and data consistency: each profile can interact only with the data relevant to them, reducing the risk of unauthorized access.

Functions of Hierarchical Security

You can configure hierarchical security by accessing the section:

Settings > Users > Profiles

There, you will find a set of predefined access profiles, each representing a hierarchical level or relationship between users. For each profile, you can customize which data are viewable, editable, or deletable across the different modules.

The dynamic security functions include:

• Any: defines the permissions a user has regarding the data of any employee in the system, without hierarchical limits.
• Boss: defines the permissions a user has regarding the data of employees who are part of a lower-level hierarchy, but are not their direct reports.
  In other words, the user is a superior (even across multiple levels) to a manager and needs access to data of the employees managed by that person or others within the reporting chain.
• DirectBoss: defines the permissions a user has regarding the data of an employee they are the direct manager of.
  This determines which data they can view/edit/delete for their direct reports.
• DirectReport: defines the permissions a user has regarding the data of their direct manager.
  This determines which data they can view/edit/delete about their manager.
• HR Manager: defines the permissions a user has regarding the data of an employee for whom they are the HR Manager. HR Managers are defined in the org chart or company hierarchy.
• OtherBoss: this function is tied exclusively to the PMP. It defines the permissions a user has regarding the data of an employee for whom they are the alternative manager.
  This applies when an employee has multiple direct managers and the evaluator selected in the review process is not their direct boss.
  In this case, managers not directly involved in the evaluation are labeled as OtherBoss.
  In other words, it allows a manager to access PMP data of their direct report when the evaluation is conducted by another evaluator.
  This setting also affects the visibility of specific fields in a view.
  Note: within workflows, statuses, and outcomes, this dynamic group is not considered: in those contexts, the user is always treated as a DirectBoss, even if the evaluation is assigned to a different manager.
• Peer: defines the permissions a user has regarding the data of employees within their same team.
  This means they can view/edit/delete data of employees who share the same manager.
• Self: defines the permissions a user has regarding their own data.

Modify Profile Permissions

Clicking on "Edit" next to a profile opens the permission configuration screen. From here, you can define, section by section, which actions are allowed for users within that profile.

For each section (e.g., Anomalies, Absences, Employees, Documents, Compensation, etc.), you can set the following authorization levels:

• Read – if the user can view the data
• Edit – if the user can modify the data
• Delete – if the user can delete the data
• Create – if the user can create new entries

For each column, you can select:

• Allowed
• Not allowed
• Or leave it blank if not needed (depending on default configuration or enabled module)

In permission settings, denial always takes precedence.

In some sections, such as "Create", you may see the label N/A (Not Available), indicating that hierarchical security does not allow the creation of new data for that section.
In other words, the “Create” action is not supported by the system for hierarchical profiles in that context, even if view, edit, or delete are permitted.

The screen also includes a search bar to quickly filter the sections to be configured.