Generalist View-Only Role

Has anyone configured a version of the HR Generalist role that is view only? We are supposed to be upgrading to GHR in a few months, and we have several members of the HR team who need access to employee information, but wouldn't ever make a change in the system. I'm considering working on an inquiry-only/view-only role, but I'm not sure how big of a task that will be.

If anyone else is in the same boat, how did you address this?

Thanks

Find more posts tagged with

Accepted answers

All comments

robert-canham

We did something similar. We started with a copy of the HRGeneralist_ST role and pulled out things that we didn't want them to have, replaced some security classes with inquire versions if they existed. The big difference is there wasn't an employee inquire security role so we copied the delivered GHRGenEmployeeAccess_ST and tweaked it to be inquire only for all the business classes.

Rachel Lake

Hi Robert, is this script something you'd be willing to share with me? I'm not technical, but I could share it with my IS team, and they could make changes based on our requirements.

srogers

I would be interested in seeing it as well if you are sharing. Thank You.

pknaul

We would be interested also. Maybe tag and export the snapshot? pknaul@xanterra.com

robert-canham

Here is the Role Security class setup for our view only role. I pulled a bunch of stuff we're not using so you will want to review it.

Role	Data Area	Security Class
GHRReadOnly_XXX	XXXX_PRD_HCM	BasicProductLineAccess_ST
GHRReadOnly_XXX	XXXX_PRD_HCM	DataMenuAccess_ST
GHRReadOnly_XXX	XXXX_PRD_HCM	EnterpriseInquiryAccess_ST
GHRReadOnly_XXX	XXXX_PRD_HCM	FrameworkInquiryAccessUncond_ST
GHRReadOnly_XXX	XXXX_PRD_HCM	GHRBackgroundActionAccess_ST
GHRReadOnly_XXX	XXXX_PRD_HCM	GHREmployeeInquiryAccess_XXX
GHRReadOnly_XXX	XXXX_PRD_HCM	GHRJobAndPositionInquiry_ST
GHRReadOnly_XXX	XXXX_PRD_HCM	GHRTextSearchAccess_ST
GHRReadOnly_XXX	XXXX_PRD_HCM	LTMAuditLogAccess_ST
GHRReadOnly_XXX	XXXX_PRD_HCM	ProductLineAuditLogAccess_ST
GHRReadOnly_XXX	XXXX_PRD_HCM	ProductLineBasicAccess_ST
GHRReadOnly_XXX	XXXX_PRD_HCM	PublicUserFolderAccess_ST
GHRReadOnly_XXX	XXXX_PRD_HCM	RoamingUIProfileAccess_ST
GHRReadOnly_XXX	XXXX_PRD_HCM	ScheduledActionsAccess_ST
GHRReadOnly_XXX	XXXX_PRD_HCM	SpellingDictionaryAccess_ST
GHRReadOnly_XXX	XXXX_PRD_HCM	UserFolderAllAccess_ST

This is the LPL for the custom security class, again, pulled a bunch of stuff we don't use.

GHREmployeeInquiryAccess_XXX is a SecurityClass
description is "This security classes provides inquiry access to the Employee business class and all of its descendants"

Access Rights
//This security class represents the Global HR business classes in the ontology of Employee for the BenefitAdministrator role.
//This excludes access to:
//DependentIdentificationNumber
//EmployeeBankDetails
//EmployeeIdentificationNumber
//EmployeeAlternateIdentificationNumber
//EmployeeTravelDocument
//Succession
//Employee Talent (qualification data)
//Learning

hr Module
is accessible
for all actions
unconditionally

// Dependent BusinessClass
// is accessible
// for all inquiries
// unconditionally

DirectSupervisorEmployee BusinessClass
is accessible
for all inquiries
unconditionally

SupervisorRptRelation BusinessClass
is accessible
for all inquiries
unconditionally

Employee BusinessClass
is accessible
for all inquiries
unconditionally

All Fields for Employee BusinessClass
excluding
Employee,
Name,
FormerName,
ResourcePicture,
ActiveEmployeeWorkAssignmentExists,
EmployeeWorkEmailAddressExists,
EmployeeWorkTelephone,
EmployeeWorkEmailAddress,
HasWorkEmail,
PresentationNameSnapshot,
PrimaryWorkAssignmentIsActive,
IsSupervisor,
IsADirectReport,
IsAnIndirectReport,
IsATemporaryDirectReport,
IsATemporaryIndirectReport ,
XiEmployeeLocation,
XiEmployeeReportsTo,
ImageLastInitial,
ImageFirstInitial,
ImageInitials,
RelationshipToOrganization,
RelationshipStatus,
WorkType,
StartDate,
AdjustedStartDate,
TerminationDate,
DeathDate,
Birthdate,
PrimaryWorkAssignment,
PrimaryOrganizationUnit,
PrimaryPosition
are not accessible
for all actions
unconditionally

// EmployeeThirdPartyPayroll BusinessClass
// is accessible
// for all inquiries
// unconditionally

EmployeeAddress BusinessClass
is accessible
for all inquiries
unconditionally

// EmployeeAllowance BusinessClass
// is accessible
// for all inquiries
// unconditionally

// EmployeeAllowancePayout BusinessClass
// is accessible
// for all inquiries
// unconditionally

// EmployeeAlternateIdentificationNumber BusinessClass
// is accessible
// for all inquiries
// unconditionally

EmployeeContact BusinessClass
is accessible
for all inquiries
unconditionally

// EmployeeDocument BusinessClass
// is accessible
// for all inquiries
// unconditionally

// IDMDocument BusinessClass
// is accessible
// for all inquiries
// when (IDMDocumentType.ViewByBenefitsAdministrator)

// EmployeeEmergencyContact BusinessClass
// is accessible
// for all inquiries
// unconditionally

// EmployeeOtherPayRate BusinessClass
// is accessible
// for all inquiries
// unconditionally

// EmployeePreferenceAttribute BusinessClass
// is accessible
// for all inquiries
// unconditionally

// EmployeePreferenceCategory BusinessClass
// is accessible
// for all inquiries
// unconditionally

// EmployeePreferenceLocation BusinessClass
// is accessible
// for all inquiries
// unconditionally

// EmployeePreferenceSchedule BusinessClass
// is accessible
// for all inquiries
// unconditionally

// EmployeeProperty BusinessClass
// is accessible
// for all inquiries
// unconditionally

EmployeeSubordinate BusinessClass
is accessible
for all inquiries
unconditionally

ReportingRelationship BusinessClass
is accessible
for all inquiries
unconditionally

// EmployeeWorkingConditions BusinessClass
// is accessible
// for all inquiries
// unconditionally

IndirectSupervisorEmployee BusinessClass
is accessible
for all inquiries
unconditionally

// LeaveOfAbsence BusinessClass
// is accessible
// for all inquiries
// unconditionally

// LeaveOfAbsence.Status Field
// is accessible
// for all inquiries
// unconditionally
// is not accessible
// for all updates
// unconditionally

OrgUnitWorkAssignment BusinessClass
is accessible
for all inquiries
unconditionally

// PayRateChangeAction BusinessClass
// is accessible
// for all inquiries
// unconditionally

// TurnoverData BusinessClass
// is accessible
// for all inquiries
// unconditionally

// EmployeeTurnover BusinessClass
// is accessible
// for all inquiries
// unconditionally

WorkAssignment BusinessClass
is accessible
for all inquiries
unconditionally

All Fields for WorkAssignment BusinessClass
excluding
HROrganization,
Name,
Employee,
Employee.Name,
Employee.PresentationNameSnapshot,
Position,
HROrganizationUnit,
Job,
DirectSupervisor,
IndirectSupervisor,
AssignmentIsSupervisor,
Location,
DirectSupervisorEmail,
DirectSupervisorLabelDer,
IndirectSupervisorLabelDer,
PresentationNameSnapshot,
Primary,
Active,
DirectSupervisorCount
are not accessible
for all actions
unconditionally

Position BusinessClass
is accessible
for all inquiries
unconditionally

Job BusinessClass
is accessible
for all inquiries
unconditionally

HRLocation BusinessClass
is accessible
for all inquiries
unconditionally

HROrganization BusinessClass
is accessible
for all inquiries
unconditionally

HROrganizationUnit BusinessClass
is accessible
for all inquiries
unconditionally

Supervisor BusinessClass
is accessible
for all inquiries
unconditionally

RelationshipToOrganization BusinessClass
is accessible
for all inquiries
unconditionally

RelationshipStatus BusinessClass
is accessible
for all inquiries
unconditionally

WorkType BusinessClass
is accessible
for all inquiries
unconditionally

Mychele Lee

We did exactly the same.

Rachel Lake

Fantastic. Thank you very much.

Copyright © 2025 Infor. All rights reserved.