Manage permissions and roles (as an admin)

New: You can now create custom Basic roles for individuals or groups in Gusto. If you cannot add a Basic role in your account yet, wait a few weeks (we're still rolling this out).

A person’s roles and permissions control what they can see and do in Gusto, as well as the emails they'll get. You can manage access for team members who already have Gusto profiles, and collaborators outside of Gusto (accountants, brokers, etc).

There's no limit to how many Global, or Limited admins you can set up in Gusto.

Reminder about assigning managers

If you set up managers with Gusto's standard permissions, you can have as many as you'd like. If you want to change the roles and access your managers have, try customizing a “Basic” role using the instructions in this article.

Other helpful articles

Learn how to update company details (like your Signatory, addresses, etc).
Gusto Pro accountants can learn how to manage the firm’s clients.

Use CMD + F (or CTRL + F) to search for words in the article.

Types of access and roles (an overview)

There are a few types of users you can have in Gusto:

Signatory—only one per company, designated during onboarding
- The signatory has permission over signing documents.
- If you need to change the signatory, there’s a few extra steps (in a different location in Gusto).
Account owner (aka Primary admin)—only one per company.
- This Global admin is the only global admin with the ability to add, remove, or edit permissions for other users.
Global admin—use sparingly
- This level of access is usually given to very few people because they'll have access to all of your company information.
- There’s no limit to how many Global admins you can have.
Limited admin—recommended
- Choose access levels for each of the functions in Gusto.
- There’s no limit to how many Limited admins you can have.
Basic roles (aka custom roles)—customize basic roles, availability based on plan type
- Delegate limited workflows and tasks to certain people.
- Most common for team members like managers who have roles outside of the standard manager access and permissions.
- The amount of custom Basic roles you can create is based on what Gusto plan you have.
Individual permissions (for US employees)—no limit.
- Delegate limited workflows and tasks to certain people.

Additional detail about Global, Limited, and Basic access can be found below.

Global admin access

Give Global access to company owners and administrators. This level of access is usually given to very few people because they'll have access to all of your company information.

If you do not want to give this level of access, choose Limited admin instead.

Reminder: If you choose Limited admin instead and select every role type, and all permissions, it's still not the same thing as giving Global access to Gusto.

Global admins have access to:

Hire and dismiss people
Run payroll and pay contractors
Create reports
Manage taxes
Manage benefits
Manage company bank accounts
Manage and pay bills
Manage company data
Manage company signatory
View and edit compensation

Global admins cannot add, remove, or edit other user’s roles and permissions. Only the account owner (aka Primary admin) can do that.

Limited admin access

Account owners (aka Primary admins) can choose access levels for various functions. Limited admin roles restrict access and can be applied to specific people or groups.

Pay
- Run payroll
  - Pay employees, view pay reports, manage expenses, edit pay schedules, and tax information. Manage Payroll on Autopilot.
- Pay contractors
  - Pay contractors and view contractor payment reports.
Team members
- Hire and onboard team members
  - Add team members and contractors, create and manage job posts, send offer letters, send and review background checks, create and manage onboarding checklists, manage documents, manage provisioning app integrations and hiring integrations.
- Manage and offboard team members
  - Dismiss team members, view and manage offboarding checklists, view and edit personal info and manage expenses.
- Team member documents and compensation
  - View and edit a team member's documents and compensation information.
Reports
- Payroll reports and tax filings
  - View financial reports, payroll history, employee compensation history, contractor payment history, and tax and compliance documents.
- Accounting integrations
  - Set up and manage accounting integrations like QuickBooks and Xero.
Time & Attendance
- Time tracking, scheduling, time off, and project tracking
  - Set up and manage time tracking, schedules, and time off policies. Create and publish scheduled shifts, review and approve worker hours and time off requests, and sync hours to payroll.
Performance
- Team insights
  - Setup employee surveys and view results.
- Performance reviews
  - Create review cycles, manage employee performance reviews, view submitted reviews, and share completed reviews with employees.
Learning
- Learning courses
  - Enroll people in courses from the catalog.
HR resources
- HR resource center
  - Access all HR Resources and certified HR pros.
Benefits
- All benefits
  - Set up and manage all company benefits including health insurance, 401k, and others.
Integrations
- Third-party
  - Manage third party integrations

Basic roles for other team members—customize the role

Custom Basic roles are available on the Simple, Plus, and Premiums plans—admins can upgrade their plan at any time.

Users with Basic roles will never see sensitive information like social security numbers (SSNs), bank account info, or tax elections.

Account owners (aka Primary admins) can choose Basic access levels for less-sensitive functions:

Team members
- Basic information
  - Control access to team members’ information like email, phone number, emergency contact, reporting details, and birthday.
- Pay and work
  - Control access to team members’ compensation and work history.
- Documents
  - Control access to team members’ documents including I-9s and other onboarding documents.
Time & Attendance
- Team time off
  - Control access to team members’ time off including balances, accruals, and requests.
- Time tracking
  - Control access to viewing and approving team members’ timesheets.
- Scheduling
  - Control access to team members’ schedules.
Expenses
- Team expenses
  - Control access to team members’ expenses

Custom role availability based on the Gusto plan you have

Simple: 1 custom role
Plus: 5 custom roles
Premium: Unlimited custom roles

Individual permissions—Basic roles for US employees

Users with individual Basic roles will never see sensitive information like social security numbers (SSNs), bank account info, or tax elections.

Account owners (aka Primary admins) can assign individual permissions by adding a new role, or going to the team member's profile:

Go to People.
Click the name of a US employee.
Under "Additional", click Permissions.
Click Grant permissions to set up new permissions.
- To edit existing roles or permissions, click it's name, and then click Edit role.

Account owners (aka Primary admins) can choose Basic access levels for less-sensitive functions:

Team members
- Basic information
  - Control access to team members’ information like email, phone number, emergency contact, reporting details, and birthday.
- Pay and work
  - Control access to team members’ compensation and work history.
- Documents
  - Control access to team members’ documents including I-9s and other onboarding documents.
Time & Attendance
- Team time off
  - Control access to team members’ time off including balances, accruals, and requests.
- Time tracking
  - Control access to viewing and approving team members’ timesheets.
- Scheduling
  - Control access to team members’ schedules.
Expenses
- Team expenses
  - Control access to team members’ expenses

Add and customize access and roles—includes collaborators outside of Gusto

The Account owner (aka Primary admin) is the only Global admin with the ability to add, remove, or edit permissions for other users. If you’re not the Account owner, reach out to them for help.

Sign in to your Account owner (aka Primary admin) profile in Gusto.
Go to Settings.
Click Permissions.
- The table shows all current admins, managers, and other team members’ access, roles, and relationship.
Toggle to the Roles tab.
- This table shows users with Basic roles that have been customized—view the members involved, the scope of the role, the role type, and who the role was created by.
Click Add a role.
Select a role type—learn more about each here. Choose from:
- Basic
- Limited admin
- Global admin
If not a global admin, choose the access levels for each of the functions available.
- Global admins have predetermined access.
When you’re ready, click Continue.
[For Basic roles only] Tell us who the person has this access for (the scope the of role):
- Everyone
- Direct and indirect reports
  - Indirect reports includes everyone your direct reports manage.
- Select people or groups, like:
  - Departments
  - Job titles
  - Worker status (active)
  - Individuals
Let us know if the person you’re giving access to is:
- A team member—someone who’s already an employee in Gusto.
  - Their admin account will be set up using the personal email in their Gusto profile.
- Not a team member—someone who’s not an employee in Gusto (accountant, bookkeeper, broker, etc).
  - We’ll ask for some additional information about the person.
  - Not available when assigning Basic roles.
Choose the preexisting team member, or if they’re not a team member, enter details about the person.
Click Continue.
Review the Summary of the access and roles you’re giving.
- If you need to change anything, click Edit next to the applicable section.
Click Create role.

We’ll email users about their new access and roles—if they do not see the email, have them:

Check their spam folder and/or;
Make sure the email they’re checking is the one associated with the role.

Users will only be able to view the parts of Gusto that correspond to their permissions.

Ex. If they don’t have the “Benefits” permissions, they will not be able to access the Benefits section in Gusto.

Change the Account owner (aka Primary admin)

Only the current Account owner can assign a new Account owner.

Important reminders

Once changed, you cannot update user permissions anymore. The new Account owner gets full access to everything Gusto.
If the owner is no longer with the company, contact us through the Help section of your profile to let us know.
- No Gusto account? Email [email protected] with proof (documentation) you have authority to “transact on behalf of the business".

Change the Account owner (aka Primary admin)

Only the current Account owner can make this change.

Sign in to your Account owner (aka Primary admin) profile in Gusto.
Go to Settings.
Click Permissions.
Click your name. It should have the "Account owner" tag next to it.
Next to Individual access, click Edit.
Click Change Account owner.
Choose the new Account owner from the dropdown.
- Important: After making this change, you’ll no longer be able to add or remove admins. Only the new account owner can undo this action.
Click Save.

Change access or roles for team members or collaborators

The Account owner (aka Primary admin) is the only Global admin with the ability to add, remove, or edit permissions for other users. If you’re not the Account owner, reach out to them for help.

Sign in to your Account owner (aka Primary admin) profile in Gusto.
Go to Settings.
Click Permissions.
If you're changing access for a single user, click their name on the User tab. If you're updating a custom role, click the role title on the Roles tab.
Click Edit next to the permissions you want to change.
Select the access you want to give, and click Save.

Users will get an email letting them know they're access or roles changed.

Edit a Limited or Global admin's email address

If the person was already a team member in Gusto when you made them an admin, their admin-account was set up using the personal email in their Gusto profile. Learn how to change the email in their member profile.

If the person was set up as "Not a team member", remove their current admin-access (instructions below), and then add access again with the new email.

Remove admins or roles

Only the current Account owner can remove other admins or roles.

If the owner is no longer with the company, contact us through the Help section of your profile to let us know. If you do not have a Gusto account, email [email protected] with proof (documentation) you have authority to “transact on behalf of the business".

Remove admins or roles

Sign in to your Account owner (aka Primary admin) profile in Gusto.
Go to Settings.
Click Permissions.
If you're removing access for a single user, click their name on the User tab. If you're removing a custom Basic role, click the role title on the Roles tab.
Next to their access, click Remove.
- For Roles: Scroll to the bottom of the page and click Remove role. Removing this role will revoke access for people who currently have this role.

An email will be sent to the person, or people, letting them know of the role change.

Employees with Limited or Global access have more than one profile

When you give an employee Limited or Global admin access in Gusto, it creates a new admin profile separate from their employee profile—they'll need to switch between the two account types based on what they're trying to do.

FAQs

Q: Does Gusto send notifications about permission or role changes?

A: We email team members when a role is added, or removed. We do not send notifications about changes to existing access.

Q: Can individuals see what access they have in their Gusto account?

A: No.

Q: Can a Basic role be assigned to someone who is "not a team member"?

A: No. For now, Basic roles must be assigned to existing team members in Gusto.

Q: Can I change a Limited or Global admin to have a Basic role?

A: To limit an admins acccess more, you can edit their individual types of access at the Limited or Global level, or remove the existing role entirely and set up a new Basic role for them.

Q: Can I see who changed permissions or roles (e.g., audit log, change log, or similar)?

A: At this time, no.

Q: Can I assign managers and direct reports like I always have?

A: Yes, assign managers the same way you always have. Custom Basic roles are offered in addition to the preexisting functionality.

Q: If I add a Gusto Pro accounting firm to my account, will they have full access?

A: Yes. The firm-admin has full access in Gusto (and the ability to grant it). They're responsible for assigning other firm members' permissions.

Q: (From accountants) We have multiple accountants working for one client—what does that set up look like?

A: An Accountant can have a full, or limited view of their client's account, based on the access their firm-admin gave them.