This article is for Primary admins who set up and manage roles and permissions in Gusto.
Roles and permissions control what someone can view and do in Gusto, as well as the emails they’ll get. You can assign access to paid team members, unpaid team members or outside collaborators (like accountants, bookkeepers, or brokers).
You can set up unlimited Global or Limited admins.
Admins can be paid team members or outside collaborators.
Customers on Plus and Premium plans can add unlimited managers with standard permissions.
To adjust manager access, create or customize a Basic role.
Other helpful articles
How to update company details (like your Signatory, addresses, and more)
For Gusto Pro accountants: Learn how to manage the firm’s clients.
You can add different types of people in Gusto.
Team members
Add from template
Multiples employees at once
Unpaid team members
Go to a different article to learn how to add unpaid team members.
External collaborators
Accountants
Bookkeepers
Other collaborators
As a Primary admin, you can assign different levels of access to the people you add.
Signatory: One per company, set during onboarding
Can sign documents
To change the Signatory, update your company details.
Account Owner (Primary admin): One per company
Has Global admin access
Only the Account Owner can add, remove, or edit permissions for other users.
Can be a team member or collaborator
Global Admin: Use sparingly
Has full access to all company information
Does not manage roles/permissions — only the Account Owner can
Can be a team member or collaborator
If you assign admin access to a team member, they need to switch between their employee and admin accounts to handle different tasks.
No limit to how many you can assign
Limited admin: Recommended for most cases
Lets you choose which functions they can access (payroll, benefits, reports, and more)
Can be a team member or collaborator
If you assign admin access to a team member, they need to switch between their employee and admin accounts to handle different tasks.
No limit to how many you can assign
Basic roles (custom)
Availability depends on plan type:
Simple: 1 role
Plus: 5 roles
Premium: Unlimited roles
Let you delegate limited tasks to individual team members
Users with Basic roles never see sensitive data like Social Security numbers (SSNs), bank account info, or tax returns.
Most common for team members like managers who need more access than a standard manager
You must set up outside collaborators who are not team members with admin access (Limited or Global).
Basic individual permissions: No limit
Let you delegate limited tasks to individual team members.
You can add individual permission for US employees and contractors, non-US contractors, and unpaid team members.
Find more details about Global, Limited, and Basic access below.
Global admins get unrestricted access to all company information and functions. Give Global access to company owners and administrators. You should typically give this level of access to only a few people, as they’ll have access to all of your company information.
If you do not want to give this level of access, choose Limited admin instead.
Note: If you choose Limited admin instead and select every role type and all permissions, it’s still not the same thing as giving Global access to Gusto.
Hire and dismiss people
Run payroll and pay contractors
Create reports
Manage taxes
Manage benefits
Manage company bank accounts
Manage and pay bills
Manage company data
Manage the company Signatory
View and edit compensation
Global admins cannot add, remove, or edit the roles and permissions of other users. Only the Account Owner (Primary admin) can do that.
Limited admins get customized access to specific Gusto functions based on your selection. Account Owners (Primary admins) can assign Limited admin roles to specific people or groups to restrict their access.
Pay
Run payroll
Pay employees, view pay reports, manage expenses, edit pay schedules, and manage tax information and Payroll on Autopilot™.
If you’re using payroll approvals, Limited admins can request payroll approval on regular payrolls. We do not support approvals on other payroll types (e.g., off-cycle, bonus, and more).
Pay contractors
Pay contractors and view contractor payment reports.
Team members
Basic information
View and edit a team member’s personal information.
Hire and onboard
Add team members and contractors, create and manage job posts, send offer letters, send and review background checks, create and manage onboarding checklists, and manage documents, provisioning app integrations, and hiring integrations.
Manage and offboard
Dismiss team members, view and manage offboarding checklists, and manage expenses.
Pay and work
View and edit a team member’s compensation information.
Documents
View and edit a team member’s documents. Some documents may include sensitive information.
Reports
Payroll reports and tax filings
View financial reports, payroll history, employee compensation history, contractor payment history, and tax and compliance documents.
Accounting integrations
Set up and manage accounting integrations like QuickBooks and Xero.
Time & Attendance
Time tracking, scheduling, time off, and project tracking
Set up and manage time tracking, schedules, and time off policies. Create and publish scheduled shifts, review and approve worker hours and time-off requests, and sync hours to payroll.
Performance
Team insights
Set up employee surveys and view results.
Performance reviews
Create review cycles, manage employee performance reviews, view submitted reviews, and share completed reviews with employees.
Learning
Learning courses
Enroll people in courses from the catalog.
HR resources
HR resource center
Access all HR resources and certified HR pros.
Benefits
All benefits
Set up and manage all company benefits including health insurance, 401 (k), and others.
View Gusto’s Employee Benefits Election report.
Important: The report contains sensitive info that people with this permission will be able to see, regardless of other permission limitations (e.g., Social Security numbers, date of birth, annual wages, and more).
Integrations
Third-party
Manage third-party integrations.
Basic permissions let you delegate specific tasks to people without giving them access to sensitive data. You can use Basic individual permissions for US employees and contractors, non-US contractors, and unpaid team members.
You can also customize roles with fixed permissions and assign them to groups.
Custom roles are available on the Simple, Plus, and Premiums plans — admins can upgrade their plan at any time.
Users with Basic roles will never see sensitive information like Social Security numbers (SSNs), bank account info, or tax elections.
The Account Owner (Primary admin) can choose Basic access levels for less-sensitive functions:
Team members
Basic information
Control access to team members’ information like email, phone number, emergency contact, reporting details, and birthday.
Pay and work
Control access to team members’ compensation and work history.
Documents
Control access to team members’ documents, including I-9s and other onboarding documents.
Time & Attendance
Team time off
Control access to team members’ time off, including balances, accruals, and requests.
Time tracking
Control access to viewing and approving team members’ timesheets.
Scheduling
Control access to team members’ schedules.
Expenses
Team expenses
Control access to team members’ expenses.
Simple: 1 custom role
Plus: 5 custom roles
Premium: Unlimited custom roles
Only the Account Owner (Primary admin) can set up or edit permissions. You can do this by opening a team member’s profile or by creating a custom role and assigning it to them.
You can add Basic individual permissions for US employees and contractors, non-US contractors, and unpaid team members.
Note: Users with Basic roles never see sensitive details like Social Security numbers (SSNs), bank account info, or tax elections.
To set up or edit Basic individual permissions for team members:
Go to People.
Click the name of a US employee.
Under Additional, click Permissions.
Click Add permissions to set up new permissions.
To edit an existing role or permission, click its name, and then click Edit role.
Toggle to the access level you want them to have (Basic, Limited, or Global).
Click Continue.
The Account Owner (Primary admin) can choose Basic access levels for less-sensitive functions:
Team members
Basic information
Control access to team members’ information like email, phone number, emergency contact, reporting details, and birthday.
Pay and work
Control access to team members’ compensation and work history.
Documents
Control access to team members’ documents, including I-9s and other onboarding documents.
Time & Attendance
Team time off
Control access to team members’ time off, including balances, accruals, and requests.
Time tracking
Control access to viewing and approving team members’ timesheets.
Scheduling
Control access to team members’ schedules.
Expenses
Team expenses
Control access to team members’ expenses.
Collaborators work with your company, but may not be on the company’s payroll. They may be:
Accountants
Bookkeepers
Other collaborators
Only the Account Owner (Primary admin) can add collaborators. If the person is part of your organization directly, but not getting paid, you may want to set them up as an unpaid team member.
To add an external collaborator and set up their permissions:
Go to People.
Next to Add person, click the caret and choose Add collaborator.
Select the collaborator type (accountant, bookkeeper, broker, or other).
Enter the collaborator’s details:
First name
Last name
This will invite them to your organization — make sure this information is correct.
Personal note (optional)
Choose their role (Limited or Global admin).
Limited admin
Choose the access levels for each function.
Collaborators can only view the parts of Gusto that match their permissions.
Example: If they do not have Benefits permissions, they cannot access the Benefits section in Gusto.
Global admin
Global admins have predetermined access.
Click Save collaborator.
Collaborators get an email about their new access. If they do not see it, have them check their spam folder or confirm they used the correct email address.
Only the Account Owner (Primary admin) can manage collaborators’ access.
To update outside collaborator access:
Go to People.
Click Collaborators.
Click their name.
Next to their access, click Edit or Remove.
Edit: Change permissions, then click Save.
Remove: Revoke access completely and remove their role from the system.
Follow the steps that match how you set up the person in Gusto:
If they’re already a team member: Update their personal email or details in their Gusto team member profile (instead of their admin profile).
If you added them as a collaborator: Remove their admin access and re-add them with updated info.
Only the Account Owner (Primary admin) can add, remove, or edit permissions for other users.
To create and customize Basic roles:
In the left menu, click your company name.
Under Settings, click Permissions.
The table shows the access, roles, and relationships of all current admins, managers, and other team members.
Use the Users tab to manage individuals or the Roles tab to manage roles.
To create a new role, click Add a role.
Select role type (Basic, Limited, Global).
Choose access levels (if Limited or Basic).
Global admins have predetermined access.
For Basic roles, assign permissions (like controlling access to team members’ time off and schedules).
Click Continue.
For Basic roles, select the scope:
Everyone
Direct and indirect reports
Indirect reports includes everyone your direct reports manage.
Select people or groups, like:
Departments
Job titles
Worker status (active)
Individuals
Click Continue.
Choose who you’re giving access to.
This can include different roles based on manager status or job title, as well as individual team members.
Click Continue.
Give the new role a name.
Review the summary and click Save role.
If you need to change anything, click Edit.
Users get an email about their new access. If they do not see it, have them check their spam folder or confirm they used the correct email address. They can only view the parts of Gusto that match their permissions.
Example: If they do not have Benefits permissions, they cannot access the Benefits section in Gusto.
The current Account owner (Primary admin) can assign a new account owner.
If the current primary admin is unreachable or has left the company, other admins or signatories can request to become the new Account owner.
Once you assign a new Account Owner, you lose access to edit permissions.
If the Account Owner left the company, and another admin or signatory cannot request to become the new Account owner, you'll need to contact us for next steps.
No Gusto account? Email [email protected] with documents (a copy of photo ID and Articles of Incorporation or an operating agreement that contains this information) proving you have the authority to "transact on behalf of the business.
To contact us, sign in to your Gusto account and click the help icon in the top-right corner of the page.
To change the Account owner (as the current Primary admin):
In the left menu, click your company name.
Under Settings, click Permissions.
In the Users tab, click your name (tagged “Account Owner”).
Next to Individual access, click View details, then click Change Account Owner.
Choose a new Account Owner from the dropdown.
Important: After making this change, you can no longer add or remove admins. Only the new Account Owner can undo this action.
Click Save.
Only the Account Owner (Primary admin) can add, remove, or edit permissions for other users. If you’re not the account owner, contact them for help.
If the Account Owner left the company, the Signatory must request a support call in Gusto from their account.
To contact us, sign in to your Gusto account and click the help icon in the top-right corner of the page.
No Gusto account? Email [email protected] with documents (a copy of photo ID and Articles of Incorporation or an operating agreement that contains this information) proving you have the authority to "transact on behalf of the business.”
To manage access for any user or role:
In the left menu, click your company name.
Under Settings, click Permissions.
Choose the tab based on what you need to do:
Users: Manage individual access
Click Users.
Click the user’s name.
Choose to Edit or Remove each type of permission they have.
Roles: Manage roles
Click Roles.
To edit or remove a role, click the role title.
Click Edit next to the permissions you want to change.
To remove the role entirely: Scroll to the bottom of the page and click Remove role. This revokes access for people who currently have this role. We’ll send an email to let them know about the role change.
Select the access you want to give, and click Save.
Q: Does Gusto send notifications about permission or role changes?
A: We email users when you add or remove roles. We do not email about edits to existing access.
Q: Can users see their own access in Gusto?
A: No. Only the Account Owner or Global Admins can view a user's assigned permissions.
Q: Can I assign Basic roles to outside collaborators (who are not team members)?
A: No. Basic roles are for team members only.
Q: How can I reduce a Global or Limited admin’s access to Basic?
A: Remove their current role and set up a new Basic role, or adjust their Limited/Global permissions.
Q: Can I see who changed permissions or roles?
A: We do not have an audit or change log.
Q: Can I still assign managers and direct reports?
A: Yes, the process works the same. Custom Basic roles are an additional option.
Q: If I add a Gusto Pro accounting firm, do they get full access?
A: Yes. The firm admin has full access and can assign permissions to others at the firm.
Q: (For accountants) How does access work for multiple accountants at one firm?
A: Each accountant’s access (full or limited) depends on what their firm admin assigns.