An in-house recruitment team gives a hiring manager a login so he can follow his vacancy. Because nobody set up roles, he gets the same account as the recruiters. A week later he mentions, a little too casually, that he saw one of his own team members had applied for a role in another department, including the interview notes. Nothing was hacked and nobody broke a rule; the system simply showed everything to everyone. This article explains how to set up user roles and access rights in your Applicant Tracking System: why access tends to drift, which small set of roles most teams need, which fields and actions deserve extra care, how to handle joiners, movers and leavers, and how to check with your own data whether the set-up still fits.
The right set-up differs per segment. Recruitment agencies want recruiters to work freely across vacancies while keeping fee terms and some client notes with the account manager. Staffing desks often have planners, back-office staff and branch teams who each need a different part of the same candidate record. Secondment firms share profiles with end clients and need to control exactly what leaves the building. Executive search firms run confidential mandates that only the assignment team should see. In-house recruitment teams work with hiring managers and internal applicants, where confidentiality towards colleagues matters most.
Why access rights drift
- Everyone received an administrator account during the first week, because that was quickest, and nobody changed it afterwards
- New users are set up by copying the account of a colleague, including rights that colleague only needed for one project
- Hiring managers and external sourcers get full accounts because a limited view was never defined
- People who left the company or changed teams still have an active login months later
- Exporting and bulk actions are open to every user, so a full download of the candidate database is one click away
None of this is bad intent. Access is usually set up once, under time pressure, and then never looked at again while the team, the clients and the type of data keep changing.
What roles and access rights are, and what they are not
A role is a named set of permissions that describes what a type of user may see and do in the Applicant Tracking System. Access rights are the rules behind it: which records, which fields and which actions. The principle is simple: people see what they need for their own work, and nothing that only matters to someone else.
Roles are not a sign of mistrust. A recruiter who cannot see the fee agreement with a client is not being kept in the dark; that information just does not help when calling candidates. Roles also do not replace agreements with your team or your clients about confidentiality. Data protection rules such as the GDPR ask for appropriate measures to keep personal data limited to the people who need it, and sensible roles are part of that. This article is not legal advice; what applies is what your own policy and contracts say.
A small set of roles most teams need
Start with as few roles as possible. Five or six are usually enough:
- Administrator — manages users, roles, pipeline stages and shared lists; limited to two named people, so there is always a backup but never a crowd
- Recruiter or consultant — works on candidates and vacancies, moves candidates through the pipeline and records notes, outcomes and submissions
- Account manager or team lead — everything a recruiter does, plus client records, agreed terms and approval of exceptions for their own clients or team
- Sourcer or researcher — adds and enriches candidate records and long lists, without access to client terms or offer details
- Hiring manager or client contact — sees only their own vacancies and the candidates presented for them, gives feedback and scores, and does not browse the wider database
- Back office or management — placements, start dates and reports, without interview notes or assessment details
Name roles after the work, not after people. “Account manager” still makes sense next year; “like Sarah” does not.
Fields and records that deserve extra care
Most of a candidate record can be visible to the whole desk. A few parts need a narrower circle:
- Salary information — the recorded salary expectation and offer details, visible to the people handling the vacancy
- Interview notes and scorecards — the shared scorecard is for the interview panel and the recruiter, not for every user
- Identity and right-to-work documents — the right-to-work check before start needs a record that the check was done, while copies of documents stay with the few people who must handle them
- Client terms — fees and agreed terms of business belong with account management and back office
- Confidential vacancies and internal applicants — a replacement search or an employee applying internally is visible only to the named team on that vacancy
Keep the rest open where you can. The candidate and client relationship view beside the pipeline only works if recruiters can see earlier contact, submissions and off-limits agreements before they pick up the phone.
Actions matter as much as visibility
What someone can do is often riskier than what they can see. Decide per role who may:
- Export candidate lists or download files in bulk
- Send bulk emails from the system
- Delete records, or merge duplicate candidates
- Change pipeline stages, entry criteria or the shared skills and tag list
- Change or switch off automated steps such as reminders and status emails
For most of these, a short list of named people is enough. A recruiter who needs a one-off export can ask; the request and the approval are then on record.
Joiners, movers and leavers
Most access problems start when people change. Agree a simple routine. A joiner gets a role on day one, not a copy of a colleague’s account. Someone who moves to another team or desk changes role on the day of the move, and their open candidates and vacancies are handed over to a named colleague. A leaver’s account is deactivated on the last working day rather than deleted, so their history and the record of who moved which candidate stay intact. External sourcers and temporary staff get an end date on their account from the start.
Keep a record of who did what
Roles reduce risk, but they do not show what happened. The Applicant Tracking System should record who viewed sensitive fields, who exported data and who changed roles or settings. That log helps when a client asks how their data is handled, and when a candidate makes a data access request and wants to know who processed their details. Store the log for a defined period, in line with the retention dates you use for candidate records.
Common mistakes to avoid
- A role per person — twenty slightly different roles cannot be reviewed; group people by the work they do
- Locking everything down — recruiters who cannot see contact history start keeping their own lists in spreadsheets, which is worse
- Shared logins — one account for “the branch” or “the client” makes it impossible to know who did what
- Full accounts for hiring managers — give them a view of their own vacancies and submitted candidates, nothing more
- No review — roles set up once and never checked slowly turn into everyone having everything again
Questions teams ask
- We are a team of four. Do we need roles? — Fewer, but yes: at least separate administrators from users, close accounts of leavers and decide who may export
- Should recruiters see each other’s candidates? — Usually yes; shared visibility prevents double work and double submissions, while confidential vacancies stay limited to their team
- Can clients log in? — Only with a limited role for their own vacancies and the candidates presented to them, and only after the candidate has agreed to be presented
- Who decides about exceptions? — Name one owner, often the team lead or administrator, and record every temporary extra right with an end date
Check it with your own data
Count from your own records: how many users have administrator rights, how many active accounts belong to people who left or have not logged in for ninety days, how many users may export, how many exports were made last month and by whom, how many hiring managers or client contacts have more than a limited role, and how many confidential vacancies are visible to users outside their team. Report the number of users behind each figure. Do not compare with industry averages; your own counts show where access has drifted away from the work people do.
A practical start
- List all active users and the role each one has today
- Define five or six roles based on the work, and assign every user to one of them
- Reduce administrators to two named people and limit export and delete rights
- Deactivate accounts of leavers and set end dates for external and temporary users
- Review the user list once a quarter, for example as part of your weekly pipeline review in the last week of the quarter
Access that follows the work
Good roles let recruiters move fast and keep sensitive information with the people who need it. Keep the number of roles small, protect salary, notes, documents and client terms, limit exports and deletions, handle joiners, movers and leavers on the day itself and keep a record of who did what. Explore the product or book a demo — we show how users, roles, field access and logging are set up in BoldATS for your segment.