Primary admins (Account Owners) can learn about the types of permissions and access that can be given in Gusto. Learn how to add new admins and roles (for existing team members or collaborators outside of Gusto), manage permissions, remove access, and more.
Users Intent
Context Variations
Content
This article is for Primary admins who set up and manage roles and permissions in Gusto.
Roles and permissions control what someone can view and do in Gusto, as well as the emails they’ll get. You can assign access to paid team members, unpaid team members or outside collaborators (like accountants, bookkeepers, or brokers).
Key things to know about roles and permissions in Gusto
- You can set up unlimited Global or Limited admins.
- Admins can be paid team members or outside collaborators.
- Customers on Plus and Premium plans can add unlimited managers with standard permissions.
- To adjust manager access, create or customize a Basic role.
Other helpful articles
Access types and permission levels As a Primary admin, you can assign different levels of access to the people you add.
- Signatory: One per company, set during onboarding
- Account Owner (Primary admin): One per company
- Has Global admin access
- Only the Account Owner can add, remove, or edit permissions for other users.
- Can be a team member or collaborator
- Global Admin: Use sparingly
- Has full access to all company information
- Does not manage roles/permissions — only the Account Owner can
- Can be a team member or collaborator
- No limit to how many you can assign
- Limited admin: Recommended for most cases
- Lets you choose which functions they can access (payroll, benefits, reports, and more)
- Can be a team member or collaborator
- No limit to how many you can assign
- Basic roles (custom)
- Availability depends on plan type:
- Simple: 1 role
- Plus: 5 roles
- Premium: Unlimited roles
- Let you delegate limited tasks to individual team members
- Users with Basic roles never see sensitive data like Social Security numbers (SSNs), bank account info, or tax returns.
- Most common for team members like managers who need more access than a standard manager
- You must set up outside collaborators who are not team members with admin access (Limited or Global).
- Basic individual permissions (for US employees): No limit
- Let you delegate limited tasks to individual team members
Find more details about Global, Limited, and Basic access below.
Global admin access — Full company access Global admins get unrestricted access to all company information and functions. Give Global access to company owners and administrators. You should typically give this level of access to only a few people, as they’ll have access to all of your company information.
If you do not want to give this level of access, choose Limited admin instead.
Note: If you choose Limited admin instead and select every role type and all permissions, it’s still not the same thing as giving Global access to Gusto.
Global admins have access to:
- Hire and dismiss people
- Run payroll and pay contractors
- Create reports
- Manage taxes
- Manage benefits
- Manage company bank accounts
- Manage and pay bills
- Manage company data
- Manage the company Signatory
- View and edit compensation
Global admins cannot add, remove, or edit the roles and permissions of other users. Only the Account Owner (Primary admin) can do that.
Limited admin access — Customized function access Limited admins get customized access to specific Gusto functions based on your selection. Account Owners (Primary admins) can assign Limited admin roles to specific people or groups to restrict their access.
- Pay
- Run payroll
- Pay employees, view pay reports, manage expenses, edit pay schedules, and manage tax information and Payroll on Autopilot™.
- If you’re using payroll approvals, Limited admins can request payroll approval on regular payrolls. We do not support approvals on other payroll types (e.g., off-cycle, bonus, and more).
- Pay contractors
- Pay contractors and view contractor payment reports.
- Team members
- Basic information
- View and edit a team member’s personal information.
- Hire and onboard
- Add team members and contractors, create and manage job posts, send offer letters, send and review background checks, create and manage onboarding checklists, and manage documents, provisioning app integrations, and hiring integrations.
- Manage and offboard
- Dismiss team members, view and manage offboarding checklists, and manage expenses.
- Pay and work
- View and edit a team member’s compensation information.
- Documents
- View and edit a team member’s documents. Some documents may include sensitive information.
- Reports
- Payroll reports and tax filings
- View financial reports, payroll history, employee compensation history, contractor payment history, and tax and compliance documents.
- Accounting integrations
- Set up and manage accounting integrations like QuickBooks and Xero.
- Time & Attendance
- Time tracking, scheduling, time off, and project tracking
- Set up and manage time tracking, schedules, and time off policies. Create and publish scheduled shifts, review and approve worker hours and time-off requests, and sync hours to payroll.
- Performance
- Team insights
- Set up employee surveys and view results.
- Performance reviews
- Create review cycles, manage employee performance reviews, view submitted reviews, and share completed reviews with employees.
- Learning
- Learning courses
- Enroll people in courses from the catalog.
- HR resources
- HR resource center
- Access all HR resources and certified HR pros.
- Benefits
- All benefits
- Set up and manage all company benefits including health insurance, 401 (k), and others.
- View Gusto’s Employee Benefits Election report.
- Important: The report contains sensitive info that people with this permission will be able to see, regardless of other permission limitations (e.g., Social Security numbers, date of birth, annual wages, and more).
- Integrations
- Third-party
- Manage third-party integrations.
Assign Basic permissions to one person or many Basic permissions let you delegate specific tasks to people without giving them access to sensitive data. You can use Basic individual permissions for all US employees. You can also customize roles with fixed permissions and assign them to groups.
- Custom roles are available on the Simple, Plus, and Premiums plans — admins can upgrade their plan at any time.
Users with Basic roles will never see sensitive information like Social Security numbers (SSNs), bank account info, or tax elections.
Account Owners (Primary admins) can choose Basic access levels for less-sensitive functions:
- Team members
- Basic information
- Control access to team members’ information like email, phone number, emergency contact, reporting details, and birthday.
- Pay and work
- Control access to team members’ compensation and work history.
- Documents
- Control access to team members’ documents, including I-9s and other onboarding documents.
- Time & Attendance
- Team time off
- Control access to team members’ time off, including balances, accruals, and requests.
- Time tracking
- Control access to viewing and approving team members’ timesheets.
- Scheduling
- Control access to team members’ schedules.
- Expenses
- Team expenses
- Control access to team members’ expenses.
Custom role availability based on the Gusto plan you have
- Simple: 1 custom role
- Plus: 5 custom roles
- Premium: Unlimited custom roles
Set up or edit permissions for US employees Only Account Owners (Primary admins) can set up or edit permissions. You can do this by opening a team member’s profile or by creating a custom role and assigning it to them.
Note: Users with Basic roles never see sensitive details like Social Security numbers (SSNs), bank account info, or tax elections.
To set up or edit permissions for US employees:
- Sign in as Account Owner (Primary admin).
- Go to People.
- Click the name of a US employee.
- Under Additional, click Permissions.
- Click Add permissions to set up new permissions.
- To edit an existing role or permission, click its name, and then click Edit role.
- Toggle to the access level you want them to have (Basic, Limited, or Global).
- Click Continue.
Account Owners (Primary admins) can choose Basic access levels for less-sensitive functions:
- Team members
- Basic information
- Control access to team members’ information like email, phone number, emergency contact, reporting details, and birthday.
- Pay and work
- Control access to team members’ compensation and work history.
- Documents
- Control access to team members’ documents, including I-9s and other onboarding documents.
- Time & Attendance
- Team time off
- Control access to team members’ time off, including balances, accruals, and requests.
- Time tracking
- Control access to viewing and approving team members’ timesheets.
- Scheduling
- Control access to team members’ schedules.
- Expenses
- Team expenses
- Control access to team members’ expenses.
Add a collaborator from outside the organization and set up permissions (Limited or Global access) Collaborators work with your company, but may not be on the company’s payroll. They may be:
- Accountants
- Bookkeepers
- Brokers
- Other collaborators
Only the Account Owner (Primary admin) can add collaborators. If the person is part of your organization directly, but not getting paid, you may want to set them up as an unpaid team member.
To add an external collaborator and set up their permissions:
- Sign in as Account Owner (Primary admin).
- Go to People.
- Next to Add person, click the caret and choose Add collaborator.
- Select the collaborator type (accountant, bookkeeper, broker, or other).
- Enter the collaborator’s details:
- First name
- Last name
- Email
- This will invite them to your organization — make sure this information is correct.
- Personal note (optional)
- Choose their role (Limited or Global admin).
- Limited admin
- Choose the access levels for each function.
- Collaborators can only view the parts of Gusto that match their permissions.
- Example: If they do not have Benefits permissions, they cannot access the Benefits section in Gusto.
- Global admin
- Click Save collaborator.
Collaborators get an email about their new access. If they do not see it, have them check their spam folder or confirm they used the correct email address.
Create and customize Basic roles for one or many Only the Account Owner (Primary admin) can add, remove, or edit permissions for other users.
To create and customize Basic roles:
- Sign in as Account Owner (Primary admin).
- Click your name (top-right), then click Settings.
- Under Company, click Permissions.
- The table shows the access, roles, and relationships of all current admins, managers, and other team members.
- Use the Users tab to manage individuals or the Roles tab to manage roles.
- To create a new role, click Add a role.
- Select role type (Basic, Limited, Global).
- Choose access levels (if Limited or Basic).
- For Basic roles, assign permissions (like controlling access to team members’ time off and schedules).
- Click Continue.
- For Basic roles, select the scope:
- Everyone
- Direct and indirect reports
- Indirect reports includes everyone your direct reports manage.
- Select people or groups, like:
- Departments
- Job titles
- Worker status (active)
- Individuals
- Click Continue.
- Choose who you’re giving access to.
- This can include different roles based on manager status or job title, as well as individual team members.
- Click Continue.
- Give the new role a name.
- Review the summary and click Save role.
- If you need to change anything, click Edit.
Users get an email about their new access. If they do not see it, have them check their spam folder or confirm they used the correct email address. They can only view the parts of Gusto that match their permissions.
Example: If they do not have Benefits permissions, they cannot access the Benefits section in Gusto.
Change the Account Owner (Primary admin) Only the current Account Owner (Primary admin) can assign a new account owner.
Important
- Once you assign a new Account Owner, you lose access to edit permissions.
- If the Account Owner left the company, the Signatory must request a support call in Gusto from their account. To contact us, sign in to your Gusto account and click the help icon
in the top-right corner of the page. - No Gusto account? Email support@gusto.com with documents (a copy of photo ID and Articles of Incorporation or an operating agreement that contains this information) proving you have the authority to "transact on behalf of the business.”
Change the Account Owner (Primary admin)
To change the Account Owner:
- Sign in as Account Owner (Primary admin).
- Click your name (top-right), then click Settings.
- Under Company, click Permissions.
- Click your name (tagged “Account Owner”).
- Next to Individual access, click Edit, then click Change Account Owner.
- Choose a new Account Owner from the dropdown.
- Important: After making this change, you can no longer add or remove admins. Only the new Account Owner can undo this action.
- Click Save.
Add, edit, or manage access for any user or role Only the Account Owner (Primary admin) can add, remove, or edit permissions for other users. If you’re not the account owner, contact them for help.
If the Account Owner left the company, the
Signatory must request a support call in Gusto from their account. To contact us, sign in to your Gusto account and click the
help icon in the top-right corner of the page.
- No Gusto account? Email support@gusto.com with documents (a copy of photo ID and Articles of Incorporation or an operating agreement that contains this information) proving you have the authority to "transact on behalf of the business.”
Manage access for any user or role
To manage access for any user or role:
- Sign in as Account Owner (Primary admin).
- Click your name (top-right), then click Settings.
- Under Company, click Permissions.
- Choose the tab based on what you need to do:
- Users: Manage individual access
- Click Users.
- Click the user’s name.
- Choose to Edit or Remove each type of permission they have.
- Roles: Manage roles
- Click Roles.
- To edit or remove a role, click the role title.
- Click Edit next to the permissions you want to change.
- To remove the role entirely: Scroll to the bottom of the page and click Remove role. This revokes access for people who currently have this role. We’ll send an email to let them know about the role change.
- Select the access you want to give, and click Save.
FAQs Q: Does Gusto send notifications about permission or role changes?
A: We email users when you add or remove roles. We do not email about edits to existing access.
Q: Can users see their own access in Gusto?
A: No.
Q: Can I assign Basic roles to outside collaborators (who are not team members)?
A: No. Basic roles are for team members only.
Q: How can I reduce a Global or Limited admin’s access to Basic?
A: Remove their current role and set up a new Basic role, or adjust their Limited/Global permissions.
Q: Can I see who changed permissions or roles?
A: We do not have an audit or change log.
Q: Can I still assign managers and direct reports?
A: Yes, the process works the same. Custom Basic roles are an additional option.
Q: If I add a Gusto Pro accounting firm, do they get full access?
A: Yes. The firm admin has full access and can assign permissions to others at the firm.
Q: (For accountants) How does access work for multiple accountants at one firm?
A: Each accountant’s access (full or limited) depends on what their firm admin assigns.
