Employee

Because a business needs to know who works for it, what they are owed, and what they are permitted to do — three questions that are related but answered from different data.

The employee record is where HR, payroll and access control meet, and separating it from the user account is what keeps that intersection manageable. The high-consequence part is authority: who can approve what, and what happens to that authority when the person is absent or gone. Get it wrong and either the business stops or its controls do.

• An employee record and a system user are different objects. Not every employee needs a login, and some system users are not employees.
• Employment has a start date and may have an end date. Records are never deleted — payroll, statutory and audit history outlive the employment.
• Approval authority attaches to a role, not to a person. When someone leaves, the authority must transfer without the record being edited.

Offboarding is treated as an HR task rather than a systems one. Payroll stops promptly; access does not. Months later an audit finds live credentials for people who left, and the approvals those accounts could still give were never revoked.

• Contractors and consultants who need system access but no payroll record.
• Rehires, where a second employment period must not overwrite the first.
• Employees moving between group companies, where payroll transfers but service continuity may not.
• Someone who leaves while documents they raised are still mid-approval.