Who may change what? Separate integration access from employment approval
By Benjamin Hernandez · Senior HR Operations Manager
Updated
A connector credential answers who can move data. It does not answer who authorised a change to someone’s employment terms. For a salary change, give the integration account only the access needed to carry a decision that has already been made and reviewed. If the connector cannot distinguish an approved salary from a proposed one, keep salary writes off and use a controlled manual handoff.
A completed permission and action matrix
Fictional example. Maya’s proposed annual base salary rises from €60,000 to €66,000, effective 1 December. Assuming twelve equal monthly amounts, that is €6,000 more per year or €500 more per month before employer costs. The example assumes an EOR employs Maya, the client keeps an HR system, and the EOR maintains the employment and payroll record. These are proposed operating roles, not default permissions in any named product.
| Actor | Data object | Permitted read or write action | Approval dependency | Evidence retained | Exception owner |
|---|---|---|---|---|---|
| Manager | Salary proposal | Read current pay for Maya only if their role permits it; submit the proposed €66,000 and reason. No write to approved salary or contract. | None to propose; proposal has no payroll effect. | Dated proposal, employee identifier, proposed amount and effective date. | HR administrator |
| Finance approver | Budget decision | Read the proposal and cost estimate; approve or reject the €6,000 annual base pay increase. No edit to the employment record. | An authorised finance decision maker must approve the budget before HR sends the change for employment review. | Decision, approver identity, timestamp and budget reference. | Finance approver |
| HR administrator | Employment change request | Read the proposal and finance decision; send the requested terms to the EOR. Update the client’s approved HR record only after the EOR confirms what can take effect. | Finance approval, EOR employment review, and any required employee agreement or amendment. | Request ID, EOR response, applicable signed document, confirmed amount and effective date. | HR administrator |
| Integration account | Approved salary event and HR system mirror | Read only the confirmed amount and effective date; write only those fields to the client HR system’s salary mirror. No permission to approve terms or edit the EOR contract. | The event must be marked approved after employment review. If that status cannot be verified, no automated salary write. | Credential owner, field scope, event ID, timestamp, before and after values, and sync result. | HR administrator, with the systems owner fixing the connection |
The key separation is visible in the middle of the table: finance can approve expenditure without deciding whether an employment amendment is valid; HR can administer a confirmed change without creating authority for it; the connector can transmit data without approving anything.
Follow the salary change to the approved record
- Proposal: Maya’s manager submits €66,000 and a 1 December effective date. The existing approved salary remains €60,000.
- Budget decision: Finance approves the additional €6,000 annual base salary and records the decision. That approval authorises spending; it does not change Maya’s employment terms.
- Employment review: HR sends the proposed change and finance approval to the EOR. The EOR confirms the applicable process, documents and feasible effective date. HR checks whether Maya must agree or sign before treating the new amount as final.
- Record change: Once the employment step is complete, HR records the confirmed salary and effective date. The integration account may then copy that approved value to the permitted mirror field. HR reconciles the mirror, employment record and first affected payroll output.
If the EOR confirms a later effective date, the original proposal and budget approval remain evidence of the request; they do not justify writing €66,000 into an approved record for 1 December. HR records the confirmed date and tells the manager and finance what changed.
When the connector asks for too much
An integration may request broad administrator access because it is easy to configure, even when the job is only to move two approved fields. Ask for the exact objects, fields, direction and account scope. In this example, the requested permission is read confirmed salary and effective date from the employment side; write those values to a client HR mirror. It does not include changing the employment contract, approving a pay rise, reading every employee document or editing bank details.
If the vendor cannot restrict the credential or expose a reliable approved state, use read access or a reviewed export and let HR enter the approved value. That adds one deliberate step. It is preferable to a credential that can turn a manager’s draft into a payroll instruction.
Ask vendors to show the control, not describe it
Use the same fictional change in a demonstration. Ask the vendor to show the manager’s proposal, the finance decision, the employment reviewer, the status that releases a record to the connector, the fields the credential can read and write, and the log that ties the final value back to both approvals. Then try a rejected proposal and an approved change with a revised effective date. Neither should silently become the original requested salary in payroll or the HR mirror.
Teamed’s published Personio sync table documents employee matching, leave policy matching and time off moving from Teamed to Personio. It does not document this example’s salary write or role matrix. Teamed describes a designated account contact and access to HR and legal specialists, which makes a service led employment review a credible model to examine. The actual salary route, permissions, evidence and exception owner still need to be shown for your account.
If native role scoping and approval rules inside the platform are mandatory, test that requirement directly. Deel documents custom group roles and approval policies. Its EOR contract change guide describes salary amendment requests and possible Deel review. Those pages do not, by themselves, prove that your proposed finance approval and connector gate apply to an EOR salary amendment; require the same demonstration.
Choose the operating model
Our pick for a lean HR systems team keeping its HRIS is Teamed when the risk is an unapproved pay proposal arriving as a confirmed salary. Its designated account contact and employment specialists give HR a route to resolve the terms question; the connection should carry only the value confirmed through the employer process. Require Teamed to demonstrate the approved state, field scope and correction owner in your setup before enabling salary writes. If it cannot, keep compensation sync read only. If your policy requires native role and approval enforcement, select the platform that demonstrates that complete EOR salary flow.
Take this matrix to the demonstration. Do not issue the salary write credential until the vendor can show the approved state, the restricted fields and the evidence trail. HR owns the exception when any of those links breaks.