# Employee portal access

Creating an employee from Add employee automatically creates an Employee-role login when an email address is supplied and the actor has identity.manage. The company user limit applies. Employee creation and account creation commit together; an existing login email is rejected rather than linked silently. Employees without an email, and records created by HR without identity.manage, can receive portal access later from an authorized administrator. CSV imports and recruitment keep their existing account flows.

The welcome email uses the requested company greeting, login URL, email and one-time password. It uses the existing encrypted platform delivery outbox and account-email configuration. Account email is submitted synchronously after the outermost account transaction commits, before the response returns; it does not wait for a queue worker or maintenance cron. Transport failures remain recorded for recovery through existing maintenance, and the employee form reports the failure without losing the saved account. Email remains disabled locally by default; no real message is sent during local browser testing. An administrator sees delivery status on the employee profile. Resending welcome email rotates the temporary password and invalidates prior pending messages.

Manual account actions use an independent limiter: 30 actions per minute per administrator, with at most three actions per employee per administrator per minute. Document uploads and other throttled actions do not consume this allowance. On cooldown, browser users return to Portal access with a retry message; JSON clients receive HTTP 429 and Retry-After. Blocked requests never rotate credentials or create email deliveries, and passwords are not flashed into the session.

The login URL uses the first active, ownership-verified, TLS-checked custom domain when the branding entitlement is active; otherwise it uses APP_URL/login. Request Host headers cannot change this URL.

Temporary passwords expire after 48 hours. Every web request is blocked from portal access until the employee chooses a different password. Bearer API access is also blocked. Password hashes are stored on users; temporary passwords are kept only in encrypted delivery-record bodies, removed after successful delivery, and never included in audit metadata or status messages. Password reset cancels old pending welcome deliveries and invalidates existing sessions and password-reset links. Normal forgot-password completion also clears the temporary-password requirement.

Authorized administrators can set/reset temporary passwords from Workspace access & password on an employee profile. This remains scoped to the current company and employee access policy; platform, disabled and the acting administrator's own account cannot be reset through this employee tool. Use Account security for your own account.

The reporting field is labeled No line manager required. It exempts an approved company head from a required-manager rule; it does not grant any role or permissions. Old branch document types are grouped under Previous branch document types. New document type masters support Company and Employee only. Existing branch records and file ownership are unchanged.

Deployment adds migration 2026_10_21_000033_employee_temporary_passwords. Existing users default to no forced password change. Back up the database and encryption keys before running migrations; keep the existing production maintenance cron enabled.