Settings issues

Settings cards are permission-filtered and many actions are filtered again by state. Seeing a page without an edit action does not prove a product defect.

Role and access: an administrator checks effective permission; users do not expand their own scope. Start at /settings; two common specialist areas are Labor law rules at /settings/labor-rules and Approval workflows at /settings/workflows.

A card appears only with its view permission; check the role before treating absence as a visual defect.

The add action can be absent when no unapplied rule remains or the account is view-only.

A definition may save, but activation remains blocked until its approval structure is ready.

The new editor separates requirements across five channels; create or save becomes available only when name, values, and change state are valid.

A Settings card is missing

Check first

1. Selected organisation.
2. Active role/assignment.
3. Whether permission is administration or self-service.

Resolution

An administrator checks effective permission and scope under Roles & Permissions, then the user refreshes their session. Do not type the URL to bypass navigation.

Expected result: required cards appear and unrelated cards remain hidden.

Still blocked? Provide card, role, scope and assignment time.

An attendance policy cannot be created or saved

Check first

1. The account has policy-management rather than view-only access.
2. The policy name is present; the system Default name is intentionally locked.
3. An enabled GPS-accuracy warning uses a valid positive whole number.
4. At least one field or requirement has really changed and no background request is still pending.

Resolution

Review every channel on the left, correct the field showing an error, then read the requirement summary. Save only when the action is enabled. To leave a dirty editor, use its discard confirmation instead of reloading the page.

Expected result: a new policy appears in the list; an edited policy advances to its next version while preserving previous history.

Still blocked? Provide channel, invalid-field label, save-button state, and visible message without real coordinates, IP ranges, or verification photos.

Automatic-code counter will not reset

Check first

1. A reason is entered.
2. Configuration is active.
3. Next code does not collide.
4. Reset cycle inferred from pattern is correct.

Resolution

Select a non-colliding next value or verify and edit the pattern. Do not delete old records or bypass collision protection.

Expected result: reset is stored with reason and preview shows an unused code.

Still blocked? Provide code type, preview and collision message without sensitive records.

Bank template has no Preview

Check first

1. Valid .xlsx uploaded.
2. The intended worksheet is first and the data-start row is correct.
3. All four mappings exist: unaccented name, recipient account, amount and transfer narrative.
4. Template management permission.

Resolution

Move the intended worksheet first, reopen the builder and complete missing mappings. The current wizard does not switch worksheets; Preview appears only when required inputs exist.

Expected result: headers, column order and sample rows align.

Still blocked? Provide bank, worksheet and missing-column names; never full account numbers.

Approval workflow saves but will not activate

Check first

1. At least one step.
2. Every step resolves an approver source.
3. Conditions and timeout handling are valid.
4. Readiness blockers.

Resolution

Keep it Inactive and fix readiness issues one by one. Do not use no-match auto-approval to bypass a required human decision.

Expected result: Active workflow routes a test request to the correct recipient.

Still blocked? Provide definition name, step count and non-sensitive readiness text.

Add labour rule is missing

Check first

1. Manage versus view-only access.
2. All library rules already applied.
3. Category/effective-date filter.

Resolution

Clear filters and review the library. If all rules are applied, change mode on existing rows; do not create duplicates.

Expected result: the action appears only with an available rule and management access.

Still blocked? Provide rule category and current role.

SSO saved but employees cannot sign in

Check first

1. Configured versus Active.
2. Connector-not-live warning.
3. Enforce SSO is unavailable.

Resolution

Keep Rifena-account sign-in. The current external OIDC/SAML connector is not live; escalate activation to the identity team and do not enforce SSO.

Expected result: users retain a safe current sign-in path; external configuration is not advertised as active.

Still blocked? Send only state and non-sensitive error text; never secrets or private certificates.

An IP change blocked clocking

Check first

1. The effective policy requires IP.
2. Affected Web/Mobile/Kiosk/Device/Manual source.
3. An Active range applies to that source and matches the observed address.

Resolution

Sign in to administration normally, correct or reactivate a verified range, or narrowly pause the IP requirement under change control. The allowlist does not control sign-in; do not open an overly broad CIDR.

Expected result: the valid clock source records an event and the outside source remains blocked.

Still blocked? Ask network administration to inspect VPN, proxy, IPv4/IPv6 and CIDR.

See Settings map and Access and notification issues.

Hand off when the issue remains blocked

Give the Settings owner the card name, route, role, scope, state, and visible message. Mask account numbers, secrets, private certificates, and employee data before attaching an image.