HRMS · Governance
Configure /admin/feature-flags API /api/v2/app/config/work-time-governance

Work-Time Governance

A code-owned catalog of timesheet, approval, planning, attendance, and integration features. Catalog defaults are off. Application Config stores tenant choices; existing timesheet, leave, and attendance approval engines stay the source of truth.

Admins enable features on Admin → Feature flags. Contributors see a governance banner on Timesheet when validation or late-band rules apply.

Code-owned catalog

Families that stay off until you switch them on

Work-Time Governance is a code-owned catalog of timesheet, approval, planning, attendance, and integration features. Catalog defaults are off. Application Config and the Feature flags console are how families go live.

Admin → Feature flags (Work-Time Governance panel) HR Admin · Org Admin

The job of this console

Understand which family you are about to enable, the dependents, and the screens that will appear. Enable from Feature flags / Application Config — this page is the map, not a second toggle UI.

Seat at the table

Administrators designing time rules. Employees never enable catalog families.

The working rhythm

Read the family, check dependents, enable on Feature flags, then prove timesheet, attendance, or approval still behave. Roll back the flag if a family is not ready.

Moments that bring you here

Before turning on approval chain. A planning feature that surprised managers. After an upgrade that added catalog entries. When two families overlap.

ⓘ
Defaults are off
Shipping code is not the same as enabling a family. Application Config still holds related keys; this catalog does not store hours.

Interactive data flow

Work-Time Governance sits on top of the existing timesheet approval flags. Use the timesheet simulator for submit/approve/lock, then return here for catalog families and resolver rules.

Flowcharts

Each diagram auto-plays steps when it scrolls into view. Use Play / Pause, or click a step to jump.

1 — Effective-value resolver

Catalog default, then Application Config, then optional project override, then role AND, then dependency AND.

flowchart TD
  Cat[Catalog default off] --> App[Application Config]
  App --> Proj{Project override?}
  Proj -->|No| Role
  Proj -->|Yes| Role[Role gate AND]
  Role --> Dep[Dependencies AND]
  Dep --> Eff[Effective enabled]
            
  1. 1
    Catalog defaultCode owns identity, family, and default-off.
  2. 2
    Application ConfigTenant / org unit choice stored on the HRMS module.
  3. 3
    Project override?Optional per-project on/off when the feature allows project scope.
  4. 4
    Role gate ANDBulk actions, import/export, and admin policy require matching role flags.
  5. 5
    Dependencies ANDEscalation needs chain; FTE needs estimates; WFH needs source resolution.
  6. 6
    Effective enabledFeature Flags panel shows Enabled, Blocked, or Off.

2 — Attendance source composition

Leave first, then swipe, timesheet WFH hours, and regularization. Resolve is a composed read — it does not write the attendance matrix.

flowchart TD
  Day[Work day] --> Leave{Approved leave?}
  Leave -->|Yes| Out[Leave evidence]
  Leave -->|No| Swipe{Swipe ingest on?}
  Swipe -->|Hit| Out2[Swipe evidence]
  Swipe -->|Miss| Wfh{Timesheet WFH on?}
  Wfh -->|Hours| Out3[WFH from timesheet]
  Wfh -->|No| Reg{Regularization?}
  Reg -->|Yes| Out4[Override]
  Reg -->|No| Empty[No composed source]
            
  1. 1
    Work dayResolve one employee-day at a time.
  2. 2
    Approved leave?Leave remains first and is not replaced by hours.
  3. 3
    Swipe ingestRaw swipe rows persist only when attendance.swipe-ingest is on.
  4. 4
    Timesheet WFHApproved timesheet hours can mark WFH when that feature is on.
  5. 5
    RegularizationExisting attendance regularization can override the composed view.
  6. 6
    Composed sourceRead API only — the Attendance matrix stays the write store.

Overview

Work-Time Governance is not a second timesheet product. It is a switchboard: about twenty catalog features grouped into approval, timesheet, planning, attendance, integration, and admin families. Turning a feature on does not invent a new source table. Hours still live on timesheet activity, projects still live on Purchase Order → Project → Task → Task Activity, and attendance marks still live on the attendance matrix.

The Feature Flags panel shows each feature’s inherited value, optional project override, role gate, and whether a missing dependency is blocking it. Effective state is Enabled, Blocked (selected on but role or dependency failed), or Off.

How to configure

1. Open Feature Flags
Requires adminGovernanceEnabled and featureFlagsAdminEnabled. Scroll to the Work-Time Governance panel.
2. Enable a family, then dependents
Example: enable approval.chain before escalation or bulk actions. Enable planning.estimates before FTE or variance.
3. Save Application Config
Tenant choices persist on the HRMS module. Pilot on a child org unit before root lock.
4. Optional project override
Enter a project id on the panel to overlay on/off for features that allow project scope. Delete the override to inherit the team value again.
5. Confirm on Timesheet
When timesheet.reminders or timesheet.late-workflow is on, the page loads a server deadline preview for the selected week. Late weeks can show a late-reason field on Submit. Submit still uses the protected timesheet workflow — including Submit on behalf when enableTimeSheetSubmissionOnBehalfOf is on. Governance does not change who may approve.

Catalog families

Catalog keys are stable ids. Defaults in code are off; organisation seeds may turn selected features on for a tenant.

FamilyFeature idsWhat it does
Approval approval.chain, approval.escalation, approval.bulk-actions Versioned policy/steps, escalation, and role-gated bulk actions. Timesheet can keep legacy manager approval when approvalChainFallbackLegacy is true.
Timesheet timesheet.validation, approval-units, reminders, late-workflow, period-lock, variance, allocation WARN/BLOCK validation, weekly approval units, deadline preview and reminder offsets, late bands with required reason, period lock after lockAfterDays, and planning bridges. Does not replace the existing timesheet grid.
Planning planning.estimates, planning.fte, planning.variance Grade / skill / resource estimate dimensions and optional FTE gate. Variance is a report over Task Activity hours.
Attendance attendance.swipe-ingest, source-resolution, timesheet-wfh, cross-midnight, period-lock Connector-gated swipe rows and a composed read of leave → swipe → WFH hours → regularization. attendance.period-lock has no lock service yet — do not treat it as active.
Integration integration.project-import, integration.timesheet-export Vendor-neutral adapters with mapping, least-privilege scopes, and idempotency. A vendor-specific adapter is not bundled.
Admin admin.policy-management, admin.observability Role-gated policy editors and observability inventory for operators.

Deadline preview, late reason, reminders, and lock

  • Deadline preview — when timesheet.reminders or timesheet.late-workflow is on (and approval.chain is effective), the timesheet page calls GET …/timesheets/deadline-preview for the selected week. The UI follows that preview; it does not guess Friday 18:00 locally. If both features are off, preview is DISABLED and not late.
  • Late reason — when timesheet.late-workflow is on and the preview reports reasonRequired, Submit shows a late-reason field (Other needs detail). Exactly seven elapsed days follows the moderately late band (TIMESHEET-LATE-LTE7); later follows TIMESHEET-LATE-GT7. Changing week or team clears leftover submit governance so an on-time week does not keep a prior late reason.
  • Validation — timesheet.validation can WARN (submit allowed with hints) or BLOCK.
  • Reminders — catalog timesheet.reminders supplies cut-off day and offsets (default Friday 18:00 UTC, 3 / 1 / 0). Emails still need the master flag timesheetAdditional.timesheetSubmissionReminderEnabled and the reminder job. Master off blocks emails even if the catalog reminder is on.
  • Period lock — with timesheet.period-lock on, lockAfterDays greater than 0 (tenant seed often 7), and job TIMESHEET_PERIOD_LOCK, approved weeks lock. Reopen can require a reason. The older month lock disableLastMonthAfterXDays still applies separately.
  • Approval units — weekly units can feed the chain engine. If no TIMESHEET chain policy is published, approvalChainFallbackLegacy=true keeps the existing manager approval path.

Approval chain and inbox

When approval.chain is effective and a domain policy is published, instances appear with step metadata. My Approvals remains the action inbox; it does not store a second copy of the timesheet. Escalation and bulk actions require the chain feature plus their own flags (bulk is role-gated).

Delegation still uses the existing approval-authority and delegation services. Governance does not replace leave or attendance approval.

Project import and timesheet export

Enable integration.project-import and integration.timesheet-export separately. Both are role-gated. Import creates or updates projects from a mapped payload; export emits timesheet rows for a scoped period. Least-privilege scopes apply. There is no bundled vendor project-tracking adapter, delivery receipt, or dead-letter queue until those are configured as connectors.

Estimates and FTE

Grade, skill, and resource dimensions resolve from Application Config lists. Resource-level estimates stay optional unless planning.fte is effective. Variance reporting reads Task Activity hours — it is not a separate hours store.

Current limits

⚠️
Protected cores stay protected
Leave, attendance matrix writes, timesheet approval, and Application Config merge are unchanged. Governance only adds catalog switches and bridges.
📝
Not in this release
No Microsoft Teams or WhatsApp timesheet channels. Attendance resolve does not write the attendance matrix and does not fabricate in/out punches from hours-only timesheets. attendance.period-lock has no lock service. A complete ACS / device feed still needs the client vendor API. Overnight pairing is a limited look-ahead, not full shift windows. Observability is an inventory, not a replacement for application logs.

Permissions

RoleAccess
Platform adminFeature Flags panel; enable catalog features; optional project override; policy/observability when those features and role gates are on.
Integration adminProject import / timesheet export only when those features and workTimeIntegrationRoles allow it.
Manager / approverExisting timesheet and inbox actions. Chain steps apply only when a policy is published and the chain feature is effective.
Individual contributorTimesheet banner and validation hints when those features are effective. No catalog editor.