Control Access To Payroll Flow Corrective Actions Using Security

Administrators can now grant an aggregate privilege to designated users to perform corrective actions across payroll flow tasks they did not initiate, reducing the need to configure group ownership on each individual task and enabling faster corrective operations across payroll processes. This gives administrators a simpler alternative to configuring group ownership on each task when they need groups of users to manage flows, they didn't start.

To give user the ability to take actions on payroll flows they didn't initiate, perform the following tasks:

Create a job role that includes the new aggregate privilege: Allow Corrective Actions on All Tasks Within Payroll Flows.
Create a payroll flow security profile that includes all the flows the user can perform actions on.
Create a data role and select the payroll flow security profile.
Grant this data role to the user.

Note: The new aggregate privilege is not granted to any predefined job role. Make a copy of the predefined job role and add the new aggregate privilege to the copied job role as required.

This feature reduces administrative overhead by avoiding per-task group ownership configuration and enables faster resolution of payroll flow errors.

Steps to enable and configure

For more details on how you can add an aggregate privilege to a predefined or delivered role, please refer 'Copy and Edit Duty Roles' topic in the Securing HCM guide on the Oracle Help Center.

Tips and considerations

If both group ownership and security are defined for the same flow, both will apply.
Group ownership already defined on flow tasks will not be impacted and will work as before.
When granting access for corrective actions, restrict payroll flow security profiles to only the flows the users should manage, for example, separate calculation and payment flows, to limit scope.

Key resources

For more information on aggregate privileges and data roles, refer to the following on the Oracle Help Center: