Permissions

Two tabs: who gets the financial-admin role, and how staff are grouped into teams. Both take effect on the affected user’s next sign-in / data load — there’s no live push to an open session.

Admin-only. Visible to WFM Administrator accounts and bootstrap admins — see Roles & access for how that’s derived.

Tab 1 — Financial admins

A multi-select of every known staff email (plus any currently-granted email that has since left the staff list). Save replaces the whole set: any email removed from the selection loses the role, any email added gains it.

Granting financial-admin does not make someone a WFM manager. It only adds:

Read-only access to Team Metrics and Team Overtime — the same team data a manager sees.
No config or admin tools, no write access anywhere, and no change to their WFM role or is_manager status.

Use it for people (e.g. finance/ops) who need visibility into team billability and overtime without being a project manager in WorkflowMax.

Tab 2 — Teams

A per-team multi-select assigning staff members to a team (default teams are A and B the first time the page loads with no configuration). Team grouping drives the team breakdowns on Team Metrics and Team Overtime. Anyone not placed in a team is tallied under an Unassigned bucket.

Saving rejects a staff member listed in more than one team — fix the overlap in the UI before it will submit.

Team membership only affects how Team Metrics and Team Overtime roll up staff into teams. It does not gate access — that’s controlled by is_manager / is_financial_admin (see Roles & access).

Where it’s stored

Financial admins — a DynamoDB table, keyed by email. Fully managed from this page.
Teams — the team → staff-member mapping in the teams SSM parameter. The parameter is Terraform-managed with ignore_changes on its value, so saves here persist across tofu apply without being reverted.