Create Staff and Provision Their Account

When a new colleague joins, you do not create a profile in one place and an account somewhere else. In Veona, adding the staff member is what provisions their account: the moment you save, Veona creates the underlying login (in an invited state, no password yet), attaches a facility membership (which facility they belong to), and assigns the role that decides what they can do. RBAC — role-based access control, the rule set that grants or denies every action — is driven straight off that role.

Who / when: the HR Admin (the HR Manager role in Veona Admin), the moment a new hire is confirmed and you have their name, work email and the role they will fill. Note that adding the person and granting them a role are deliberately two different permissions: an HR Manager can add staff; only an Administrator can assign or change a role.

1. HR Admin — open Admin → Add Staff. A short guided form opens for the new person.
2. HR Admin — fill in their details: full name, work email (this is where the invite is sent, so get it right), phone, department, and their job title. The email is the person’s unique identity in the system.
3. HR Admin — pick the role for this colleague (for example “Clinician”, “Lab Scientist”, “Cashier” or “Ward Nurse”). The role is what Veona uses to grant the right screens and actions; you are not ticking individual permissions, you are choosing the job they do.
4. HR Admin — press “Save”. In one transaction Veona does three things: it provisions the user in an invited state (active but with no password yet), creates the facility membership that ties them to this facility, and records the membership role you chose.

Note

Choosing a role is not the same as building one. The role you pick maps to Veona’s canonical role set, and the new colleague’s permissions are re-resolved from that assignment. If a role does not exist for the job you need, an Administrator manages roles first on Admin → Roles and grants access on Admin → Access.

Caution

Adding staff (Add Staff) and assigning a role (Access) are separated on purpose. As an HR Manager you can create the person, but the role you choose only takes full effect once an Administrator has confirmed the access assignment — role assignment is the single most privileged action in the product and is Administrator-only by design. If the person’s role looks “stuck” after you create them, an Administrator needs to finish it on Admin → Access.

What happens next: the new colleague now exists, but they cannot sign in yet — there is no password. Creating them immediately fires a content-free invite to the email you entered, carrying a single-use first-login link. From there the person sets their own password, enrols two-factor and creates their eSign PIN before any access is released. You will find the new starter listed on Admin → Staff, where you can review their membership and role at any time.

Follow the trail

• Next: Invite New Staff With a Notification
• Related: Complete First Login With Password, MFA and PIN