Run HR files in Nucleus One
Employee files with access control that actually holds: per-folder sharing on top of Direct assignments, the fields and tags that make records findable, and onboarding as a repeatable workflow process.
Before you begin
- A project you administer (Project Manager)
At the end of this recipe, each employee's file lives in a folder only the right people can open, every document in it is findable by field and tag, and onboarding runs as a process that assigns its own tasks — the HR wall built from standard parts.
HR's defining requirement is the opposite of AP's: not routing speed, but containment. Build the access model first and everything else sits safely inside it.
Part 1 — The access model (the part to get right)
Two layers combine into "only the right people":
Project-wide default: Direct assignments. In Settings > Project Profile, under Member access, set Folders & documents to Direct assignments. Non-admin members now see nothing in the documents area except what's explicitly shared with them. Confirming the change warns it takes time to propagate to all items — that's normal.
Per-folder shares open the doors. Each folder's Properties & sharing has a Share with people (optional) list — the people who can reach that folder. Subfolders inherit (the dialog shows Shared by inheritance), so share at the level that matches the secret: the whole
HR teamat the root of routine records; a specific manager on their own team's folders only.
Finish the wall with two more Project Profile settings: Disallow content removal by project members (on), and remember Project Manager is the role that sees everything — grant it accordingly, and use Groups (Settings > Groups, e.g. HR team) so shares name a group's worth of people in one line.
What restricted members experience is silence, not a locked door — folders they lack simply don't appear. When someone says "the folder is missing," that's the access model working; check the folder's share list, not for a bug.
Part 2 — Structure and findability
- Folders: one per employee (
Last, First), with standard subfolders if you like —Onboarding,Reviews,Benefits. Create them as you hire; a New folder right-click is the whole ceremony. - Fields (Settings > Fields — create by name, then set Data type in properties):
Employee Name(Text),Hire Date(Date),Document Category(Text with List items: Offer, I-9, W-4, Review, Certification…),Expiration Date(Date) for the certifications and work authorizations that age out. - Tags mark cross-cutting states a field shouldn't own —
needs-signature,confidential,2026-review-cycle. Type them on any document's tag control; they're created on first use.
The payoff is advanced search: Document Category word starts with Certification, Expiration Date is between and including today and 90 days out — the expiring-credentials report, from criteria, in seconds. Save it as a template.
Part 3 — Onboarding as a process
Settings > Workflow Processes > + Onboarding. The HR flavor of workflow is task-shaped:
- Trigger: Document upload scoped to intake (a signed offer arriving), or Form submit if you front onboarding with a form — a new-hire form with Project Field inputs feeds clean data straight in (Build and submit forms).
- Task actions assign the checklist — collect the I-9, order equipment, schedule orientation — each Assigned to the right person. Give tasks Task Milestones and Task States (both under Settings; each is just a name and an order) that mirror your real stages:
Offer accepted,First day,30-day check-in. - Approval where sign-off matters (manager confirms the file is complete), E-mail where people just need to know.
Assignees see their work in My Work — the checklist runs itself instead of living in someone's memory.
Part 4 — Intake for the paper
Signed documents arrive by Document upload (drag and drop), Document scan from a Windows desktop with the Capture Agent, or form submissions. With required fields set, intake pauses at Tags & Field Values — an employee file where every document carries its name, category, and dates is the file you'll actually be able to audit.
Success check: sign in as a test member who's shared into exactly one employee folder. They should see that folder, that folder only, and find its documents by field search — while a colleague with no shares sees an empty documents area. Then run one onboarding through the process and watch the tasks land in My Work.
