Recruitment
Part of Applicant tracking systems
Checking access controls for interview feedback
Map who can view, submit, edit and export interview feedback, then check those permissions with hiring roles and an internal applicant case.
Check interview feedback access with accounts for the hiring roles the organisation will use. Establish who can read another interviewer's scorecard, see private notes, edit submitted feedback and export it. A role name alone does not answer those questions.
Map the feedback and its audience
Separate the application, interview kit, each interviewer's feedback, private notes, hiring decision and candidate-facing correspondence. For each item, decide who needs to view, add, change or share it, and when. Include an interviewer who applies for another role and a manager who leaves the hiring team.
| Item | Access question |
|---|---|
| Interview kit | Does the interviewer see the material needed for the assigned interview? |
| Submitted scorecard | Can another interviewer read it before submitting their own? |
| Private note | Who can create, read and export it? |
| Edited feedback | Who may edit it after submission, and how can the change be explained? |
| Candidate message | Could internal feedback appear in a message or attachment? |
Check reports, downloads and integrations as well as the main profile. A restriction on one screen may not restrict every route to the information.
Key access control checks for interview feedback
- Confirm who can view the interview kit
- Verify access to submitted scorecards before submission
- Define who can create, read and export private notes
- Establish editing rights post-submission and audit trail requirements
- Check if internal feedback could appear in candidate-facing messages
- Validate restrictions across reports, downloads and integrations
Compare the documented controls
Workable describes Candidate Reviewers as users who review CVs, leave internal evaluations and comments, and make referrals. Admins have access across jobs and candidates. Workable documents one evaluation per hiring-team member per stage.
A user invited to an interview event cannot see colleagues' evaluations until submitting their own, with an exception for Super Admins and Recruiters. The evaluation guide also says users can edit or delete evaluations they submitted. Check the proposed reviewers' views and whether the edit and export behaviour meets the employer's rules.
Greenhouse Recruiting documents three settings for an interviewer seeing another interviewer's submitted scorecard: never, always or only after submitting their own. A scheduled Basic interviewer can access an assigned scorecard and specified candidate material, but not attachments marked Admin Only or Private.
Greenhouse restricts private scorecard notes to users with specified Job Admin or Site Admin permissions. Its current permission-policy page says Core does not include custom Job Admin levels. Confirm the subscription and the precise permission design before relying on a finer separation.
An ATS visibility setting cannot control copies already downloaded or feedback an authorised person shares outside the system.
Check changes in access
Use synthetic applications and feedback. Have each role inspect the same interview before and after scorecard submission. Check an interviewer assigned to one job but not another. Remove someone from a hiring team and inspect the profile, interview kit, reports and exports again.
Repeat the review for an internal applicant. Greenhouse warns that a Job Admin or Site Admin applying for another role could access their own scorecard unless the account and candidate permissions are handled appropriately. Ask each supplier to show how its proposed setup addresses that case.
Testing access changes in an ATS environment
- Use synthetic applications to simulate real hiring scenarios
- Have each role inspect the same interview before and after scorecard submission
- Test access for an interviewer assigned to one job but not another
- Remove someone from a hiring team and re-check profile, kit, reports and exports
- Repeat review for an internal applicant case with special permission handling
Further reading: Who can view the private notes option on candidate scorecards? (support.greenhouse.io).
