Leave Governance

Beyond the basic time-off request flow (see Availability, Time Off & Swaps), ShiftPilot has a full leave-governance layer: configurable leave types and accrual, staff-visible balances, FMLA/ADA protected designations, a supervisor of record who approves leave, per-role leave limits, and seasonal blackouts. This page covers all of it. Like compensation, the sensitive pieces are gated by capabilities, not role alone.

Leave types, accrual & balances (/leave)

The Leave Admin console (gated by MANAGE_ACCRUAL_POLICIES) defines the leave your organization offers:

• Leave types — PTO, Sick, CME, Jury Duty, etc. Each is paid/unpaid and either accrues or is simply tracked.
• Accrual policies — how a type accrues: PER_PAY_PERIOD (a fixed amount each period), ANNUAL_GRANT (once a year), or PER_HOURS_WORKED (a rate × hours worked — using actual timecard hours where a punch exists, else scheduled). Policies carry a max balance cap and a carryover cap, and are assigned to staff.
• Balances are never a mutable counter — they're a sum over an append-only ledger, so every accrual, usage, adjustment, and forfeiture is individually auditable and reversible. Staff see their balances on the Time Off page.

Accruals run idempotently (the monthly cron, or the Run accruals now button) — re-running a period is a no-op. At year-end, Apply year-end carryover forfeits any balance above each policy's carryover cap (a carryoverCap of 0 means use-it-or-lose-it; blank means unlimited carryover), writing a CARRYOVER_FORFEIT ledger entry.

Protected leave (FMLA / ADA)

A time-off request can be designated FMLA or ADA by a holder of MANAGE_PROTECTED_LEAVE. This is treated as sensitive, medical-adjacent data: the protected designation and note are stripped from the API response for anyone who isn't the staff member themselves or a holder of VIEW_PROTECTED_LEAVE at that facility — the client is never trusted to hide them. ShiftPilot tracks designations; it does not determine FMLA/ADA eligibility, which is an HR/legal call.

Supervisor of record

Every staff member can have a supervisor (set on their profile, /staff/[id]). The supervisor is the person who approves their leave and the one notified about their leave, swaps, and schedule changes. A profile shows "Reports to …", and the seed builds a manager → charge → clinical chain to demonstrate it.

Approval authority is deliberately "sole-approver, safely" — leave is never stranded:

1. The supervisor chain approves (the direct supervisor, or anyone above them).
2. Admin break-glass — an administrator with access to the facility can always approve, covering an absent, inactive, or unset supervisor.
3. No supervisor set falls back to the previous rule: any scheduler at that facility.

A person can never approve their own leave, regardless of role. An unrelated scheduler can no longer approve leave for someone who does have a supervisor — that was the point of the feature.

Per-role leave limits

Under Leave Rules (/org/leave-rules, gated by MANAGE_LEAVE_RULES) you can cap how many people of a role can be off at once. A leave limit applies to a role at a facility (optionally one department) and sets an absolute cap (max concurrently off) and/or a percentage of headcount, optionally counting only certain leave types.

When someone submits time off, ShiftPilot checks two triggers on every requested day:

• the per-role cap — would this push the role over its limit?
• coverage impact — would it drop a covered station below the minimumCount in its staffing model?

If either fires, the request is not denied — it's created but held PENDING and flagged "Over capacity." It can then only be approved by someone who both has approval authority and holds the OVERRIDE_LEAVE_LIMITS capability; the approver's list shows a red badge and the reason, and approving prompts for an override reason that is audited (TIME_OFF_LIMIT_OVERRIDDEN). A supervisor is typically granted OVERRIDE_LEAVE_LIMITS per-facility from Access & Scopes; admins hold it by default.

Approvers can also edit the requested hours on a pending request (the auto-computed hours are an estimate from shift lengths) before approving.

Seasonal blackouts

Also under Leave Rules, a blackout blocks discretionary leave for covered roles during a window ("Summer census surge", "Year-end close") — facility-wide or per-department, for specific roles or all.

• Submitting normal leave inside a blackout is rejected with the blackout's reason.
• The staff member can still submit if they flag it FMLA, ADA, or an emergency — this creates a PENDING request held against the blackout for a supervisor override (the same OVERRIDE_LEAVE_LIMITS gate as a limit breach), audited as TIME_OFF_BLACKOUT_EXCEPTION_APPROVED. A blackout can also disallow exceptions entirely.

The self-declared exception reason is kept separate from the formal FMLA/ADA protected designation above: the exception is a request reason the approver sees; the protected designation remains a privileged HR action.