Issue Details: Testing with the roles ZZ SS Payroll and ZZ HR PII Data assigned.

Main Menu>Payroll for North America>Employee Pay Data USA>Request Direct Deposit

Not seeing the full bank account number with ZZ HR PII Data assigned.

Research: Request Direct Deposit page is already masked in Production through the Payroll for North America installation settings. This masking is independent of the delivered masking functionality being implemented by the HCM Masking Project. Because of this, the unmask roles being created for the delivered HCM masking solution will not provide visibility to direct deposit data.

Resolution: The QRG Viewing or Updating Direct Deposit Information in ESS shows that the direct deposit account number is masked when viewing the page The unmasked account number would be viewable in Add or Edit mode.

Issue Details: The tester has the role ZZ Payroll Data Maintenance. When we added the role ZD Garnishment Inquiry, they were able to add/delete/edit/save in the garnishment table. According to testing documentation, even with the ZZ Payroll Data Maintenance role, the data should be read only with the ZD Garnishment Inquiry role.

Research: The ZD Garnishment Inquiry role is intended to provide inquiry access for users whose payroll security is also aligned to the ZD role set. When a user has a higher-level payroll maintenance role, such as ZZ Payroll Data Maintenance, pairing it with a ZD garnishment role does not result in read-only access because the payroll role's update access remains in effect.

Resolution: As a general rule, the garnishment role version (ZD, ZZ, or ZC) should match the payroll-related role version (ZD, ZZ, or ZC) assigned to the user. This ensures the intended level of access is applied consistently across payroll and garnishment pages.

• ZZ Payroll Data Maintenance - ZZ Garnishment Data
• ZC Payroll Data Maintenance - ZC Garnishment Data - Correct History Access
• ZD Payroll Data Maintenance - ZD Garnishment Inquiry - View Only Access
• ZD Payroll Inquiry - ZD Garnishment Inquiry - View Only Access

The ZC, ZZ, and ZD garnishment roles actually serve two purposes:

1. They control whether garnishment-related tabs and sections are displayed within payroll pages that already require the appropriate payroll-role access. This is where the ZC/ZZ/ZD role matching is important.
2. They provide menu-path navigation and access to garnishment-specific pages where users create, review, update, and otherwise manage garnishments. This is where the three different page access levels are required.

• Issue Details: Only the first 10 characters of the Visa appear to be masked. The visa number, which is something like "TEST123456789" has the last 3 characters (789) visible. If the visa is meant to be masked entirely, then the field should be masked for an arbitrary number of characters (up to the character limit).
• Research: While employees may have multiple passport numbers over time due to renewals or replacements, there is generally less need to distinguish between passport records during day-to-day HR processing so you may notice that the passport number is fully masked. However, the Visa/Work permit records are more commonly updated, renewed, or replaced throughout an employee's work authorization history, so displaying the last three characters of the permit number provides a helpful visual identifier.
• Resolution: The Visa/Work Permit Number field was configured differently from the delivered Passport Number masking, which masks the entire value. The Visa/Work permit number displays the last three characters of the permit number.