Employee and manager self-service for a deskless public workforce

Reference article · 7 min read

Most self-service rollouts begin with the population that is easiest to reach: staff with an assigned desk, an agency laptop, a work email address, and a network account they sign into every morning. That group adopts a portal quickly. The second population is often larger and much harder to serve: road crews, transit operators, corrections and dispatch staff, utility field technicians, custodians, bus drivers, seasonal parks workers, and anyone on a rotating shift. Many never touch a workstation in a normal week, and some have no agency mailbox at all.

When adoption stalls after the office go-live, the cause is usually not the software. It is that the access path, the identity model, and the approval rules were designed around desk workers and then handed to people whose working day looks nothing like that. Most of the fixes are policy and design decisions the agency controls, and nearly all of them are cheaper to make before go-live than after.

Inventory how people actually work before choosing an access path

Walk the yards, garages, stations, and school sites before you write requirements. The details that break a rollout are mundane and specific to each unit.

• Mailbox coverage. Confirm which classifications have agency email. If password resets, enrollment invitations, and notifications all route to an inbox a third of the workforce does not have, the help desk absorbs the difference.
• Device reality. Note who has an agency phone or tablet, who shares a vehicle-mounted device, and who has only a personal phone. Do not assume smartphone ownership is universal.
• Connectivity. Some crews work in basements, tunnels, remote right-of-way, or facilities where personal devices are restricted or prohibited outright, which is common in correctional and secure settings.
• Language and reading needs. Confirm the languages your workforce uses and whether the vendor supports them in the employee-facing screens, not just in marketing material.
• Bargaining agreements. Leave rules, overtime approval, seniority-based scheduling, and notice requirements are often contractual. Involve labor relations early rather than discovering a conflict during user acceptance testing.

Kiosks, shared devices, and personal phones

Plan for all three rather than betting on one. Kiosks belong where people already stop: break rooms, muster areas, time clock locations, and shop entrances. Give each one a privacy screen, a short inactivity timeout, a clear sign-out, and a session model that does not leave the previous user's data recoverable through the browser history or back button. Verify that an employee can complete the whole task standing up, in a few minutes, without a printer or a mouse.

Personal-device access needs a written policy that says what the agency does and does not do to the phone. Requiring full mobile device management enrollment before an employee can view a pay statement is a predictable adoption killer and raises fair questions about agency reach into personal property. A responsive browser experience, or an app that stores nothing sensitive at rest, usually serves the need. If your agency requires employees to use personal devices for work, check whether your state imposes expense reimbursement obligations, and confirm the answer with counsel.

Authentication that survives a phishing test

The self-service portal holds direct deposit details, tax withholding, and home addresses, which makes it a payroll diversion target. Treat it accordingly.

• Prefer phishing-resistant factors. Federal digital identity guidance describes authenticator types and their relative resistance to phishing, and generally favors public key methods such as FIDO2 and passkeys, or agency smart cards, over one-time codes delivered by text message. The guidance is revised periodically, so confirm the current version.
• Design the recovery path first. Account recovery is where attacks land. A worker who has lost a phone, changed a number, and has no agency email still needs a route back in, and that route cannot be a phone call that anyone can place.
• Protect banking changes separately. Require step-up verification for direct deposit and tax changes, send an out-of-band notification whenever they occur, and consider a short holding period before the first payment routes to a new account.
• Test enrollment at scale. Enrolling thousands of people who lack agency email, on a deadline, is its own project. Supervisors validating identity in person during a shift briefing is often more practical than mailed codes.

Paperless pay statements and W-2 consent

Electronic delivery of wage statements and tax forms is a compliance exercise, not just a print savings measure. Federal rules on furnishing Forms W-2 electronically generally require affirmative employee consent given in a manner that demonstrates the employee can actually access the electronic form, along with specific disclosures covering scope, how to withdraw consent, how to request a paper copy, hardware and software requirements, and what happens on separation. State wage statement laws add their own requirements and vary considerably, including whether an employee may be required to go paperless at all. Confirm both with your counsel and payroll leadership before you disable printing.

Two operational points get missed. First, keep a working paper path: printing at a kiosk, a mailed copy on request, and a documented way to withdraw consent. Second, plan post-separation access. Former employees still need prior year forms after their accounts are disabled, and a process that depends on an active login will generate calls every January.

Approvals, delegation, and acting assignments

Approval routing is where agency rules diverge most from commercial products. Work through your actual cases and require the system to handle them.

• Delegation with limits. Delegations should carry start and end dates, a defined scope, and an audit record showing who acted on whose behalf. A permanent, unbounded delegation is an audit finding waiting to happen.
• Acting assignments. Authority usually attaches to a position, not a person. When someone is acting in a vacant supervisor role, the approval queue should follow the assignment rather than requiring a security ticket.
• Coverage and escalation. Shift supervisors rotate and crews report to whoever is on duty. Support multiple eligible approvers and automatic escalation when a request ages past a deadline.
• Separation of duties. No one approves their own leave or timesheet, and the system should enforce that rather than relying on convention.

What to ask vendors and how to start

1. Demonstrate the full employee experience on a phone browser and on a shared kiosk, using a test account with no email address on file, including password reset and multifactor enrollment.
2. Show which phishing-resistant authenticators are supported natively and which require an added license tier.
3. Walk through delegation, acting assignment, and escalation configuration in the administrative interface, not in slides.
4. Provide an accessibility conformance report for the employee-facing screens and describe remediation timelines for defects. A Department of Justice rule establishes technical accessibility standards for state and local government web content and mobile applications, with compliance timing that varies by entity, so confirm how it applies to you.
5. Describe audit logging for direct deposit and tax changes, including retention and export.

In contract terms, ask for standards-based single sign-on at no premium tier, named performance expectations for the mobile and kiosk paths, test environments available before each release, and data export in a documented format. Then pilot with one field unit that has the hardest conditions you can find, rather than with headquarters. The issues that surface in a garage at shift change are the ones that determine whether the rollout succeeds.

HQT works with state and local agencies on enterprise systems integration, identity and access design, and application delivery for workforce-facing services.

Frequently asked questions