Access and Permissions

You decide exactly what each person on your team can open, see, and change: which apps they use, what their role lets them do in each app, which single fields they see or change, and whether they take calls. It works the same way for every company.

Where to Find It

Everything about access is in one place: Settings, Permissions, for owners and admins. The gear at the bottom of the menu has Permissions, which opens Settings at the Permissions card. It has six tabs:

• People: everyone in your workspace, with their access in every app and their Phone, and Access to change one person's (below).
• Permission Groups: a job's access, such as Account Manager or Project Manager, that everyone in the group follows.
• Roles: each app's roles, with their levels and their field rules.
• Client Protection: lists, exports, unusual activity, conflict checks, and Do Not Contact (Client Protection).
• Team Agreement: the agreement your team accepts (Team Agreement).
• What Admins See: what admins see of prices and amounts.

No app has a permissions page of its own: each app's Settings page links to Permissions. Access beside a person on the Staff page opens their access here too. The old addresses of the Staff page's Roles and Templates tabs open these tabs.

Who Sees What, in Short

• Owners see and change everything, always.
• Admins see and change everything, except prices and amounts when an owner hides them from admins (What Admins See, below).
• Members have, in each app, a role (Manager, Team member, Viewer, or one your company makes) or No access. Their role says what they may do with each module's records, and with each field.

No Access to an App

A member with No access in an app does not see it at all:

• the app is not in their app switcher or menu, its records are not in search, and its widgets are not on their Home;
• a notice an automation sends them about a record in that app has no link to it and none of its values;
• every action of that app answers "You have no access" and every record in it answers as one that does not exist, from the screens, an AI agent they connected, or anywhere else.

People you add from now on start with No access in every app until you give them access, one app at a time or with a template. Everyone who was on your team before this kept exactly the access they had: where a member had no role in an app (which used to mean everything there), they were given a role with everything there, written in your Activity Log as "Access is now set app by app".

When an owner or admin becomes a member, they start with No access too, until you give them access.

One Person's Access

On the People tab of Permissions, Access beside a person opens their access in the same card (owners and admins, action core.access.get), and All People goes back to the list:

• Apps: each app your company has, with a choice of No access or one of the app's roles, including your own roles.
• Staff Tools: Phone, whether they take and place calls in the staff tools. Chat and Notifications are for all staff. Owners and admins have Phone until it is turned off; members once it is turned on.
• Permission Group: put them in a group, which gives them its access in one step and keeps them in step with it (below), with their client protection shown.
• Remove Access: for someone leaving, ends their sign-in, AI agents, and API keys at once (Client Protection).

Save Access saves every change at once (action core.access.set). Nobody changes their own access, and only an owner changes an owner's. Owners and admins see everything in every app, so for them only their staff tools are set here.

Roles and Their Fields

On the Roles tab of Permissions, each app's roles, and Change on a role, show what it allows (see Roles): per module, what records it sees, changes, and deletes, and whether it imports and exports.

Under the levels, Fields lists each module's fields. Open a module to choose, for each field:

• Editable: shown and changeable wherever the role can change the record (what every field is until you choose).
• Read only: shown, but never changed: the record page shows it without a way to change it, and any change to it is refused with a plain message.
• Hidden: never shown. It is left out of record pages and lists, search and its snippets, reports and boards, record history, exports, notices, the API, and AI agents. Filtering, sorting, or grouping by it is refused, and a change to it is refused.

The choices are saved with the role (action core.roles.save, with fields), and every person with the role gets them at once. The Activity Log names the role and each field that changed, from what to what.

Prices and Amounts

Prices and amounts are field permissions like any other field. The fields that hold prices (a project's budget and hourly rate, and a CRM deal's amount) are grouped under Prices and Amounts in each role's Fields. They are sensitive:

• Members never see them unless their role (or their permission group) shows them. Each role has its own choice for prices and amounts not named one by one, Hidden until an owner chooses otherwise.
• Only an owner changes what a role or template says about prices and amounts. An admin can change everything else about a role, but never who sees prices.
• What app screens work out from prices (a project's billable amount, a deal pipeline's totals, proposal prices) follows the same answer.
• Your client always sees the prices on their own proposal.

What Admins See

The What Admins See tab of Permissions says whether admins see prices and amounts (Editable), see them without changing them (Read only), or do not see them (Hidden), with a choice per field if you like. Only an owner changes it (actions core.access.admins.get and core.access.admins.save). This is what Who Sees Prices used to be: Owners and Admins is Editable, and Owners Only is Hidden. Each workspace kept exactly the choice it had made. See Who Sees Prices.

Permission Groups

A permission group is a job's access in one place, such as Account Manager or Project Manager: a role or No access in each app (and a choice for every other app, including apps added later), field choices, staff tools, and client protection. Each person is in a group, so you set up a job once and add more people to it. The Permission Groups tab of Permissions lists them (action core.access.templates.list), with Add a Group, Change, Apply Again, and Delete.

• Every workspace starts with four: Full Access (Manager in every app, and the phone), Custom (No access everywhere, to change to fit a job), Account Manager, and Project Manager (below). Add Starter Groups brings back a starter group you deleted (action core.access.groups.starters).
• Add a Group and Change (action core.access.templates.save): changing a group changes everyone in it at once, in every app, field, staff tool, and client protection, written in the Activity Log.
• Put in Group, in a person's access (action core.access.templates.apply), gives them exactly what the group says, and they follow it from then on.
• Apply Again (action core.access.templates.reapply) puts back exactly what the group says for everyone in it, replacing changes made to them by hand since.
• Delete (action core.access.templates.delete) removes the group; the people in it keep their access.
• Inviting someone means choosing their group: Invite a Person on the Staff page asks for the group (action core.access.invite), and they are in it from their first sign-in. Only an owner invites someone into a group that shows prices.

Account Manager

For someone who brings in clients, agencies, and partners:

• CRM: sees the accounts, contacts, and websites they find and open; adds and changes their own companies, contacts, leads, deals, tasks, and activities.
• Proposals: writes and changes their own proposals with prices; sees the price lines and sections.
• Subscriptions: sees the product catalog, and each of their accounts' services and status on the account's page (not the billing ledger, payment methods, or other accounts' invoices; no Invoices).
• Helpdesk and Chat: answers client tickets and website chats.
• Partners: sees the partners and affiliates they brought in. Approving stays with whoever reviews partner applications.
• Projects and Files: their own.
• Phone: takes and places calls in the staff tools.
• Prices and amounts: shown and editable (only an owner puts someone in this group).
• Client protection: type to find, no exports, watched for unusual activity.
• No settings, no permissions, no API keys, and no exports.

Project Manager

For someone who runs the work for every client:

• Projects: every project and task, assignments, and time.
• Helpdesk: every ticket in the queue, and answering them.
• CRM: finds accounts, contacts, and websites by typing; sees the people a ticket, project, or task needs, with their email and phone; adds contacts to clients they work on. New clients (companies, leads, and deals) are the Account Manager's.
• Files: their own, and the files of the records their work opens.
• Phone: takes and places calls in the staff tools; the call card shows no prices.
• Prices and amounts: hidden everywhere, with No access to Proposals, Invoices, Subscriptions, Contracts, and Partners.
• Client protection: type to find, no exports, watched for unusual activity, and accounts only through their work.
• No settings, no permissions, no API keys, and no exports.

Change either group to fit your company, like any group, including whether its people take calls.

The Activity Log

Every access change is in the Activity Log, with who made it, whose access changed, and from what to what, for example "changed Ana Ruiz's access: CRM from Viewer to No access; Phone from Off to On".

Client Protection and the Team Agreement

Client protection (lists, exports, unusual activity, conflict checks, Do Not Contact, and Remove Access) is set per permission group and explained in Client Protection. Your team agreement is in Team Agreement.

API Keys and AI Agents

• A member-level API key has a role (or No access) in each app, like a member, and gets its role's field choices too.
• An AI agent acts as the person who connected it, with exactly that person's access and fields. It never changes anyone's access.

Given One by One

Some permissions are not part of any role: each is a switch for one person, on their Access page under Given One by One (and in a template). Each says who has it from the start, usually the owner, and the owner can give it to anyone else. For example, Review partner applications (Partners) lets a person approve or turn down partner and affiliate applications; the owner has it from the start.

For the Phone

Your phone service asks your workspace who may take calls: each person with access, and whether their Phone switch is on. Nobody whose Phone is off is rung. It also says whether each person may see prices and amounts, so a call card never shows prices to someone who may not see them.