Roles

Owners and admins of a workspace see and change everything. Everyone else, a member, also has a role in each app, which says what they may see and change there.

The Roles Each App Starts With

• Manager sees and changes everything.
• Team member works on their own customers and deals: sees and changes only the records they own, and deletes none.
• Viewer can look, but can't change anything.

A member with no role in an app has the Manager's access there, so roles change nothing until someone is given one. These roles can be changed, and a company can add its own.

What a Role Says

For each module of the app (or for every module at once):

• View: own records, or all records.
• Edit: none, own, or all. Adding records needs anything but none.
• Delete: none, own, or all.
• Import and export: yes or no.

Record Owners

Each record has an owner: whoever added it, until someone gives it to another person. "Own" means the records a person owns. Giving a record to someone else (action core.records.set_owner) needs edit-all on that module.

A record someone may not see answers exactly as one that does not exist: it is not in lists or search, and opening, changing, or deleting it says it does not exist.

Apps' Own Rules

An app may hide some of its records from some people on top of roles, for example Helpdesk's admin-only inboxes. The rule is part of the app and applies the same way everywhere its records are shown.

Managing Roles

In Setup, Roles, owners and admins:

• see each app's roles and who has them (action core.roles.list);
• add or change a role and its levels (action core.roles.save);
• delete a role (action core.roles.delete): people who had it go back to having no role in that app;
• give a person a role in an app, or no role (action core.roles.assign).

For AI Agents

AI agents never change roles. An agent acts as the person who connected it, with that person's role.