Use access by responsibility
Staff should only see the areas they need to do their work. Good permissions protect data, reduce confusion, and make daily navigation faster.
Suggested setup process
- Create role groups that match how your business operates, such as sales, support, operations, finance, or management.
- Assign permissions based on real tasks instead of giving broad access by default.
- Review who can create, edit, delete, export, approve, or manage setup items.
- Test the role with a non-admin account before releasing it to the whole team.
What to watch closely
- Lead and customer visibility rules.
- Billing and payment access.
- Setup and utilities permissions.
- Knowledge base, communication logs, and report access.
Best practice
Use the smallest permission set that still lets the user complete the job. When a team grows, update roles centrally instead of adjusting many staff records one by one.