Who Can See What, Without a Spreadsheet of Passwords

As a team grows, "everyone is an admin" stops being generous and starts being risky. Groups and per-section access let you give each person exactly what their job needs — and change it in one place.

The first three people on a CRM are all admins, because it is easier. The fifth person is an intern who only needs the calendar. The eighth is a bookkeeper who needs reports but should never change a deal. By then "everyone is an admin" has turned into a question nobody wants to answer: who can delete what?

Access control is not about trust. It is about making mistakes small.

Three levels per section

Settings → Team gives every member an Access tab with a level per section — Dashboard, Inbox, Pipeline, Contacts, Leads, Companies, Tasks, Calendar, Messages, Reports, Site traffic, Automations, Notes and Settings. No access hides the section. View lets someone read without changing anything. Edit is the full experience.

View-only people see a clear "View only" badge and simply do not get edit or delete buttons, instead of clicking into error messages. The server enforces the same rules on every request, so a permission is a real boundary, not a hidden button.

Settings deserve their own levels

Settings is not one thing. Someone who manages web forms does not need to touch billing or the domain. Each area — Client accounts, Integrations, Plugins, Web forms, Site tracking, Domain, Activity log, Data retention — gets its own None, View or Edit, for a group or a person. White-label is owners only, and billing is strictly the workspace owner's.

Give people the access their job needs on its busiest day — not the access it needs on its strangest one.

A setup that holds up

  1. Start from three groups: the people who sell, the people who deliver, and the people who only need to look.
  2. Invite with a preset. The invite dialog offers Full access, Standard, Read only or Custom.
  3. Use overrides sparingly. If three people need the same exception, it is a group.
  4. Turn on two-factor authentication for everyone with access to client data — it matters as much as permissions when a data request arrives.

Each member's profile also shows their own statistics — deals won, open pipeline, tasks done versus overdue — so the Team page doubles as a quiet weekly check-in. Combined with live presence, you know who is working on what without asking.

When a group needs its own space, an admin can give it a team calendar that only that team and admins see — useful for a delivery team that should not crowd the workspace calendar.

Curious what else is in the workspace? Our features page starts from the problem that eats your week.