Access and sharing

A person sees the records their role allows: every record, their teams', or their own. Four things widen or narrow that, all in Settings > Members & access, and field access decides, on top, which values of a record they may read or change.

Only holders of the Organization settings right, Owners and Admins by default, set access defaults, sharing and restriction rules, field access, and share a record by hand.

How a record's visibility is decided#

In this order:

1. The role must hold the verb, such as View or Edit, on the object at all.
2. View all or Modify all opens every record, and skips restriction rules. Owners and Admins hold both.
3. A Public access default, or a role scope of All, opens every record of the object.
4. Otherwise the person sees records they own, records owned by their team tree, tasks assigned to them, unassigned records if their role includes them, and records a sharing rule or a manual share gives them.
5. Finally, restriction rules take records away.

Employee records, employments and leave requests take a rule of their own in place of steps 3 and 4: a person sees their own, their direct reports' and, as HR of a legal entity, that entity's.

Field access then applies on top of any record the person can see.

Access defaults#

Access defaults set the floor for each object: Private (the owner, their team and admins), Public read (everyone can view, the owner's scope edits) or Public read/write (everyone can view and edit).

Contacts, companies and deals start Private. Purchase orders, goods receipts and stock adjustments start Public read/write. A default opens records, not verbs: a role that cannot edit still cannot edit a public record. No access default opens records to the External role: it sees what it owns and what is shared with it.

Teams#

Teams form a hierarchy, and a parent team sees every sub-team's records: the Team scope covers records owned by anyone in your teams and their sub-teams. A sub-team does not see its parent's records. Adding people to a team or moving a team changes who sees what, so it needs View all records as well as the teams right.

Sharing and restriction rules#

Sharing has two kinds of rule:

• Sharing rules only add access. Owner-based: records owned by chosen people, teams or roles. Criteria-based: records whose values match a filter. Each shares View or Edit with a role, a team or a person, and can be paused.
• Restriction rules only take access away: a role, team or person may see only the records the rule names, even where ownership or a sharing rule would open more. Owners and Admins are never restricted; Viewers are.

Sharing a record by hand#

On a record, More actions > Manage access grants View or View & edit to a person, a team or a role. It is open to holders of Organization settings, and only for a record they can see.

Field access#

For each property, Settings > Data > Properties, the property's Permissions tab, Field access sets who may see and change its value:

A masked email reads like a•••@e•••.com, a phone keeps its last two digits.

• The rules name Everyone else and each role level: OWNER, ADMIN, MEMBER and VIEWER. Manager, Billing Admin and every custom role follow the MEMBER row; External follows the VIEWER row.
• A property with no rule is editable by everyone, so field access only narrows. Owners and Admins are held by it too.
• Identity and pipeline properties, such as a contact's first name and email, cannot be restricted, so records never become anonymous.

Personal data starts masked#

A property's Sensitivity is None, PII, Sensitive or Highly sensitive, and can only be raised. PII and above start masked for the VIEWER level. A new organization masks the built-in personal properties this way, such as a contact's last name, phones and birthday, and a company's tax ID.

Where field access applies#

Changes to field access, sharing and roles are recorded in the audit log's Security group.