Everyone sees what their role allows, and every act leaves a line in the log.
Roles, teams, sharing and field access decide who sees what, and the product can tell you why. Approval rules hold the acts that matter until the right person says yes, and the audit log says who did what, when and from where, including what was refused.
Access you cannot explain is access you cannot trust. Ask about one deal and one person, share it, and ask again: each answer comes with its reasons, and each step lands in the log.
Before · View as user
The answer comes with its reasons: no role, team, rule or share reaches this colleague for this record.
Waiting for you. Share the deal with them, read only.
After the share · Read access
Asked again, the answer says a manual share grants them read access. The margin stays hidden, because their role does not see costs and margins.
Waiting for you. Give them edit access, or keep it read only.
Afterwards · The log
Who shared the deal with whom, and what was done with it or refused, each a plain sentence with when and from where.
Waiting for you. Export it for whoever asks.
Control is not only for the IT department. Here is what it means for four people.
Owner
The Owner holds every right, is the only one who can let the Agent act on its own, and cannot be changed by anyone else.
The Owner's row in a table of who sees what: all deals and all invoices, costs and margins seen, a contact's phone to edit, and the one Yes under letting the Agent act on its own.
Office manager
Invite people with the role they need. When someone leaves, deactivate them: sign-in stops at once, and their records and history stay, ready for someone else.
The Admin's row: the same reach over records and properties as the Owner, and No under letting the Agent act on its own.
Accounts
A role reaches each kind of record its own way: every invoice and payment, only the deals someone shares, and costs and margins where the role holds that right.
The row of a role the organization built for accounts: every invoice, no deal unless one is shared, costs and margins not seen, a contact's phone to view.
Sales manager
A manager sees the records of their team and its sub-teams. Team performance and the Agent count only what that role can already see.
The Manager's row: the team's deals and invoices, costs and margins seen, a contact's phone masked.
As a team grows, so does what each person should not see. Roles, teams and sharing set who reaches which records; field access sets what they read of each one; and sign-in makes sure the person is who they say.
Owner, Admin, Billing Admin, Manager, Member, Viewer and External, and roles you build from them: for each kind of record, who may view, edit, delete and communicate, over all records, their team's or their own. Teams nest, sharing rules give access, restriction rules take it away, and a record can be shared by hand with a person, a team or a role.
For each property, choose Edit, View, Masked or Hidden, for everyone and for each role. Masked shows a redacted hint, never the value; Hidden means the property does not exist for that person. It holds in lists, search, exports and for the Agent, and personal data starts masked for viewers.
Passkeys or a second step from an authenticator app. Ask a second factor of nobody, of admins or of everyone, and those it newly covers get 14 days and an email. Choose how long people stay signed in and after how much inactivity they confirm it is them. On Business and Enterprise, people sign in with SSO; Enterprise adds SCIM.
Export everything the organization holds about a person as one file, or erase them across records, emails, files and history. An erased address cannot come back through an import, a form or the Agent, and a record under legal hold keeps what the law needs.
The rules are kept by the product on every request, not by hoping people remember them.
Who decides an approvalEvery read and write is limited to your organization, which the product takes from the signed-in membership, never from anything a request says. Membership is checked again on every request, so a freeze or a deactivation counts at once.
An approval rule holds the act until the people it names decide, in order. Nobody decides their own request, the record stays locked while it waits, and an approval that nobody decides expires after 30 days.
It works with the rights of the person it works for. Sharing, field access and roles always wait for a person's yes, approvals are decided by people only, and nobody can grant a right they do not hold.
Roles, teams, sharing, field access and approval rules come with every plan. The audit log, single sign-on and the rest grow with the plan.
No audit log
The audit log of sign-ins and security
The audit log of sign-ins and security, SSO
The full audit log, records and settings included, SSO, SCIM, roles given to teams, sensitive data
It can propose a share, a field's access or a role change, and each waits for a person's yes whatever the Agent may do elsewhere. Approvals are decided by people only, and the Agent never works with more than the rights of the person it works for.
Deactivate them: sign-in stops at once and nothing is deleted. Their records and history stay, and you can move every record they own to someone else as you deactivate them, or later.
Pro and Business read sign-ins, security, content and object types. Enterprise adds records, settings, and workflows and agents. Acts are kept for 24 months whatever the plan.
Start with the built-in roles, ask who can see what, and read every act back in the log.