--- title: "Roles, permissions, approvals and audit log | SalexHub" description: "Seven built-in roles and your own, teams, sharing and field access. Approval rules hold an act until the right people approve; the audit log shows who did what." url: "https://salexhub.com/platform/control" --- # Control & audit **Everyone sees what their role allows, and every act leaves a line in the log.** Roles, teams, sharing and field access decide who sees what, and the product can tell you why. Approval rules hold the acts that matter until the right person says yes, and the audit log says who did what, when and from where, including what was refused. One deal in two windows. On the left its Owner has it whole, margin included, and asks whether a colleague in accounts can see it: the product answers that she cannot, because no grant reaches her for this record. On the right is her own screen, where the deal is not visible. Granting her read access changes the answer and its reason, and her window shows the deal, read only and without its margin; when she tries to change its stage she is refused. Under both windows the audit log gains a line for each step, with who, when, from where and how it ended. [Start free](https://app.salexhub.com/register) · [Ask who can see it](https://salexhub.com/platform/control#see) ## Decide who sees what, once. As a team grows, so does what each person should not see. Roles, teams and sharing set who reaches which records; field access sets what they read of each one; and sign-in makes sure the person is who they say. - **Roles that fit how you work**: Owner, Admin, Billing Admin, Manager, Member, Viewer and External, and roles you build from them: for each kind of record, who may view, edit, delete and communicate, over all records, their team's or their own. Teams nest, sharing rules give access, restriction rules take it away, and a record can be shared by hand with a person, a team or a role. - **Field by field**: For each property, choose Edit, View, Masked or Hidden, for everyone and for each role. Masked shows a redacted hint, never the value; Hidden means the property does not exist for that person. It holds in lists, search, exports and for the Agent, and personal data starts masked for viewers. - **Sign-in, the way you ask for it**: Passkeys or a second step from an authenticator app. Ask a second factor of nobody, of admins or of everyone, and those it newly covers get 14 days and an email. Choose how long people stay signed in and after how much inactivity they confirm it is them. On Business and Enterprise, people sign in with SSO; Enterprise adds SCIM. - **Personal data, exported or erased**: Export everything the organization holds about a person as one file, or erase them across records, emails, files and history. An erased address cannot come back through an import, a form or the Agent, and a record under legal hold keeps what the law needs. ## Each person holds what their work needs. Control is not only for the IT department. Here is what it means for four people. - **Owner: Every right, and the last word on the Agent.** The Owner holds every right, is the only one who can let the Agent act on its own, and cannot be changed by anyone else. - **Office manager: Bring people in, and let them go cleanly.** Invite people with the role they need. When someone leaves, deactivate them: sign-in stops at once, and their records and history stay, ready for someone else. - **Accounts: See the money, not every conversation.** A role reaches each kind of record its own way: every invoice and payment, only the deals someone shares, and costs and margins where the role holds that right. - **Sales manager: Your team's deals, not everyone's.** A manager sees the records of their team and its sub-teams. Team performance and the Agent count only what that role can already see. ## Control that holds when nobody is watching. The rules are kept by the product on every request, not by hoping people remember them. - **Your organization, kept apart.** Every read and write is limited to your organization, which the product takes from the signed-in membership, never from anything a request says. Membership is checked again on every request, so a freeze or a deactivation counts at once. - **Nobody approves their own.** An approval rule holds the act until the people it names decide, in order. Nobody decides their own request, the record stays locked while it waits, and an approval that nobody decides expires after 30 days. - **The Agent never holds more.** It works with the rights of the person it works for. Sharing, field access and roles always wait for a person's yes, approvals are decided by people only, and nobody can grant a right they do not hold. [Who decides an approval](https://salexhub.com/docs/control/approval-rules) ## Who can see it? The product says, and says why. Access you cannot explain is access you cannot trust. Ask about one deal and one person, share it, and ask again: each answer comes with its reasons, and each step lands in the log. - **Before, view as user: They cannot see it yet.** The answer comes with its reasons: no role, team, rule or share reaches this colleague for this record. Waiting for you. Share the deal with them, read only. - **After the share, read access: They can read it, and only read it.** Asked again, the answer says a manual share grants them read access. The margin stays hidden, because their role does not see costs and margins. Waiting for you. Give them edit access, or keep it read only. - **Afterwards, the log: Every step is in the log.** Who shared the deal with whom, and what was done with it or refused, each a plain sentence with when and from where. Waiting for you. Export it for whoever asks. ## Where you set it, decide it and read it back. Control lives in Settings, decisions wait where people work, and the log answers whoever is allowed to ask. - **Members and access: Roles you can read.** Each role as a grid of what it may do to each kind of record, and View as user to see exactly what one person can reach, and why. - **Approvals: Decisions wait for the right person.** What an approval rule holds waits in Approvals with who decides it and at which step, and the person who asked sees where it stands. [More](https://salexhub.com/docs/control/approval-rules) - **Audit log: Read it, filter it, export it.** Filter by who, by kind of act or by outcome, open any act for its details, and export what you see. How far back you read depends on the plan; acts are kept for 24 months. [More](https://salexhub.com/docs/control/audit-log) - **The Agent: Ask who did what.** Someone who may read the log can ask the Agent what happened, and it answers from the log, within that person's rights. ## How to get Control & audit. Roles, teams, sharing, field access and approval rules come with every plan. The audit log, single sign-on and the rest grow with the plan. - **Free**: included. No audit log. - **Pro**: included. The audit log of sign-ins and security. - **Business**: included. The audit log of sign-ins and security, SSO. - **Enterprise**: included. The full audit log, records and settings included, SSO, SCIM, roles given to teams, sensitive data. - Roles, teams, sharing, field access, approval rules and two-factor sign-in are on every plan. - The audit log keeps acts for 24 months; the plan decides which of them you read and how far back. - Try Pro or Business free for 14 days. ## Read more - [Roles and permissions](https://salexhub.com/docs/control/roles): The seven built-in roles, the rights a role can hold and custom roles. - [Access and sharing](https://salexhub.com/docs/control/access): Access defaults, teams, sharing rules and field access. - [Approval rules](https://salexhub.com/docs/control/approval-rules): What a rule can hold, who decides, and in what order. - [Audit log](https://salexhub.com/docs/control/audit-log): What is recorded, what your plan lets you read, and export. ## Questions about control **Can the Agent change who sees what?** It can propose a share, a field's access or a role change, and each waits for a person's yes whatever the Agent may do elsewhere. Approvals are decided by people only, and the Agent never works with more than the rights of the person it works for. **What happens to someone's records when they leave?** Deactivate them: sign-in stops at once and nothing is deleted. Their records and history stay, and you can move every record they own to someone else as you deactivate them, or later. **Which acts does the audit log show on my plan?** Pro and Business read sign-ins, security, content and object types. Enterprise adds records, settings, and workflows and agents. Acts are kept for 24 months whatever the plan. ## Give each person what their work needs. Start with the built-in roles, ask who can see what, and read every act back in the log. [Start free](https://app.salexhub.com/register) · [See pricing](https://salexhub.com/pricing) --- The same page for people: https://salexhub.com/platform/control. Index of this site for agents: https://salexhub.com/llms.txt