Understand role permissions and record access

Only an authorized administrator should change role access. Review the intended scope before applying bulk changes.

1. Open Roles and edit the intended role or use its record-access action.
2. Review permissions for the modules the role needs.
3. Review Show Assigned Users for user-selector visibility.
4. Set Module Record Access separately for each applicable module.
5. Use the bulk action when the same selected module settings must be applied to multiple roles.
6. Save, then test with a representative restricted account.

• Show Assigned Users: governs the assigned-user visibility policy, including applicable child-role users.
• Module Record Access: controls records for the selected module.
• Assigned to me: narrows records to the applicable personal assignment rule.
• Assigned to me & my team: includes the applicable team scope.
• All company records: remains within company/permission boundaries.
• Use previous access rules: retains the module’s existing visibility behavior.

Verify both listing and direct record access with a restricted user. Changing a dropdown is not proof that every team workflow is correct.

If access is broader or narrower than expected, inspect the module scope, assignments and all levels of the role hierarchy. Avoid making everyone an administrator as a workaround.

Open the same module from the app menu. Use the record card or its actions menu. Scroll through the form before saving so that required fields and validation messages are not missed. Your permissions still apply.