How to Plan Permissions and Roles in CRM?

A Functional Role Model

Three to five roles are usually sufficient. Creating twelve roles means they will not be maintained.

What is Often Overlooked

Reports Bypass Permissions. A report on all sales shows figures that the person in the individual record should not see. Reports require their own permissions.

Export is a Permission. Those who are allowed to export can take the entire inventory. This permission should be granted consciously and logged.

Departed Employees. Access must be blocked on the last working day – not when someone notices. Their records must simultaneously be assigned to someone else; otherwise, they become invisible.

Data Protection

A tiered permission concept is not an option but part of the technical and organizational measures according to Art. 32 GDPR. "Everyone sees everything" is difficult to justify in an audit case.

Practical Advice

Start narrow and open up as needed. The reverse approach – granting everything first and later restricting – creates resistance because people lose something they already had.