Staff roles and permissions¶
Give each account the access needed for its work and check the result with that account.
Needs: Core
CRM-NG uses capabilities to control access. Roles group those capabilities, but an account may also inherit permissions from additional roles. Check the effective permissions rather than assuming that the role name tells the whole story.
Understand the main permissions¶
| Capability area | Purpose |
|---|---|
| View | Read permitted CRM records |
| Manage | Operate assigned/permitted work |
| Manage all | Broader cross-record management |
| Admin | Application configuration and administrative functions |
| Audit view | Additional audit visibility where granted |
The reviewed role set includes an auditor or viewer, a technician with restricted ticket work, a manager and a CRM administrator. Service accounts can have manager-level access while being left out of ordinary staff selectors. They do not automatically receive HR permissions.
Configure and test access¶
Open Settings → Access and inspect the assignments. Give a dedicated account the permissions required for its job, then sign in with that account to test the relevant screens and actions. Check direct record links as well as menu visibility.
On a self-hosted site, WordPress administrators have broad authority, and existing installations also keep broad CRM access for WordPress Editors with edit_others_posts. Do not assume an Editor account is limited to website content.
Check module-specific permissions¶
HR separates view, manage, pay and admin access. Changing another account's role requires permission to manage users. Client portal roles control customer visibility, while security administration includes sensitive account operations.
General CRM viewing access does not imply permission to export pay information or reset someone else's MFA. Review permissions after role changes, departures or module activation. Audit access also has its own scope; an ordinary viewer may only see their own activity.