RBAC Matrix

Who this is for

Users authorized to manage Settings. System-role changes and the seven documented System Manager configuration procedures have stricter role requirements.

The permission model

The CRM resolves permissions from user_roles and role_permissions; the legacy profile role array is not the authorization source. Every one of these 25 modules has read, create, edit, delete, and an access level:

leads, cold_contacts, deals, contacts, organizations, vendors, tasks, pipelines, campaigns, influencer, sequences, finance, contracts, reports, chats, meetings, timesheets, compliance, email, files, settings, integrations, automations, team, and data_exchange.

• all permits eligible records across the module.
• own restricts records to the user’s ownership scope where the record supports it.
• none removes access.
• delete is the manage capability for non-CRUD operations as well as deletion.

Roles with at least one readable module can enter the CRM shell, including custom roles. The matrix—not an assumed built-in display name—is the default access source.

Guard ladder

User-facing procedures authenticate the Clerk session, require CRM workspace access, then enforce a module/action guard. The guard provides the resolved access level to the procedure, and the procedure must apply it to the requested record.

There are seven deliberate System Manager-only exceptions: five business-rule configuration procedures and two meeting-bot configuration procedures. Sales Manager access to a module does not override those exceptions.

Before you change permissions

1. Identify the specific module and action the person needs.
2. Choose all or own deliberately; do not use all merely to solve a single inaccessible record.
3. Check whether the task is actually a manage operation.
4. Review the effect on navigation, command-palette actions, API procedures, and owner-scoped records.

What happens next

Authorization caches are cleared after role/permission changes. Administrative mutations are recorded in the Audit log after their main database operation commits.