Who sees what
is your decision.

For every permission you also pick a scope: only their own records, their team’s records, or all of them. The same task list is therefore a different length from person to person. Because the scope is a separate setting, you can say “let them see, but not everything”.

A workspace opens with the Owner, Admin, Staff and Guest roles. Someone who joins takes the Staff role by default. Because the roles come ready, you do not build permissions on day one.

When the ready roles are not enough, you define your own. You can also copy a role and change it. Once a role is set up, it goes to everyone doing that job with a single click.

You see every role and every permission side by side in one table. What a role reaches and what its scope is are read on the same line. Because the table holds together, you understand the difference between two roles by comparing them.

You split your people into teams and match projects with teams. When you pick the team scope, a person sees their own team’s work. Because the team is defined, you do not count the scope person by person.

Every team can have a lead. The lead manages the team's members and edits the team itself; an administrator hands the role to someone else when it changes. Who is responsible for a team is right there in the list.

You invite a new colleague by e-mail address and a link goes out to them. Whoever opens the link sets their own password and joins the workspace. Because the invitation comes as a link, you do not create the account yourself.

When you grant the right to change a record, the right to view it comes with it. You do not tick the lower rights one by one. Because the chain builds itself, the “I cannot reach it” case caused by a missing permission grows rarer.

Departments hold the org chart: who sits where and who manages whom. Teams carry permission scope; the team scope decides which records a person sees. Naming a department manager shows on the chart but grants no extra permission.

Some permissions change the whole workspace: the address, billing or deletion. Those carry a warning label while you build the role. You see what you are handing over before you hand it over.

You close the access of a departing colleague from one place. The person stays on the list but cannot enter the workspace. Because access hangs on one switch, you do not collect permissions module by module.