Build an action matrix
For customers, deals, payments and reports, list view, create, edit, delete and export separately. Define the scope for each: owned records, team records or the whole company. Export is not equivalent to viewing because bulk extraction may require separate approval. Agree what changes when a customer is reassigned or an employee leaves.
Enforce permissions on the server
Hiding a button does not protect a record from a direct request. Every read and mutation should verify the user, action and object ownership. Test uploads, APIs, search and reports separately: they can expose data hidden by the main interface. Use accounts with different roles and anonymised records.
Control exceptions
Grant administrator privileges separately from everyday access. Log permission changes, mass exports and critical mutations without recording passwords or secrets. Give temporary access an expiry and a revocation owner. Review the matrix when teams and processes change, not only at launch.
Checklist
- Separate export and deletion permissions.
- Test direct requests and API access.
- Check access after record reassignment.
- Audit administrator actions.
Project questions
Should a supervisor automatically have full access?
Only when required by their duties. Financial fields, user administration and exports should be agreed separately.