Published at: 2026-09-17

Roles, data permissions, and sharing model

Learn how the platform designs function permissions and controls granular data visibility.

Overview

The platform uses role-based access control (RBAC) and a multidimensional, record-level sharing model based on the Org Structure. Function permissions control what employees can do, such as create, edit, and delete records. Data permissions control which records employees can view, such as specific customer records. Together, these controls protect enterprise data privacy and support compliance.

Function permissions: role model

Roles carry function permissions. Administrators assign menu and button permissions to roles, then assign roles to employees.

Business roles: Assign these roles to front-line business users, such as sales representatives, support agents, and cashiers. Their permissions cover list entry points and detail-page operation buttons for business objects such as accounts, opportunities, and contracts.
Management roles: Assign these roles to system management staff, such as system administrators and organization administrators. Their permissions cover back-end management menus and function configuration.
Role union principle: If you assign multiple roles to an employee, the employee’s resulting function permissions are the union of the permissions assigned through all roles.

Data permissions: four-level visibility model

1. Basic data permissions

This is the lowest-level global default. Configure it by business object:

Private: Only the record owner, the owner’s manager in the reporting line, the department manager and department assistant, and related team members can access the record.
Public read-only: All employees can view all records for the object. Only the owner, the owner’s manager, and related team members with edit permission can modify them.
Public read/write: All employees can view and edit all records for the object.

2. Data permissions within departments or organizations

When an object’s basic data permission is Private, configure department data permissions to expand visibility horizontally or downward across the administrative hierarchy:

View data in the current department, excluding child departments: Members can view only data belonging to their department.
View data in the current department, including child departments: Members of the current and child departments can view only data belonging to their respective departments.
View data in the current and child departments: Members can view data belonging to their department and child departments.
Mutual visibility for the current and child departments: Members of the current and child departments can view data belonging to both the current and child departments.

3. Data sharing rules

Use sharing rules to cross administrative boundaries and share data horizontally with colleagues, departments, roles, or user groups. The platform supports four rule types:

By data owner: Share data owned by specified people with the target recipients.
By data department: Share data belonging to an Assigned Department with the target recipients.
By data organization: Share data belonging to an Assigned Organization with the target recipients.
By criteria: Share data that meets specified filter criteria, such as accounts whose level equals VIP, with the target recipients.

4. Related teams and temporary permissions

Related teams (record-level authorization): Add collaborators to a record’s related team manually or automatically. Assign each collaborator a role, such as co-owner or regular member, and read/write permissions.
Temporary permissions (process-driven): During an approval or business process, the system temporarily grants the process handler access to the current approval record. It automatically revokes the permission after the task is complete.