CRM roles and permissions: who should see what

Your CRM holds your customer list, your pipeline and every conversation your team has had. That makes “who can see and change what” an important question, even for a team of five. This guide shows you how to design simple roles, decide who sees which records, protect the risky actions and handle the day someone leaves.

Why permissions matter for small teams

It’s tempting to give everyone full access and move on. Here’s why that backfires:

• Departing reps can take your pipeline with them. Full export access makes it easy.
• Mistakes spread. One bulk edit or delete by the wrong person can damage hundreds of records.
• Lead fairness suffers. If reps can see and grab each other’s leads, you get arguments instead of follow-ups.
• Customer data is sensitive. Phone numbers, addresses, budgets and payment status deserve care.

Many small businesses haven’t set this up yet. In a 2024 survey by Salesforce (a CRM vendor) of 3,350 leaders at businesses with 200 or fewer employees across 26 countries, only 44% said they were implementing access controls or monitoring for internal users, and 39% said they used two-factor authentication (Salesforce SMB Trends, 6th edition).

Start with least privilege

The guiding idea is least privilege. NIST defines it as the principle that a system should restrict users’ access privileges “to the minimum necessary to accomplish assigned tasks” (NIST glossary). The FTC’s guidance for businesses says the same thing in plainer words: limit access to personal information to employees with a “need to know” (FTC, Protecting Personal Information).

In practice, that means you start everyone with narrow access and widen it only when there’s a clear reason, not the other way around.

Designing roles

Most small teams need five roles or fewer. Here’s a common pattern. Each CRM defines its roles a little differently, so check the details in yours.

Role	Who	Typical access
Owner	The business owner	Everything, including billing and account ownership
Admin	Owner’s trusted backup or ops lead	Settings, users, integrations, imports and exports
Manager	Sales manager or team lead	All records for coaching and reassignment, reports, no account settings
Rep	Salespeople, closers, estimators	Their own records and unassigned leads; create and update, limited delete
Viewer	Bookkeeper, partner, assistant who only needs to look	Read-only access to what they need

A few guidelines:

• Keep admins to two. One is a single point of failure; five is a security risk.
• Don’t make everyone a manager just to avoid permission questions.
• Give people the role for their job, not their seniority. A senior closer still only needs rep access.
• Use viewer access for outsiders such as an accountant or a part-time assistant.

Record ownership and visibility

Roles decide what someone can do. Ownership decides which records they see.

Every lead, contact and deal should have an owner. Common visibility models:

Model	How it works	Good for
Own records only	Reps see what they own	Commission-based teams, high-ticket closers
Own plus unassigned	Reps see their records and a shared pool of new leads	Most small sales teams
Team-wide	Everyone sees everything	Very small, collaborative teams such as a two-person agency

The “own plus unassigned” model works well with automatic assignment. New leads land in the pool or go straight to a rep by round-robin, so no one has to decide who gets what. Our guide to lead routing explains assignment rules.

Special cases

Real teams rarely fit a neat chart. A few situations come up again and again:

• Shared logins. Never share one login between people, even a receptionist and an office manager. Every person needs their own user, or the audit log can’t tell you who did what, and you can’t remove one person’s access without locking out the other.
• The owner who also sells. Give yourself the owner role, but own your deals like any rep so your pipeline shows up correctly in rep reports.
• Seasonal and part-time staff. A lawn care company that adds canvassers in spring should give them rep or viewer access for the season and deactivate them when it ends, rather than leaving dormant accounts behind.
• Assistants and transaction coordinators. A realtor’s assistant may need to update contacts and book appointments for the agent’s clients. Give them a role that covers that work, not admin rights for convenience.
• Outside partners. Bookkeepers, agencies and consultants should get viewer access, time-limited if possible, and only to the records they need.
• Handoffs between teams. When a closed deal moves from sales to an install or delivery team, reassign ownership so the record doesn’t stay with someone who no longer works on it.

Protect the high-risk actions

Some actions deserve tighter control than everyday editing:

• Exporting data. The fastest way to walk out with your customer list. Limit it to admins.
• Bulk delete and bulk edit. Restrict to admins and managers, and check the audit log after.
• Changing pipelines, fields and automations. One change affects everyone.
• Connecting integrations and creating API keys. These give other systems access to your data. See our guide to CRM API and webhooks for key safety.
• Billing and account ownership. Owner only.

Pair these restrictions with strong sign-in habits. The FTC recommends strong passwords and suggests considering multi-factor authentication, such as a password plus a code sent by a different method.

Offboarding checklist

The day someone leaves is when permissions matter most. The FTC advises having a procedure to terminate the passwords of workers who leave as part of the check-out routine. For your CRM, that looks like:

1. Remove or deactivate their user the same day. Don’t wait for the end of the pay period.
2. Reassign their open leads, deals and tasks to another rep or the manager.
3. Check their scheduled items: appointments, follow-ups and automated messages in their name.
4. Revoke integrations and API keys they created, and reconnect any shared ones under an admin account.
5. Review the audit log for unusual exports, bulk changes or deletions in the weeks before they left.
6. Update shared logins for any connected tools, such as calendars or phone systems.

For a friendly departure this takes 15 minutes. For an unfriendly one, it’s the 15 minutes that matter most.

Audit logs: trust, but verify

Permissions prevent problems; audit logs help you understand the ones that slip through. A good CRM audit log records:

• What changed (create, update, delete), with old and new values
• Who made the change
• When it happened
• Where from, such as IP address and device

Use the audit log to investigate a deal that suddenly changed owner, a batch of deleted contacts or a pipeline value that doesn’t add up. Knowing that changes are logged also encourages careful work.

AI assistants and permissions

If your CRM includes an AI assistant, it should follow the same rules as the person using it. A rep asking “show me all deals over $10,000” should only get their own deals. And the assistant should ask before it creates, sends or changes anything. Our guide to AI CRM and our post on using AI with customer data cover this in more detail.

Review access every quarter

Set a calendar reminder to review access four times a year:

• Is everyone on the user list still with you?
• Does anyone have a higher role than their job needs?
• Are there API keys or integrations nobody recognizes?
• Are any records unowned or owned by people who’ve left?

How Exa helps

Exa has five roles (owner, admin, manager, rep and viewer), and reps see only the records they own or that are unassigned. Round-robin lead assignment spreads new leads across the team. The AI assistant respects the user’s role and permissions, and it only creates tasks, notes, leads, messages, appointments or automations after the user confirms an action card.

On the security side, Exa keeps audit logs of creates, updates and deletes with old and new values, the user, IP address and user agent. Integration credentials, calendar tokens and webhook secrets are encrypted at rest, and API keys for the lead API are scoped and stored hashed.

Final thoughts

Permissions don’t need to be complicated. Start everyone with the least access they need, use a few clear roles, let ownership decide visibility, lock down exports and integrations, and offboard people the same day they leave. Then let audit logs and a quarterly review catch whatever slips through.