The problem
Twenty-six roles across sixteen modules, and you can retune any square.
The trade
What changes, and what it costs you today
Today
What this looks like before
- Permissions were designed per screen, so nobody can state the rule in one sentence.
- The reporting line is documentation, not something the software enforces.
- Somebody can export what they cannot open.
None of this is anybody being careless. It is what happens when the record lives in more than one place.
Instead
Access your security team can actually read
A matrix, not a mazeOne grid of roles against modules. Each cell carries verbs and a scope, and clicking it retunes that grant.
Scope means the org chartGlobal, one department subtree, your reporting line, your assigned records, or just your own.
Delegation has stricter rules than the gatesYou cannot widen scope beyond your own, and nobody edits their own role.
Enforced in the queryRow-level security in Postgres, not a filter the next endpoint might forget.
All of it on Starter and above. Security is on every plan.
On the screen
Not a mockup
The role matrix: 26 roles across 16 modules with verbs and scope
The modules behind it
What is actually doing the work
Named, so this page cannot promise something your plan will refuse — each one links to what it does and which tier holds it.