The usual mistake is not giving too few permissions: it is giving too many because it is faster than thinking about the split. These four rules cover most cases.
A role describes a job, not a person
Assign the salesperson role, the warehouse role, the accounting role. When someone changes position, you change their role and that is it. If the role carries a person's name, every rotation is an investigation.
Start from the bottom
Give the minimum permission and raise it when someone asks with a reason. The reverse almost never happens: nobody gives back an access they already have.
Permissions are per module and per organization
A user can be an administrator in one organization and read only in another. Switching organizations does not carry permissions over: each scope decides its own.
Xeni and the agents inherit the split
Everything you decide here applies to artificial intelligence too: Xeni answers with the permissions of whoever asks, and agents operate with the ones the organization assigned them. It is deliberate: without that rule, the assistant would be the back door to the whole scheme. See how it is applied in the help center
Review it from time to time
- Who has the administrator role and why.
- Which accounts are still active for people who have left.
- Which external integrations have access and under which user.
