Set Up Role Permissions

Set Up Role Permissions

HARi controls access through three layers:

1. User role (admin or member) — admins manage settings; members get the rest
2. Permission profiles — granular per-entity grants assigned to teams
3. Teams — groupings of users that inherit a profile and a record-sharing scope

This guide covers the profile + team layer, where most day-to-day permission tuning happens.

Understanding Permission Levels

For each entity, a profile grants four actions:

• Create — Can the user create new records?
• Read — Can the user view records?
• Update — Can the user edit existing records?
• Delete — Can the user delete records?

Each action takes a scope value:

• All — Every record of that entity
• Team — Records owned by anyone in the user’s team
• Own — Only records assigned to the user
• None — No access (the action is denied)

Reviewing Profile Permissions

1. Go to Settings > Schema
2. Pick an entity (e.g. Contact)
3. Open the Permissions tab — you’ll see a matrix of every profile that has a grant on this entity, with a coloured badge per action showing the scope (All / Team / Own / None)

Example: Sales Representative permissions

Entity	Create	Read	Update	Delete
Contacts	All	Team	Team	None
Companies	All	All	Team	None
Opportunities	All	Own	Own	None
Activities	All	Own	Own	Own
Invoices	None	Own	None	None
Tasks	All	Own	Own	Own

Common Profile Templates

Manager

• Same entity access as Sales Representative
• Record scope set to All for Opportunities and Activities
• Read access to all entities for reporting

Finance

• Full access (CRUD) to Invoices
• Read-only access to Companies and Contacts
• No access to Opportunities or Leads

Marketing

• Full access to Contacts and Leads
• Read-only access to Companies
• No access to Invoices or Opportunities

View-Only

• Read access to all entities
• No create, update, or delete permissions
• Scope set to All

Assigning Profiles to Teams

In HARi, profiles are attached to teams, not directly to users:

1. Go to Settings > Teams
2. Select the team you want to configure
3. Open the Permissions tab on the team page — pick the profile that should govern this team
4. Add users to the team via the Members tab — they inherit the team’s permissions

To change what a single user can do, move them between teams or adjust the profile assigned to their team.

Testing Permissions

After configuring a profile, verify it works as expected:

1. Log in as a user with that profile (or ask them to test)
2. Check that they can access the correct entities in the sidebar
3. Verify that they can only perform the allowed actions
4. Confirm the record scope works (they see only their own records, or all records, depending on the setting)

Updating a Profile

When you modify a permission profile, changes take effect immediately for all users assigned to that profile. No need to re-assign users.

Next Steps

• Add a User to assign the profile to new team members
• Inviting Your Team for the full team setup guide
• Create a Custom Entity — remember to add new entities to your permission profiles