Where
Team & security, Roles & permissions tab. You need "Create and edit roles" to change roles, and "Manage people and their exceptions" to add exceptions.
Make a new role
- Press New role. It starts at rank 40, or just below your own rank if yours is lower.
- Give it a name, a rank and a description. The owner can pick any rank from 0 to 99; everyone else can go up to one below their own rank.
- Tick the permissions it needs. Where a permission has a scope, pick whose records it covers. Where it has a limit, type the most it allows. Blank means no limit.
Often the quickest way is Duplicate on a role that is close, then change the copy. Permissions you don't hold yourself are left out of the copy, and the app tells you how many.
Compare roles shows every role side by side. A role can be deleted only when nobody holds it.
Exceptions for one person
- On the People tab, press Manage next to the person.
- Under Add an exception, pick the permission, then Allow or Block.
- Choose whose records it covers (the same as the role, their own, their crew or everyone) and a limit if it has one.
- Write the reason. It is required and saved in the history log.
- Press Add exception.
The drawer lists the person's exceptions, each with Remove, and ends with everything the person can do once their role and exceptions are put together. Exceptions don't apply to the CEO role, which already has everything.
The rules that keep this safe
- Nobody can give a permission they don't have, a wider scope than their own, or a higher limit than their own.
- Nobody can change their own access. Ask someone ranked above you.
- Nobody can manage people or roles ranked at or above them. The CEO is the exception.
- Only an owner can move another owner, so the company never loses its last owner.
The database enforces all four, and every change is written to the history log. See The history log.