Roles and permissions
How APROS decides what each person can see and do — permissions, roles, access levels (Own, Own + subordinates, Department, All) and the built-in roles.
APROS decides what each person can do with roles. A role is a set of permissions, and each permission comes with an access level that says which records it covers.
How it works
- A permission allows one action on one kind of record. Its name has the form
ACTION_RESOURCE:VIEW_LEADlets you read leads,CREATE_DEALlets you create deals,UPDATE_ORGANIZATIONlets you change company settings. - An access level says which records the permission covers: only yours, your team's, your department's or all of them.
- A role groups permissions with their access levels. Each person has one or more roles.
- If any of a person's roles allows an action on a record, the person can do it. Roles add up; one role can't take away what another gives.
People with the Administrator role can do everything.
APROS checks permissions on the server. The same rules apply when you work in the browser, when the AI Brain or an AI agent acts for you, and when an API key is used. If you lack a permission, the related sidebar items, buttons and pages don't appear, or APROS refuses the action and tells you that you lack the rights.
Access levels
| In the app | Code | Records the permission covers |
|---|---|---|
| No access | NONE | None. |
| Own | OWN | Records you own. |
| Own + subordinates | MANAGER | Your records, and records owned by people who report to you, directly or further down. Who reports to whom comes from each person's Manager. |
| Department | DEPARTMENT | Your records, and records of your department and of the departments under it. |
| All | COMPANY | Every record in the workspace. |
Under Own + subordinates and Department, a record with no owner or no department is visible only if it is yours. Set people's Manager and Department when you add them, or these levels have nothing to work with.
Built-in roles
Every workspace comes with these roles, marked System. You can't delete them.
| Role | Access level as shipped | What it can do |
|---|---|---|
| Administrator | All | Everything, including company settings, roles, users and API keys. |
| Director | All | All business work across the company. Can read roles and the audit log, but can't manage roles, API keys, company settings, AI agent security settings, the warehouse, or restore deleted records. |
| Department Head | Department | Full work with leads, deals, contacts, companies, projects, tasks and quotes, including deleting them; manages deal stages; approves time entries and documents; uses chat, mail, channels, calendar and files; builds AI agents and automations and approves AI actions. Reads finance settings and transactions. |
| Employee | Own | Creates and updates leads, deals, contacts, companies, activities and tasks, converts leads, logs time; reads projects, products and quotes; uses chat, mail, calendar, files and video calls. Can see AI Studio but not change it. Can't delete CRM records. |
| Observer | All | Reads everything except the warehouse, the audit log, roles and finance transactions. Changes nothing. |
A sixth built-in role, Client, is marked as not assignable and can't be given to anyone.
When you create a user, their Employee Role gives them one of these roles. See the table in Invite your team.
Permissions you will meet first
| Permission | What it allows |
|---|---|
UPDATE_ORGANIZATION | Open and change Settings → Organization and System, and open Settings → Users. |
VIEW_ROLE | Open Settings → Roles & Permissions. |
CREATE_ROLE, UPDATE_ROLE, DELETE_ROLE | Create, change and delete roles. |
ASSIGN_ROLE | Give roles to people and set their Employee Role. |
VIEW_LEAD, CREATE_LEAD, UPDATE_LEAD, DELETE_LEAD, CONVERT_LEAD | Read, create, change, delete and convert leads. Deals, contacts and companies have matching VIEW_, CREATE_, UPDATE_ and DELETE_ permissions. |
MANAGE_DEAL_STAGES | Create deal funnels and change their stages. |
CREATE_CHANNEL | Connect messaging channels such as Telegram. |
VIEW_INVOICE, CREATE_INVOICE, UPDATE_INVOICE | Work with invoices; UPDATE_INVOICE also sends them and creates payment links. |
VIEW_AI_STUDIO, CREATE_AI_STUDIO, UPDATE_AI_STUDIO | Open AI Studio, create and change AI agents. |
MANAGE_AI_AGENT_SECURITY | Change an AI agent's autonomy level and schedules. |
APPROVE_AI_EXECUTION | Approve or deny actions that AI agents pause for, including runs other people started. |
See and change roles
AdminGo to Settings → Roles & Permissions. The page is a grid: permissions grouped by area on the left, one column per role. Each cell shows the role's access level for that permission.
- Change an access level: click the cell and choose No access, Own, Own + subordinates, Department or All. The change applies immediately. Needs
UPDATE_ROLE. - Give a role to people: click the + under the role's name, then pick the people. Needs
ASSIGN_ROLE. - Open a role: click its name. The role page has Overview, Permissions, Users and Audit Log tabs. The audit log lists who created, changed, cloned the role and who added or removed users.
Create a role
-
On Settings → Roles & Permissions, click Create Role.
-
Enter the Role Name (unique, for example Sales Manager), an optional Description and a Priority from 0 to 100.
-
Select the role's Permissions, then click Create Role.
-
On the role page that opens, adjust access levels and add users.
To make a variant of a built-in role, open it and click Clone Role, then change the copy. Delete Role is available only for roles you created; deleting a role removes it from everyone who has it.
To give one person an extra role, you can also open them in Settings → Users, click the ⋮ menu → Manage Roles.