Roles and permissions

As a workspace grows beyond a founding team, "everyone can do everything" stops being acceptable: SDRs shouldn't delete companies, contractors shouldn't export your database, and only admins should manage the team and workspace. Roles define what each member can see and do.

Open Settings > Users > User Roles to see the workspace's roles (Super Admin, Admin, Member, Guest and Agent) and add your own with Add User Type. Roles decide what a member can do; visibility groups decide whose records they see.

What a role defines

A role is a matrix. For each object (People, Companies, Opportunities, Workflows, Tasks, Notes, AI Meeting Note, Users, Workspaces) it sets five actions:

• Create
• Read
• Edit
• Delete
• Assign

Each action is Full Access, Restricted or Not Allowed:

• Full Access covers every record
• Restricted narrows the action to the records the member owns; for Read, it means the records their visibility group lets them see
• Not Allowed blocks the action completely

Create has no Restricted option, and Assign is always Not Allowed for Notes and AI Meeting Note.

Record permissions

The rows for People, Companies, Opportunities, Workflows, Tasks, Notes and AI Meeting Note control what the role can do with CRM data.

Settings permissions

The Users row controls access to members, roles and groups; the Workspaces row controls workspace settings. Super Admin, Guest and Agent are fixed and can't be edited; every other role, including the ones you add, can be. A Guest only sees what is shared with them.

Object-level overrides

Every cell is its own setting: click a cell to change that object and action on its own (it saves straight away), for example Companies > Delete to Restricted while People stays Full Access. Use this for roles like:

• SDR: full access to People and Companies, read-only on Opportunities
• Finance: read access to Opportunities, no access to outreach objects
• External contractor: restricted to the records they own

Assigning members

Click Add Member on Settings > Users, enter the full name and email, pick the User Type (the role) and the Visibility Group, then click Add. The person is invited and shows as Invited until they join. The Users tab lists everyone in the workspace with their user type and visibility group, and you can change a member's User Type from the list at any time; the change takes effect immediately.

Narrated video · 1:04

1 linked topic

Adding a teammate with the right access. In Settings, open Users to see everyone with user type and visibility group. Click Add Member, enter name and email, choose Super Admin, Member, Admin, Guest or Agent, pick a visibility group and click Add; they show as invited until they join. In User Roles, each object has create, read, edit, delete and assign permissions set to Full Access, Restricted or Not Allowed. Super Admin, Guest and Agent are fixed.

Transcript

A new teammate needs an account and the right access. In Settings, open Users. The Users tab lists everyone in the workspace, with their user type and visibility group. Click Add Member, enter their name and email, and choose a user type: Super Admin, Member, Admin, Guest or Agent. Pick their visibility group, click Add, and the invitation goes out. They show as invited until they join. Each user type is a role, so open User Roles and click Member. For every object, from People and Companies to Workflows and Users, the role sets five permissions: create, read, edit, delete and assign. Full Access covers every record. Restricted narrows it, so they can only change the records they own, and only read what their visibility group allows. Not Allowed blocks it completely. Click any cell to change it, and it saves straight away. Super Admin, Guest and Agent are fixed, so the ones you tune are Admin and Member.

Role and permission changes generate notifications (User and Permission Changes), so affected members know their access changed.

Visibility groups

Roles decide what a member can do; visibility groups decide whose records they see. In Settings > Users > Visibility Groups, open a group (every workspace starts with Default Company), click an object (People, Opportunities, Companies, Workflows) and choose in Permission Settings:

• Owner only: each record is visible to its owner, admins and the group above
• Owner's visibility group: everyone in the owner's group
• Owner's group, and sub-groups: the owner's group and every group below it
• Entire company: everyone in the workspace

Add groups beside or below a group with the + buttons, for example a team inside a region, and add members under Add User (or pick their group when you invite them). All four levels are included in your plan.

Narrated video · 0:51

1 linked topic

Controlling which records each person can see. Roles decide what someone can do, while visibility groups decide what they can see. In Settings, open Users and Visibility Groups. Every workspace starts with Default Company, and plus buttons add groups beside or below. Open a group and set levels for People, Opportunities, Companies and Workflows: Owner only, Owner's visibility group, Owner's group and sub-groups, or Entire company. Add members there or when inviting.

Transcript

Roles decide what someone can do. Visibility groups decide which records they can see. In Settings, open Users and the Visibility Groups tab. Every workspace starts with Default Company, and the plus buttons add groups beside it or below it, like a team inside a region. Open a group to set visibility for People, Opportunities, Companies and Workflows. Click People, and pick a level. Owner only shows each record to its owner, admins and the group above. Owner's visibility group opens it to everyone in the owner's group. Owner's group and sub-groups adds every group below it, and Entire company shares it with everyone. Save, and the card shows the new level. Underneath are the group's members, and you can add users right here, or pick their group when you invite them.

Inbox access is separate

Roles and visibility groups govern CRM records (People, Companies, Opportunities and the other objects above). They do not control who can read an inbox. Each member sees the conversations of the accounts they connected, plus the accounts and conversations shared with them, and each account's message visibility decides how much teammates see of its messages. To give someone access to a mailbox, a LinkedIn account or a single conversation, share it: see Inbox filters, views and collaboration.

AI agents and roles

Roles don't just govern humans. The built-in Agent role ("Has access to features and data related to customer interactions") scopes what AI agents can touch, so an AI CRM agent operates with defined permissions rather than full workspace access: the same least-privilege logic you apply to people.

Recommended setup

1. Super Admin: keep it to 1 or 2 people
2. Admin: full access across records, plus the Users row for managing the team
3. Member: create, read and edit records; Delete set to Restricted or Not Allowed; no access to the Users and Workspaces rows
4. Invite new people as Member and elevate them deliberately

Common questions

Key outcome

Roles make Vetta safe to scale: every member gets exactly the access their job needs, destructive actions are restricted to people accountable for them, and the data model, security, and API surface stay under admin control.