CRM Access Matrix: Decide Who Can View, Edit, Export and Administer

Copy the access decision matrix

For each role record: business task | records in scope | view | create/edit | export | administer | approver | review event. Use explicit yes/no/needs-assessment entries rather than “normal access”.

• Owner: assess required business administration separately from unrestricted everyday data access.
• Sales colleague: consider assigned/shared opportunities and the customer context necessary to respond.
• Delivery colleague: consider agreed project information; do not automatically expose every unrelated opportunity.
• External contractor: define the specific work and end condition; broad access is not justified by convenience alone.

A fictional scoped decision

A contractor needs approved project photographs but does not need the complete contact database. The requested access is to the approved project material, not general CRM export or user administration.

Record the manager who approves it, the project scope and when access is reviewed. If the system cannot express that restriction, resolve the gap before sharing; a matrix entry does not itself enforce security.

Join, change role, leave

• Join: verify identity, task, approver and the smallest sufficient scope using an individual account.
• Change role: reassess existing rights; do not only add the new role.
• Leave or finish work: use the supported process to remove unnecessary access and transfer owned work.
• Review: test the relevant allowed and denied actions with authorised test accounts.

Keep subscription seats and permissions separate. Paying for access does not mean every action should be permitted; organisation membership alone should not be assumed to grant every licensed capability.

Separate CMS access from customer membership

Umbraco distinguishes backoffice users from website members, and provides user groups and content/media start nodes. Those controls describe CMS access, not every connected application’s authorisation. See the Umbraco user documentation.

Confirm both the application boundary and the record scope. This is a requirements worksheet, not a security certification or evidence that a configured role has passed its access tests.