CRM permissions: an access matrix for 8 roles

CRM permissions are the rules that define who sees, edits, exports and deletes each record in the database, and a safe design starts from least privilege: each person gets the access their role requires, for as long as it requires it. Most of the risk sits with people and the access they accumulate. Verizon’s 2026 report, which analyzed more than 22,000 confirmed data breaches in 145 countries, found the human element, such as error, social engineering or misuse of credentials, in 62% of them (Verizon, 2026). In the CRM, that number shows up as the salesperson with an admin profile who exports the database the day before resigning, the former employee whose login is still active and the integration that runs on the password of someone who already left. A role-based profile matrix is the cheapest measure the board can approve against all three.

In the assessments I run, the list of admins tends to be longer than the board imagines, because during implementation someone granted full access so the team would not get stuck, and nobody went back to adjust it. I wrote this for the board, revenue operations, IT and the data protection officer, the DPO (the person who answers for the protection of personal data), as management guidance with no claim to be legal advice.

Why are CRM permissions a board decision?

The CRM holds the customer book, the pipeline with values and discounts and the personal data of buyers and decision makers. A user with full access can take, in a few minutes of exporting, the commercial asset the company spent years building, so the decision about who sees what belongs to whoever answers for the risk, even if the configuration stays with the admin.

Brazil’s data protection law, the LGPD, Law 13,709/2018, requires in art. 46 that processing agents adopt technical and administrative security measures able to protect personal data from unauthorized access, and in art. 49 that the systems that process personal data be structured to meet security requirements and standards of good practice and governance. Art. 6, item X, requires the company to demonstrate those measures, and the evidence comes from the approved matrix, the audit log and the minutes of the access review.

Among the security incidents reported to the ANPD, Brazil’s data protection authority, from 2021 to 2025, 98 involved unauthorized access to information systems and 52 involved data sent to the wrong recipient, and in the cycle from July 2023 to June 2025 credential theft and social engineering moved to first place (ANPD, 2025). The other figures are in LGPD by the numbers.

What is the principle of least privilege in the CRM?

Least privilege is the rule of giving each user the minimum access their role requires. In the CRM, it translates into four decisions per profile: which records the person sees, what they change, what they take out of the system and what they delete. An access profile is the bundle of those decisions, built for a role such as SDR or CS analyst, and assigned to everyone in that role.

Granting everything and restricting later almost never ends, because whoever loses a permission complains the next day and whoever has a spare permission stays quiet. I start with a closed profile and open it through requests approved by the manager. A partner migrating data for two months gets access with an expiry date.

Who sees what: own book, team or the whole database?

Most CRMs organize visibility into three scopes tied to the record owner, the user listed as responsible for each company, contact or deal. If the owner is wrong, the permission is wrong too, so the design depends on the account portfolio rules.

Scope	What the person sees	Who it serves	Risk when there is too much
Own book	Records they own or participate in	Salesperson, external partner, SDR with a named queue	Low; the problem appears when it is missing, with two salespeople opening deals in the same account
Team	Records of their own team or unit	Sales manager, CS coordinator, SDR with a shared queue	Medium; one team sees another team’s values and discounts
Whole database	Every record of the object	Admin, revenue operations, marketing, board	High; one export takes the entire book

Visibility can vary by object. The salesperson usually sees all companies, to check whether an account exists before creating another one, and only the deals in their own book. The combination reduces duplicates and protects values and commercial terms.

Who edits, exports and deletes in the CRM?

Editing defines who changes the record and which fields, and changing the owner causes more disputes than anything else. The salesperson who can move an account into their own name settles a territory conflict alone, and the rule reserves that action for the manager.

Exporting takes the data out of the system where the company controls who has access, and it includes the download button, the scheduled report that arrives by email every Monday and contact sync with a personal phone. I reserve bulk export for a few profiles, with each one logged, and offer the rest of the team reports inside the CRM.

Deleting destroys history: the salesperson who deletes a lost deal erases what the loss analysis would use next quarter. Deletion stays with the admin, through a documented request, including when the data subject asks for erasure under the LGPD. Imports and bulk updates also get their own permission, because a bad load undoes months of care, as I showed in CRM data quality.

Access profile matrix by role

The matrix below is the starting point I take to the board. Each company adjusts it to the objects in its own CRM, and the logic of the rows usually holds.

Profile	Sees	Edits	Exports	Deletes	Sensitive fields
SDR	All companies and contacts; deals in own queue	Contacts, activities and qualification of own leads	No	No	No contract values or financial data
Salesperson	All companies; deals in own book	Own deals and contacts, without changing the owner	No	No; marks as lost	Value and discount of own deals
Sales manager	Team records	Team records, including owner changes	Team reports, logged	No	Team values and discounts
Customer Success	Active customers in the book and tickets	Contacts, account health and renewal	No	No	Contract and usage, no margin
Marketing	Contacts and companies in the database; no deal details	Source, segmentation and consent	Campaign lists, approved and logged	No	No deal values or financial data
Finance	Customers, contracts and billing	Billing fields and financial status	Financial reports, logged	No	Bank and billing data
Admin	Whole database and settings	Structure, profiles, fields and integrations	Yes, logged	Yes, through a documented request	Full access, with an audit of own actions
External partner	Records of the assigned project or book	Assigned records	No	No	No access; named login with an expiry date

Two rules go with the table. Admin is a role profile held by few people, and the sales director works day to day with a manager profile, because following the operation does not require touching the configuration. And each person has a named login, with no shared account among interns or partners, because without individual logins the audit cannot say who did what.

Sensitive fields and data protection: what to restrict inside the record

Some fields need protection beyond record visibility, what CRMs call field-level permission: tax ID, bank details, payment terms, margin, approved discount and notes about the contact’s personal life. In healthcare, education and financial services, the CRM sometimes holds sensitive personal data, which art. 5, item II, of the LGPD defines and which includes health information and biometrics, and that data needs its own rule written with the DPO.

The safest protection for a sensitive field is not storing it. The salesperson who writes in a notes field that the decision maker is on sick leave creates sensitive data with no commercial purpose, and the recording policy needs to say what does not go into the CRM. Art. 47 adds that anyone involved in any phase of processing must guarantee data security “even after its end”, so the contract with partners and providers covers access, export and return of data at the end of the project.

Data export: the salesperson who leaves with the database

The most common CRM leak needs no hacker: the salesperson accepts a competitor’s offer, spends the last week exporting contacts and deals and arrives at the new job with the list ready. In the teams I work with, the question about exports almost always comes after someone has left, when there is nothing left to block. Prevention works in layers: the profile restricts who exports, the audit log shows who exported what and when, and an alert tells the admin about unusual volumes, especially in the weeks before an offboarding. The employment contract and the code of conduct state that the database belongs to the company and that exporting without authorization is misconduct, and HR presents the rule at hiring.

Contact sync with a personal phone and a scheduled report sent to an outside email copy the book every week, with no export button involved. The commercial cost of these departures is in sales turnover.

User offboarding: what to do on the day someone leaves

CRM access ends on the same day as the employment, and HR tells the admin before the conversation with the employee. In contentious departures, access is suspended before the meeting. The right action is to deactivate the user rather than delete them: the deactivated user loses the login and keeps the history, activities and authorship of records, which the company uses to serve the customer and to answer an audit. Account transfer follows the portfolio rules, with the manager as interim owner until redistribution.

Periodic access review: the quarterly routine

People change areas and keep the old profile, temporary access stays and the partner finishes the project with an active login. In the access review, also called recertification, each manager confirms, person by person, that the team’s access is still needed, on the list the admin cross-checks against HR’s payroll and third-party contracts. In a hypothetical example, the review finds 52 active users for 45 people with planned access: 4 former employees with logins, 2 integrations running on former employees’ credentials and 1 partner whose contract has ended. The seven cases are removed the same day, and the minutes, sent to the DPO, record who decided. The admin list gets its own review with the board, with a written justification for each name.

Audit log: what the CRM needs to keep

The audit log is the history of user actions: logins, exports, deletions, permission changes and edits to critical fields, with date, time and author. It answers the questions that come after an incident and serves as evidence for the demonstration the LGPD requires.

The admin checks with IT which actions the contracted plan logs and how long the vendor keeps the history, because an investigation that starts months later may find an empty log. The monthly reading focuses on exceptions: exports above the agreed volume, bulk deletions, profile changes and logins at unusual hours.

Integrations and API keys: the users nobody sees

An API key is the credential one system uses to talk to another without a human login, and whoever holds it reads and changes whatever its scope allows, usually without going through profile visibility. The website form, marketing automation, ERP, e-signature tool and AI agents are on this list, almost always with broader access than any person.

Verizon shows why this matters. Breaches involving third parties reached 48% of the total, up 60% from the previous year, and in third-party cloud exposures half of the findings of weak passwords and permission misconfigurations took almost eight months to resolve (Verizon, 2026). In a sales operation, the third party is the vendor who connected their tool to your CRM with full access and was never reviewed.

Each integration runs with a service user created only for it, and the key covers only the objects and actions the integration uses, with an owner and a rotation date. AI agents read only the fields the task requires, as I detailed in AI agents.

Roles and responsibilities: who decides, who configures and who approves

The matrix works when each decision has an owner. The roles below fit the structure of sponsor, domain owners and data steward described in data governance.

Role	Responsibility	Approves	Executes
Board	Sponsors the matrix and rules on exceptions	The profile matrix and the admin list	Nothing in the system
Revenue operations or CRM admin	Designs and maintains the profiles	Routine requests within the matrix	Configuration, offboarding and quarterly review
Area managers	Answer for their own team’s access	Team access requests and recertification	Check the team list in the review
IT and security	Sign-in through the corporate account, second authentication factor and integrations	New integrations and key scopes	Key rotation and storage of the audit log
Data protection officer (DPO)	Links the matrix to the personal data inventory	Rules for sensitive fields and third-party access	Receives the review minutes and handles incidents
HR	Reports hires, transfers and departures	Nothing in the system	Includes the notice to the admin in offboarding

Common mistakes in CRM permission management

Everyone is an admin

The full access granted during implementation never goes back, and many people spend years able to delete fields and export everything. The fix starts with an admin list approved by the board.

Profile copied from another user

The manager asks for the new hire’s access to be “the same as so-and-so’s“, and so-and-so has accumulated permissions from three roles. The request points to a profile in the matrix, and anything outside it becomes an exception with a deadline.

Shared login

A single account for the interns or the partner erases the authorship of each action. In the audit, the company knows someone exported the database and does not know who.

Former employee with active access

The former employee keeps getting in through the mobile app because the session stayed open, and the license is still being paid months later. HR’s notice on the day of departure closes the door.

Integration running on a person’s password

The analyst’s automation uses their login, and when they leave the company chooses between keeping a former employee’s credential alive or stopping the process. A service user from day one avoids the choice.

Team enablement: who needs to learn what

The admin learns to configure profiles, read the audit log and run the quarterly review. Managers learn to request access through the matrix, recertify their team and use CRM reports instead of exports. The sales team learns what can leave the system and what does not go into free text, and HR learns to notify the admin at the right time.

30-day roadmap for leadership

1. Week 1: map the current state. Pull the active users with profile and last access and cross-check them against HR’s payroll.
2. Week 1: cut what is already wrong. Deactivate former employees, close shared logins and reduce admins to the justified minimum.
3. Week 2: write and approve the matrix. Start from the profile table, adjust it to your CRM’s objects and take it to the board, with the DPO and IT reviewing.
4. Week 2: flag sensitive fields. Define with the DPO who sees and who edits each field with personal, financial or strategic data.
5. Week 3: lock down export and deletion. Restrict both actions to the matrix profiles, turn on the audit log and set up the export alert.
6. Week 3: inventory the integrations. Replace those running on a person’s login with service users and name an owner for each key.
7. Week 4: tie offboarding to HR. Add the notice to the admin and the CRM checklist to employee departures and to the end of partner contracts.
8. Week 4: train and schedule the review. Present the matrix to managers and the team and book the first quarterly review, with minutes for the DPO.

The matrix protects the book when managers request access by the rule and the team understands why not everything leaves the system. That is the work of the in-company CRM adoption training, delivered on the CRM and profiles your company already has. The company leaves with the CRM best practices guide, which includes the profile matrix and the export rules, and the account portfolio and database management manual, with the offboarding checklist and the access review routine.

Frequently asked questions

What are CRM permissions?

They are the rules that define, for each user profile, which records the user sees and what they can edit, export and delete. They are grouped into role-based profiles, such as SDR, salesperson, manager and admin, and each person gets the profile of the role they hold.

Should a salesperson see the whole customer database?

In most B2B operations, the salesperson sees all companies, to check whether an account already exists before creating another, and only the deals in their own book. Values, discounts and terms from other books stay outside their profile.

How do you stop a salesperson from exporting the database before leaving?

Restrict export to a few profiles, turn on the audit log and set up an alert for unusual volumes. The contract and the code of conduct state that the database belongs to the company, and HR notifies the admin on the day of departure so access ends with the employment.

How often should CRM access be reviewed?

Every quarter, with each manager confirming their own team’s access and the board reviewing the admin list. Transfers and departures are handled on the day they happen, without waiting for the review.

What does data protection law require about access to CRM data?

Brazil’s LGPD, art. 46, requires technical and administrative security measures against unauthorized access, and art. 49 requires systems structured to meet security and governance requirements. The company needs to demonstrate these measures, and the approved matrix, the audit log and the review minutes serve as evidence, validated with legal and the DPO.

How do you prepare the team to work with tighter permissions?

Explain before changing anything, showing each role what they keep doing and which report replaces the exported spreadsheet. Train managers first, because they request access and recertify the team, and agree with HR to present the export rules at hiring.