CRM permissions are the quiet source of churn, data leakage, and audit findings. Most CRMs ship a shallow role model that forces admins to either over-grant and hope, or build complex workarounds that break the moment a reorg lands. This page is the operating playbook: role matrix, RBAC, field-level, record-level, team-based hierarchy, and the audit evidence a US compliance review will ask for.
US revops and admin teams running CRM at 50 to 500 seats hit the same cluster of permissions problems. The sales ops lead inherited a Salesforce profile tangle from a previous admin and nobody wants to touch it. The HubSpot team has three users with Super Admin because the permission model does not express what they actually need. The Dynamics team is one reorg away from a cross-territory data-leakage finding in audit. The six pain points below show up on nearly every US CRM permissions call.
The common pattern in HubSpot, Pipedrive, and Zoho installs: 4 to 8 users carry Super Admin because the standard roles do not express the actual job. The sales ops lead needs to edit workflows but not billing. The marketing ops lead needs to edit lists but not merge accounts. The result is a security review finding that a dozen users can effectively do anything. Strkr ships 30-plus granular permissions grouped into roles, so the admin pool actually matches the job responsibilities.
A pattern: a company adds a compensation-plan field to the opportunity record, intends it to be visible to managers only, forgets to configure the field-level visibility. Three months later the whole sales team is reading each other's commission rates. Strkr field-level permissions are enforced at the API layer, not just the UI, so a curl against the opportunity record from a rep account cannot return a field the rep is not supposed to see.
Territory realignments happen on most sales teams twice a year. The record-level sharing in Salesforce and the territory logic in Dynamics both require admin work on every realignment, and the work is error-prone. Strkr runs record-level RLS tied to team membership plus manager hierarchy plus explicit record sharing, so a reorg propagates through the visibility rules in one admin action instead of 40.
SOC 2 and HIPAA audits specifically ask for permission-change audit trails. Several midmarket CRMs retain roughly 30 days of permission-change history, which is not enough for annual audit scope. Strkr retains permission-change audit history on the standard retention clock (currently 365 days on the paid tier, extendable per plan), with user, timestamp, before, after, and reason-code where captured.
A new sales rep starts Monday. The admin assigns the role, sets the team, assigns the manager, configures the territory, grants access to the right dashboards. The flow takes 90 minutes per new hire if the admin remembers every step. Strkr runs JIT provisioning from the SSO identity provider claims, so a user that lands with the right group assignments gets the right role, team, and territory on first login. The admin runs an exception review, not a setup checklist.
Most teams need a hybrid model: workspace roles define the baseline (what a Sales Rep can do by default), and per-entity membership overrides (this specific account has these specific people with these specific permissions). CRMs that only express the workspace-role side force admins to build custom-field workarounds. Strkr ships hybrid: role defines baseline, membership link table defines overrides with per-entity role strings.
The permissions model below is what Strkr ships in production. It is the model we recommend US revops admin teams design toward, whether on Strkr or elsewhere. The cards walk through the layers in order.
The foundation is a flat list of boolean permissions, one per capability. "accounts.view_all", "opportunities.edit_amount", "workflows.publish", "billing.manage", "users.invite", and so on. Strkr ships 30-plus boolean permissions covering CRM, Marketing, Projects, Docs, Admin, Flow, and Reports. Every permission check in the application resolves against this flat list.
Standard roles are named bundles over the boolean list. Sales Rep, Sales Manager, RevOps Admin, Marketing Manager, Project Lead, Account Executive, SDR, Customer Success, Finance, Executive, Read-Only. Each role is a set of boolean flags that match the actual job. Strkr ships the standard roles as defaults, and admins can clone and customize per tenant.
Workspace membership is where the role attaches to the user. In a multi-tenant deployment a user can hold different roles in different workspaces (Admin in the staging workspace, Sales Rep in production). Strkr enforces workspace membership at the JWT claims layer, which is where every API request lands.
Teams in Strkr express the manager-report hierarchy. The manager_id self-reference on the user record lets BFS traversal resolve "who reports to this manager, directly or indirectly." Record-level visibility rules can condition on team membership and manager-chain membership rather than hardcoded territory lists.
Per-entity membership (the project-member pattern) lets a account, opportunity, or project grant explicit permissions to users beyond their workspace role. A strategic account might have 7 named members: the AE, the CSM, a solutions engineer, the VP, and three executive sponsors. The membership table carries a text role string that resolves to additional permissions on that specific record.
Postgres row-level security policies filter every query against the current user's claims plus team membership plus explicit per-entity membership. A rep running "SELECT * FROM accounts" sees only accounts they can access; a manager sees reps plus their reports' accounts; an admin sees all. The gate is enforced at the database layer, which is the only place a determined attacker cannot bypass.
Field-level visibility rules gate specific fields on specific records to specific roles. The compensation plan field on the opportunity is visible to Sales Manager and up. The forecast commit field is visible to the owning rep and the manager chain. The gate is enforced on the API response, not just the UI, so a direct API call cannot return a field the caller is not supposed to see.
Permission changes write to the audit log with user, timestamp, before, after, and reason-code where captured. Role assignments, membership additions, workspace changes, boolean permission edits all land in the log. The retention clock runs 365 days on the paid Strkr tier with extensions available per plan to meet US SOC 2, HIPAA, and state-regulatory retention requirements.
Strkr integrates with SAML and OIDC identity providers. User claims from the IdP (department, title, manager, security groups) map to Strkr role, team, and permission assignments on first login. The admin reviews exceptions rather than running a 10-step onboarding checklist per new hire. SCIM provisioning is available for enterprise customers that need push-based lifecycle.
The role matrix is the single document a US CRM admin team should maintain and version. The cards below describe what goes in each cell, who owns it, how often it refreshes, and what to put in the quarterly review.
The role list should match actual jobs in the organization, not the vendor-shipped defaults. For most US SaaS companies the list is: Sales Rep, Sales Manager, SDR, SDR Manager, AE, Customer Success Manager, Customer Success Lead, Marketing Manager, Marketing Ops, RevOps Admin, Finance, Executive, Read-Only, External Collaborator. Vertical B2B adds specialty roles for the field motion.
Read scope is expressed as "own + team + direct reports" or "all accounts in territory X" or "all records in the workspace." The expression needs to be unambiguous and testable; the admin should be able to run a test query as that role and verify the row count matches the expectation. Strkr's RLS makes this testable from the admin console.
Write scope is often narrower than read scope. A manager might read all team-member records but only write to the "manager coaching notes" field, not the deal amount. The write-scope cell should list the fields with write access and the state transitions allowed. Strkr enforces write-scope at the API layer, which means the UI can trust the enforcement rather than reimplement it.
Admin capabilities include workflow editing, custom field creation, user invitation, role editing, report publishing, workflow publishing, data import, and integration configuration. The matrix should express which admin surfaces each role can touch, with explicit exclusions where appropriate (RevOps can edit workflows but not billing).
Export permissions deserve their own column because the most common data-exfiltration path from a CRM is a legitimate user running a legitimate export. The matrix should express which roles can export, what formats, with what row-count caps, and with what logging. Strkr caps exports with per-role row ceilings and logs every export with filter criteria.
The quarterly audit asks: did any role expand or contract in scope, did any new permission get introduced that lacks a cell in the matrix, did any user get granted an exception that should become a role change, did any role become redundant with another. The audit should produce a changelog, which the compliance team can reference during the annual review.
A fresh admin inheriting a US CRM install from a predecessor should run the audit below in the first 30 days. The cards describe common mistakes and how to fix them without breaking the daily motion.
Review the Super Admin list on day one. Most installs have 5 to 10 Super Admins because the role model was too shallow to express the actual needs. The fix: build granular admin roles (Workflow Admin, User Admin, Billing Admin, Integration Admin) and demote the Super Admins to the appropriate specific role.
Run a sample test: log in as a rep in region A, query records tagged region B, see what comes back. The common finding is that the "my records plus my team" sharing was never configured, so the rep can read the full account table. The fix: tighten record-level visibility to the correct scope and test with sample accounts in each region.
Review the field list for sensitive content: compensation, forecast commits, confidential notes, pricing exceptions, legal flags. Each should carry an explicit field-level visibility rule. The fix: audit sensitive fields quarterly, build field-level rules for each, test by querying as a non-privileged user.
The baseline for US SaaS is SSO plus MFA. Admin accounts without MFA are an immediate SOC 2 finding. The fix: enforce SSO for all users at the workspace level, require MFA for every admin, run the exception review for the handful of accounts that cannot SSO (board members, external auditors).
SOC 2 Type II audit scope typically requires 365 days of permission-change evidence. CRMs that retain only 30 days of permission history force the admin team to assemble evidence from backup copies and support tickets. The fix: ensure retention is set to the audit window, extend if necessary, or move to a CRM that retains the window natively.
Review the active user list against HR's departed-employee list weekly. The common lag is 2 to 4 weeks between HR offboarding and CRM deactivation, which is 2 to 4 weeks of continued access by former employees. The fix: automate offboarding via SCIM or SSO group changes, or run a weekly reconciliation report that flags users without recent HR activity.
Salesforce is the deepest CRM permissions model on the market and the usual benchmark. Here is the head-to-head on the capabilities US admin teams care about.
| Feature | Strkr | Salesforce (Sales Cloud Enterprise) |
|---|---|---|
| Boolean permissions | 30+ granular flags grouped into roles | User Permissions on Profile plus Permission Sets |
| Standard roles | 11 shipped roles, clone and customize per tenant | Profile plus Role plus Permission Set plus Group plus Queue |
| Record-level visibility | Postgres RLS on team plus manager-chain plus explicit membership | Sharing Rules plus Role Hierarchy plus Manual Sharing |
| Field-level visibility | Per-role per-field, enforced at API layer | Field-Level Security on Profile |
| Per-entity membership | Membership link table with text role strings | Account Teams, Opportunity Teams, Case Teams |
| Audit log retention | 365 days on paid tier, extendable per plan | 180 days default, extendable with Field Audit Trail |
| SSO and SCIM | SAML, OIDC, SCIM on paid tiers | SSO Standard, SCIM available on Shield |
| JIT provisioning | Role, team, territory assigned on first login from IdP claims | JIT via SAML, deeper setup required |
| Admin learning curve | 1 to 2 week ramp for a competent revops admin | Admin certification; typical ramp 3 to 6 months |
| Pricing basis | Flat per-seat with permissions included | Shield add-on required for full audit retention |
The common thread: the permissions model is deep enough to express actual jobs and shallow enough that a competent revops generalist can run it. The playbooks below are motions on live customer accounts.
A mid-market SaaS company running Strkr pulled the SOC 2 Type II permissions evidence in 2 days of admin time, versus the 3-week scramble the prior Salesforce admin remembered from the previous audit. The evidence included 365 days of permission-change audit log, role matrix with scope expressions, sample user access tests, departed-user offboarding log, and SSO plus MFA enforcement evidence.
An enterprise B2B team ran a mid-year territory realignment affecting 60 reps across 8 regions. The Strkr admin updated the team structure, which propagated through record-level RLS, manager-chain visibility, and per-entity membership automatically. The whole realignment took 20 minutes of admin time versus the 40-hour project the previous Salesforce install would have required.
A healthcare SaaS tenant required HIPAA-grade field-level permissions on fields carrying protected health information. Strkr field-level visibility was configured to restrict PHI fields to a role (CSM) with explicit per-entity membership overrides for CSM leads. The admin tested with a non-CSM user running a direct API query against the account record and verified the PHI fields did not appear in the response. The HIPAA audit cleared on the first review.
A wealth-management firm needed advisor compensation plans visible to the branch manager and firm leadership but invisible to the advisor themselves. Strkr field-level visibility was configured on the compensation plan fields with the branch manager chain granted read access. The field disappeared from the advisor UI and did not return from direct API queries from an advisor session. The audit evidence satisfied the firm's internal control review.
A Series C B2B team configured JIT provisioning from the Okta identity provider: Okta groups mapped to Strkr roles, department attribute mapped to team, manager attribute mapped to Strkr manager_id. A new hire landed on Monday with the right role, team, manager, and territory on first login. The admin confirmed the exceptions in a 10-minute review versus the 90-minute per-hire setup the previous admin ran.
See how Strkr ships granular boolean permissions, standard roles, team hierarchy with manager-chain, per-entity membership, Postgres RLS, field-level visibility, and 365-day audit retention on the flat per-seat tier.
The standard list for a mid-market US SaaS install is 11 to 14 roles: Sales Rep, Sales Manager, SDR, SDR Manager, Account Executive, Customer Success Manager, Customer Success Lead, Marketing Manager, Marketing Ops, RevOps Admin, Finance, Executive, Read-Only. Each role should have an explicit scope expression for record-level read and write, an explicit field-level visibility rule for sensitive fields, and an explicit admin-capability list. The matrix should be maintained as a document, versioned, and audited quarterly against actual production assignments.
Strkr runs Postgres row-level security policies that filter every query against the current user's claims plus team membership plus explicit per-entity membership. The RLS is enforced at the database layer, which means a direct SQL query (even one the application layer did not generate) cannot return rows the user is not supposed to see. Field-level visibility is enforced at the API serialization layer, which means a direct API call cannot return fields the caller is not permitted to read. The combination gives a defense-in-depth posture that satisfies SOC 2 Type II controls.
Strkr retains permission-change audit history for 365 days on the paid tier, with user, timestamp, before, after, and reason-code where captured. Extensions beyond 365 days are available per plan to meet specific state-regulatory retention requirements or longer SOC 2 audit windows. The audit log covers role changes, team membership changes, per-entity membership changes, boolean permission edits, SSO configuration changes, and admin console actions. The evidence is pullable in CSV or JSON for ingestion into a GRC tool.
Departed-user offboarding runs through the SSO identity provider by default. When Okta, Azure AD, Google Workspace, or OneLogin deactivates the user, Strkr sessions terminate at the next token refresh. For tenants running SCIM provisioning, the deactivation push triggers an immediate Strkr-side suspension. For tenants not on SCIM, Strkr runs a weekly SSO reconciliation report that flags any Strkr user not present in the IdP, which the admin reviews and suspends. The reconciliation report is one of the standard SOC 2 evidence items.
Yes. Strkr integrates with Okta, Azure AD, Google Workspace, OneLogin, Ping, and any SAML 2.0 or OIDC-compliant provider. Just-in-time provisioning maps IdP claims (department, title, manager, security groups) to Strkr role, team, and territory assignments on first login. SCIM 2.0 provisioning is available on paid tiers for enterprise customers that need push-based lifecycle. Workspace-level SSO enforcement means a user cannot bypass the IdP by using a password. MFA requirements inherit from the IdP, with Strkr-side MFA available as a fallback for tenants that need it.
Salesforce ships the deepest permissions model on the market, which is both a strength and a cost. The Salesforce model layers Profiles, Roles, Permission Sets, Permission Set Groups, Sharing Rules, Role Hierarchy, Manual Sharing, Account Teams, Opportunity Teams, Case Teams, Public Groups, and Queues; the full model takes a certified admin to operate confidently. Strkr ships a flatter model with 30-plus granular boolean permissions, 11 shipped roles, team hierarchy with manager-chain, per-entity membership, Postgres RLS, and field-level visibility. The Strkr model is deep enough to express the same scope expressions that most Salesforce installs actually use and shallow enough for a competent revops generalist to run without the certification path. The pricing basis is also different: full audit retention is included in Strkr's paid tier, where Salesforce Shield is a substantial add-on.
No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.
