Roles and access
Login, roles and permissions enforced in the database, so each person sees and changes only what their job needs, with a record of who changed what.
Once finance, sales, operations and contractors share one tool, someone has to decide who sees margins, pay and customer data. We write it down as a role matrix, agree it with you, and set it in the database as well as on screen. Staff can sign in with Google Workspace or Microsoft 365, and removing a leaver takes one step. Access in the console we built for a UK consumer brand is set by role.
For Founders, COOs and finance leads whose CRM, internal tool or client portal is about to open to more staff, contractors, franchisees or clients.
You need this when
- 01
Everyone with a login sees every figure, including margins and pay.
- 02
Contractors and former staff still have logins nobody remembers granting.
- 03
When a record changes, nobody can say who changed it or when.
What’s included.
Role matrix
Every role listed against every screen, record and action: view, edit, approve and export.
Login and sign-in
Email login with two-factor, or sign-in through Google Workspace or Microsoft 365 so staff use their work accounts.
Database-level rules
Row-level security, so each role receives only the rows and fields it is allowed.
Audit log
A record of who changed or exported sensitive data, and when.
Admin panel
Add people, change roles and remove access in one place, without a developer.
Joiners and leavers
A checklist and a current list of who has access to what, ready for a review you run each quarter.
How it runs.
On a new build, login and roles work on staging by week 3; adding them to an existing tool runs as a Sprint of 1–4 weeks.
- 01 · List roles and data
We list who uses the tool and which data is sensitive: margins, pay, customer details, contracts.
- 02 · Write the matrix
Each role against each screen, record and action, agreed with you before anything changes.
- 03 · Enforce and test
Rules set in the database and the interface, then tested by logging in as each role.
- 04 · Hand over the controls
Your admin adds, changes and removes access from the admin panel, with every change logged.
Deliverables
- Role matrix
- Login with two-factor, and single sign-on where needed
- Row-level security policies in the database
- Audit log
- Admin panel for users and roles
- Joiner and leaver checklist
- Access report for periodic reviews
- Docs: how roles work and how to change them
Works with
What buyers ask.
Isn’t hiding a figure in the interface enough?
No. If the data reaches the browser, anyone who opens the browser’s developer tools can read it. We filter it in the database, before it is sent.
Can you add roles to a tool we already have?
Often, yes. We review the code and database in week 1 and say whether roles can be added safely or whether parts need rebuilding first.
Does this make us compliant with UK GDPR or GDPR?
No tool does that on its own. Roles, an audit log and leaver checks support your obligations; your data protection lead decides what is required.
Pairs well with
One AI task built into your app or internal tool, tested on your own data.
Let’s build your pipeline.
Tell us what you sell, who buys it and roughly what a customer is worth to you. We reply with questions, then a written proposal.