Assign Member Roles
Change which role a workspace member has.
Assign roles when a teammate joins, changes responsibility, or no longer needs broad access.
Roles should describe the work a teammate is allowed to do. A sales teammate may need CRM and estimates. A finance teammate may need invoices, payments, and reports. A contractor may only need project or task access.
Change A Member Role
- Open Settings.
- Go to Access Control.
- Open the Members tab.
- Find the member.
- Choose the new role from the role selector.
- Wait for the page to save and refresh.
- Ask the teammate to refresh their browser if the navigation does not update immediately.
The new role controls what the member can view or manage across the workspace.
Role changes can affect navigation, records, reports, settings, integrations, and customer-facing actions. Make the change when the teammate can refresh and confirm access, especially for finance, HRM, or admin work.
If the member is currently working in the app, tell them before you reduce access. A role change can remove pages from the sidebar, hide actions on open records, or prevent a save if the page was already open.
Before Changing A Role
Check whether the role includes sensitive access such as billing, domains, API keys, payment gateways, app credentials, or permission management.
Also check whether the member has direct permissions. Direct permissions remain separate from the role, so a member can keep extra access after their role changes unless you remove those permissions.
If the role change is part of offboarding or a sensitive handoff, review API keys, mailbox ownership, workflows, dashboard ownership, and assigned records in addition to the member role.
For finance and HRM roles, confirm whether the member should only view records or also create, approve, export, delete, or manage settings. Viewing a section and managing that section are different access decisions.
Common Role Changes
- New teammate: assign the smallest role that lets them start work.
- Manager promotion: assign a role with team, report, and approval access only where needed.
- Finance handoff: add finance permissions before removing the previous owner’s access.
- Contractor offboarding: move the member to a restricted role or remove the member from the workspace according to your internal process.
Test The Member Experience
After the save, ask the teammate to check:
- The sidebar only shows the sections they should use.
- They can open one record they are expected to work on.
- They can perform one required action, such as creating a task, editing a contact, sending an invoice, or approving a leave request.
- They cannot open a sensitive page that should be restricted.
Do not verify access only from the admin view. The admin page confirms the role assignment, but the teammate's own session confirms the actual working experience.
Verify the Result
After changing a role, check:
- The member appears with the new role in the Members tab.
- The permission matrix includes the permissions the member needs.
- Direct permissions are still intentional.
- The audit tab shows the role change.
If the member still cannot access the page, confirm the module is enabled and the feature is included in the current plan.
Ask the teammate to test one expected page and one action after the role change. Viewing a page and performing an action may require different permissions.