Fulcrum Docs Guides

Roles and permissions in Fulcrum CRM

Understand the built-in Fulcrum CRM roles, edit what each role can see and do, preview the app as a role, create custom roles and assign them to team members.

Roles control what each person can see and do in Fulcrum CRM, from viewing contacts to exporting data. The sidebar only shows the areas a person's role allows, so it's simpler for everyone.

Built-in roles

Every workspace starts with six roles: Owner, Admin, Manager, Member, Limited and Read-only. Owner and Admin are locked. You can adjust the others, or create your own.

Edit a role

  1. Go to Settings → Roles & Permissions and pick a role.
  2. For each area of the CRM, set the level: None, View, Edit or Manage.
  3. Set the record scope, which controls whose records the role can reach, and tick any extra capabilities, such as Export.
  4. Select Preview as this role to see the app the way that role would before you save.
  5. Save your changes.

To start a new role, use New role, or duplicate an existing one and adjust it. Reset to default undoes your changes to a built-in role, and Delete role removes a custom one.

Sensitive capabilities

Some actions are kept to owners or admins by default:

  • Exporting contacts and activity history: owner only.
  • Deleting contacts in bulk: owner only.
  • Merging duplicates: owners and admins.
  • Reassigning a contact to someone else: needs the reassign capability.
  • Creating and managing MCP tokens for AI tools: owners and admins.

Grant these to other roles only when there's a clear need.

Assign roles to people

  1. Invite people with Invite User in Quick Actions, or from Settings → Teams & Members.
  2. In Teams & Members, set each person's role on their member row. This is also where you limit which pipelines a person can see.

Keep a record

Owners and admins can check two records. Settings → Activity log shows who did what (exports, edits, emails, calls, sign-ins and AI Pal actions) per person and day. Settings → Audit log records permission and token changes, restores and denied access attempts. AI Pals always act within their owner's permissions; see Calls and AI. Fulcrum Mail workspace roles are separate; see Invite and manage members.

Test the role from the recipient’s perspective

Use a representative member account to check the intended record visibility and allowed actions. Confirm read, edit, export, reassignment and administration separately. An owner’s view cannot demonstrate what a restricted member can see.

Review access after team changes

When someone changes teams or leaves, inspect roles, groups, connected accounts and integration credentials. Removing a role is different from revoking a session or an independent API token. Keep the permissions record aligned with the actual people responsible for each workflow.

Last updated