Settings & team
Create a custom role and hide sensitive fields
The four built-in roles cover most teams, but some cases need finer control: a field rep who sees only their own deals and cannot export, or an outsourced support team that must not see a financial field. In Naffes CRM you build that with a custom role plus field visibility rules.
Understand the permission levels first
| Level | Meaning | Example |
|---|---|---|
| Own | Only records the user owns | A rep edits their own deals and no one else's |
| Team | Records of members of their team under Teams | The Riyadh team lead sees that team's deals |
| All | Every record in the workspace | The sales director |
Each view, edit or delete permission is granted at one of these levels, alongside separate permissions such as bulk delete, export, calling, invoice access and administer workspace.
Steps
Open Roles
Go to Settings → Team & Access → People → Roles & Permissions. You need workspace admin rights.
Create the role
Click New role, enter a Role name such as Field rep, and click Create.
Pick permissions
Click the Edit role icon. Use Search permissions (for example delete contacts), tick only what the role needs, and click Save. Reserve administer workspace for people who run settings, invitations and billing.
Hide sensitive fields
Open the Field visibility tab under People. Choose the Resource (such as deals or contacts), then for each field set View and Edit to allowed or blocked for the role. Blocking View drops the field from the lists and records that role sees; blocking Edit makes the server reject changes to it from that role.
Assign the role
From Users, open Edit user and assign the new role, or choose it when sending an invitation.
Rules that decide the outcome
- Hiding always wins. If a user holds several roles and one hides the field, the field is hidden.
- Workspace admins are exempt. They always see and edit every field, so do not test a rule with an admin account.
- The server enforces the rule on reads and writes, not just the screen, so it cannot be bypassed through the API.
- The Naffes Smart assistant follows the same permissions. A rep limited to their own deals cannot read or change other deals through the chat.
- Built-in roles (Owner, Manager, Member, Viewer) keep their names and cannot be deleted, but their permissions can be edited.
Verify before rolling out
Assign the role to a non-admin test user, then open the deals list, one record and try an export. Is the field gone? Is export available as intended? If a field is truly sensitive, leave the export permission off that role altogether and inspect an exported file yourself before rolling out. Once the role is live, the audit log lets you review what its holders do to records.