RBAC for Your CRM: Locking Down Who Sees What

Start with a simple grid: every role that touches the CRM (AE, SDR, sales manager, RevOps admin, finance, customer success) against every sensitive object (opportunities, contracts, commission fields, discount approvals, exported reports). For each cell, decide read, write, or no access. Do this on paper or in a spreadsheet before you open the CRM's permission settings.

Most teams find the grid exposes access nobody remembers granting: an SDR with edit rights on closed-won contract values, or a customer success rep who can see every rep's commission split. Those aren't malicious grants. They're leftovers from someone being added to a role and inheriting whatever that role's profile had at the time.

Job-title-based profiles drift the moment someone's role changes slightly, which is constantly. Object-level and field-level permission sets hold up better: a base profile that covers what every rep needs, plus additive permission sets layered on for specific responsibilities (deal desk approval, forecast submission, partner deal registration).

The fields worth locking down hardest are the ones tied to compensation and pricing: discount percentage, commission rate, contract value, and margin. Restrict those to the smallest group that needs them, and audit that group separately from the general access review.

Single sign-on through a provider like Okta, Entra, or Google Workspace does more than remove another password. Paired with SCIM provisioning, it ties CRM access to employment status: when HR marks someone terminated, their CRM login deactivates the same day instead of waiting for someone to remember to revoke it manually.

Manual deprovisioning is the most common access leak in a growing sales org. A contractor's engagement ends, their laptop gets returned, and their CRM login sits active for months because offboarding a laptop and offboarding a CRM account happen on different checklists.

An annual review finds problems a year after they started. A quarterly one, run by a named owner (usually RevOps or IT), catches role changes and departures while the context is still fresh. The review should answer one question for every active login: does this person's current role still justify this access.

If you're heading toward a SOC 2 audit, a platform like Vanta or Drata can automate much of the evidence collection instead of someone screenshotting a user list every quarter, which helps the review happen on schedule.

A few patterns show up again and again once teams start reviewing access seriously:

• Shared logins for integrations or reporting tools, so nobody can tell which human made a change.
• Every VP getting admin rights by default, regardless of whether their job touches CRM configuration.
• Service accounts and API keys left out of the access review entirely, even though they often hold broader permissions than any human user.
• Contractors and agency partners kept active past their contract end date because nobody set an expiration.

Picture a ten-person sales org with three AEs, two SDRs, a sales manager, a RevOps admin, and a finance contact who pulls commission reports. Before the grid exercise, all three AEs had the same admin profile the first AE was given two years earlier, which happened to include export rights on the full customer list and edit access to every rep's commission field. That's not unusual. It's what happens when a profile gets copied forward instead of rebuilt.

After mapping roles, the AEs move to a base profile with edit rights on their own deals only, export gets restricted to the sales manager and RevOps admin, and commission fields become visible only to the person they belong to plus finance. None of that required new software. It required someone sitting down with the grid and actually changing the profiles, which is usually the step that gets skipped in favor of buying a tool first.