Authorization and permission evaluation

Product Zbix CRM · Version 1.2.0 · Source reviewed · Reviewed 28 October 2026
Audience Administrators and implementation teams · Deployment All supported models

Overview

Zbix CRM separates identity roles, module actions and record visibility. Legacy identity roles are admin, manager, sales and readonly. A custom module role provides eight independent actions for each module plus own, team or organization visibility. One explicit module-role assignment replaces the legacy action policy; assignments are not combined as a union of multiple roles.

Purpose

Use this model to design least-privilege access and explain why a user can see a menu but cannot perform a particular operation.

Prerequisites

• Administrator identity for managing roles and assignments.

• A written description of the actions and records required by the business role.

Procedure

1. Open Module Permissions and inspect the role’s complete action matrix. Evaluate View separately from Create, Edit, Delete, Assign, Export, Approve and Manage Settings.

2. Review the visibility scope for each module. Own uses the record owner; Team includes qualifying team membership; Organization remains inside the current organization.

3. Check the user’s explicit assignment and effective access. Removing the assignment restores the legacy policy, so review that fallback before removal.

4. Check access to parent and source records as well as the target module. Attachments, documents, related CRM records and report execution intersect these permissions.

5. Verify representative actions with an appropriate test account in an approved test environment, then document the intended role behavior.

Expected result

The role grants only the required actions and record scope, and users understand which permission is missing when an operation is denied.

Screenshots and diagrams

Important notes

• Team membership expands eligible team visibility but does not itself grant actions or administrator identity.

• Identity and access administration requires the admin identity role; a custom Manage Settings action is not a substitute.

• A role with an inactive or invalid explicit assignment does not silently regain legacy privileges.

• License and capability checks may further restrict an otherwise permitted action.

Troubleshooting

• A record disappears after a related record is restricted: review the full relationship and source visibility chain.

• A shared report returns fewer records for another user: sharing the definition does not share the owner’s data access.

Related articles

• CRM and commercial data relationships

• Troubleshoot report totals and missing records

• Authentication and sign in architecture