In a hypothetical company, a newcomer cannot see a required deal. Someone grants full access to get things working quickly. That solves the problem rather like removing every door to fix a draught.
A more sustainable approach is to describe the work and match access to it.
Start with a task matrix
Bitrix24 roles separate CRM permissions; the feature is not available on every plan. Configuration is described in the official guide.
Create a short matrix: what the salesperson reads, creates, changes and hands over. Examine other people’s deals, export, deletion and settings separately. Everyday work and system administration need different justifications.
Do not blindly copy a predecessor’s role: it may have accumulated years of exceptions.
Treat the first working day as a test
Using the agreed role, check:
- creating a test enquiry;
- opening an owned record and someone else’s;
- changing permitted information;
- viewing the related contact;
- attempting an action that should be unavailable.
Test both successful work and correct restrictions. Otherwise, missing access emerges in front of a customer while excessive access stays unnoticed.
If access differs from expectations, review role assignments with the administrator. Change the specific cause, then repeat the check.
Make changes manageable
Decide who approves a new role, who configures it and how the result is recorded. For temporary work, set an access review date.
Review roles after department transfers and changes of responsibility. Job titles change faster than old permissions disappear by themselves.
Prepare a list of the employee’s working actions and discuss a Bitrix24 audit with QQDev. That is more concrete than asking for everything: a clear role supports work and keeps access management purposeful.