Guide to Role-Based Access Control - GTG CRM

1. Accessing Permissions

Step 1: Log in to GTG CRM

Log in to your GTG CRM account.

Step 2: Open the Settings Menu

Look at the left-hand menu, scroll to the very bottom, and click on Settings.

Step 3: Select Permissions

In the Settings menu, click on Permissions.

2. Viewing Default Roles

GTG CRM provides 3 default roles:

Administrator

Attribute	Value
Name	Administrator
Permissions	Full access on the platform
Description	Highest level of access, manages the entire system
Settings	Automatically has all Settings permissions (from 5/2026)

Marketing Manager

Attribute	Value
Name	Marketing Manager
Permissions	Manages marketing, views reports
Description	For marketing team managers

Marketing Staff

Attribute	Value
Name	Marketing Staff
Permissions	Performs marketing tasks
Description	For marketing employees

3. Creating a New Role

Step 1: Click "Add Role"

In the top right corner of the screen, click the "Add Role" button.

Step 2: Name the Role

Enter a name for the new role (e.g., "Sales", "Support", "Warehouse").

Step 3: Add Description (Optional)

A brief description of this role for easier management later.

Example: - Name: Sales - Description: Sales representatives, manage customers and orders

4. Customizing Permissions

Permission Structure

Each module has distinct permissions:

Module
├── Create
├── View
├── Update
├── Delete
└── Other special permissions

Toggling Permissions

Use the toggle switches to enable/disable individual permissions: - Toggle ON: Allowed - Toggle OFF: Not allowed

Permissions by Module

Automation Workflow

Permission	Convention A	Description
Create	AUTOMATION_WORKFLOW_CREATE	Create new workflows
View	AUTOMATION_WORKFLOW_VIEW	View workflow list and details
Update	AUTOMATION_WORKFLOW_UPDATE	Edit workflows
Delete	AUTOMATION_WORKFLOW_DELETE	Delete workflows

Landing Page

Permission	Description
Create	Create new landing pages
Update	Edit landing pages
Publish	Publish landing pages
Unpublish	Unpublish landing pages
Delete	Delete landing pages
Modify Custom Domain	Set up custom domains

Marketing

Permission	Description
View Social Posts	View social posts
Manage Campaigns	Manage campaigns

CRM

Permission	Convention A	Description
View All Contacts	CRM_VIEW_ALL_CONTACT	View all contacts
View Object	CRM_OBJECT_VIEW	View contact details

Email & Messaging

Module	Permission
Email	Create, Send, View, Delete
Messaging	View, Reply, Manage

Billing

Permission	Convention A	Description
View Invoice	BILLING_VIEW_INVOICE	View invoices
Add Payment Method	BILLING_ADD_PAYMENT_METHOD	Add payment methods

Settings / Workspace

Permission	Convention A	Description
Manage Users	WORKSPACE_ACTION_USER	Manage workspace users
View Billing	WORKSPACE_VIEW_BILLING_MEMBER	View billing information

Saving the Role

After customizing, click "Save" to create the role.

5. Assigning Roles to Users

Step 1: Open "User Management"

"User list" here shows all users in the workspace.

Step 2: Find User

Locate the user you want to assign permissions to in the list.

Step 3: Select Role

In the "Role" column, click the dropdown to open the list of roles.

Step 4: Assign Role

Choose the appropriate role from the dropdown. The role will be assigned immediately.

Step 5: Confirm

Verify that the role has been assigned correctly.

6. Managing Roles

Editing a Role

1. Click on the role to edit
2. Change permissions
3. Click Save

Deleting a Role

1. Click on the role to delete
2. Click Delete Role
3. Confirm deletion

Note: Default roles (Administrator, Marketing Manager, Marketing Staff) cannot be deleted.

Practical Examples

Example 1: Create "Sales" Role

Objective: Sales representatives need to manage customers, send messages, and emails.

Granted Permissions: - CRM: CRM_VIEW_ALL_CONTACT, CRM_OBJECT_VIEW - Messaging: All - Email: All - Automation: AUTOMATION_WORKFLOW_CREATE, View, Update - Landing Page: Create, Update, Publish, View - Marketing: View only

Denied Permissions: - AUTOMATION_WORKFLOW_DELETE - Delete Landing Page - Manage Marketing Campaigns

Example 2: Create "Support" Role

Objective: Support staff only need to view messages and reply to customers.

Granted Permissions: - Messaging: View, Reply - CRM: CRM_VIEW_ALL_CONTACT, CRM_OBJECT_VIEW - Email: View only

Denied Permissions: - All other permissions

Example 3: Create "Finance" Role

Objective: Accountants manage invoices and payment methods.

Granted Permissions: - BILLING_VIEW_INVOICE — View invoices - BILLING_ADD_PAYMENT_METHOD — Add payment methods - WORKSPACE_VIEW_BILLING_MEMBER — View billing information

7. Convention A - Permission Name DOMAIN_ACTION_OBJECT (New 5/2026)

All permission names in GTG CRM are standardized according to Convention A — DOMAIN_ACTION_OBJECT.

How to Read Convention A Permission Names

BILLING_VIEW_INVOICE
   │       │      │
   │       │      └── Object: INVOICE (the item: invoice)
   │       └── Action: VIEW (the action: view)
   └── Domain: BILLING (the area: billing)

Table of Permission Names by Domain

Domain	Permission Name	Meaning
BILLING_	BILLING_VIEW_INVOICE	View invoices
BILLING_	BILLING_ADD_PAYMENT_METHOD	Add payment methods
WORKSPACE_	WORKSPACE_ACTION_USER	Manage workspace users
WORKSPACE_	WORKSPACE_VIEW_BILLING_MEMBER	View workspace billing information
AUTOMATION_	AUTOMATION_WORKFLOW_CREATE	Create automation workflows
AUTOMATION_	AUTOMATION_WORKFLOW_DELETE	Delete automation workflows
CRM_	CRM_OBJECT_VIEW	View CRM objects
CRM_	CRM_VIEW_ALL_CONTACT	View all contacts

Why the Name Change?

Previously, permission names were inconsistent: SEND_EMAIL, CREATE_LANDING_PAGE, VIEW_BILLING — making them difficult to find and audit when a workspace had many permissions.

Convention A solves this by: - Grouping by Domain → searching for BILLING_ immediately shows all billing permissions. - Consistent Actions → VIEW always means view, CREATE always means create. - Easy Auditing → typing the domain name filters all related permission groups.

8. Administrator Automatically Accesses Settings

Administrators will automatically have the WORKSPACE_* permissions individually added to access the Settings menu.

Administrators automatically have all Settings permissions — no need to add them separately.

Important Notes

Best Practices

1. Principle of Least Privilege: Only grant necessary permissions for a given role.
2. Periodic Review: Re-check permissions when employees change positions.
3. Backup before Deleting: Record role configurations before deleting them.
4. Test Permissions: Log in with a user account assigned the role to test actual functionality.

Security

• Only Administrators can manage permissions.
• Do not share Administrator accounts.
• All permission changes are logged automatically.

FAQ

Q: Can a user be assigned multiple roles?

A: Currently, each user can only be assigned one role.

Q: Does a new role take effect immediately?

A: Yes, roles are applied immediately after assignment.

Q: Can permissions be rolled back?

A: You can reassign a different role at any time.

Q: Where are the Convention A permission names displayed?

A: In the Settings → Permissions interface, each permission toggle displays its name according to Convention A for easy lookup.

Summary

With the Permissions feature in GTG CRM:

• Safely expand your team — each person does only their assigned tasks.
• Control access to important data.
• Convention A — standardized permission names, easy to audit by domain.
• Administrator automatically has Settings — no more misconfigurations.
• Operate professionally like a large enterprise.