Not everyone at a firm needs to see everything. Roles and permissions let you give each person exactly the access their work requires, and nothing more.
Roles keep access tidy
Rather than setting permissions one person at a time, you group them into roles. A role is a named bundle of permissions, such as Lawyer, Paralegal, Bookkeeper, or Administrator. You assign a person to a role, and they receive that role's access. When someone changes jobs, you move them to a different role instead of reworking dozens of individual settings.
Permissions usually cover two things: which parts of the workspace a person can open, and what they can do there, such as view only, create, edit, or delete. A bookkeeper might have full access to Invoices and Trust accounting but no access to sensitive matter notes, while a paralegal might work freely in Matters but not touch financial settings.
Set a person up with the right access
- Open your staff or team settings. This is where the people in your firm and their roles are listed.
- Add the person or open their profile. For a new hire, create their account with their name and work email.
- Assign a role. Choose the role that matches their job. This grants the access that role carries.
- Adjust if needed. If one person needs slightly different access, you can fine-tune their permissions or create a new role that fits a group of people.
- Review before you finish. Confirm they can reach what they need and nothing they should not.
The principle of least access
A good rule is to grant the least access a person needs to do their job well, then add more only when a real need appears. This is not about mistrust. It keeps sensitive files in fewer hands, reduces the chance of an accidental change, and makes your activity logs easier to read because fewer people can touch each area.
Reserve full administrator access for the small number of people who genuinely manage the firm's setup. Administrators can change security settings and other people's access, so the fewer of them there are, the safer your workspace.
When people join and leave
Access should track your team. Set up new joiners with a role on their first day, and review access when someone moves to a different job inside the firm, since old permissions tend to pile up. When a person leaves, disable their account promptly so it can no longer be used to sign in. Disabling is usually better than deleting straight away, because it keeps the record of their past activity intact for your logs.
Do a quick access review a couple of times a year. Ask whether each person's role still matches their job. It rarely takes long and it catches access that quietly outlived its purpose.