Permissions decide who can see and do what. Get the shape right early and the team can move fast without anyone reaching a screen they should not.
Roles versus staff permissions
There are two layers, and they work together.
- Roles are reusable templates of permissions. You might have a Partner role, an Associate role, and a Reception role. Set the permissions once on the role and every person in it inherits them.
- Staff permissions are the settings on an individual profile. A person starts from their role, and you can adjust their own permissions where one individual needs something slightly different.
Use roles for the pattern and individual permissions for the exception. This keeps the common case simple: change the role once and everyone in it updates, rather than editing ten profiles by hand.
Create and edit a role
- Open roles under Setup. You will see the roles already defined and can create a new one.
- Name it for the job, not the person. Reception and Bookkeeper age better than someone's name, because roles outlast individuals.
- Tick the areas that role should reach. Permissions are grouped by feature, and most areas separate viewing from creating, editing, and deleting, so you can let someone read invoices without letting them change them.
- Decide whether to push changes to existing staff. When you edit a role, you can choose to apply the update to everyone already in it, or leave their current permissions untouched.
Choosing to sync a role change to existing staff overwrites their individual tweaks for that role. If a person has a deliberate one off permission, syncing may undo it, so review before you confirm.
Own versus all visibility
Many areas distinguish between seeing your own records and seeing everyone's. In Matters, for example, a role can be limited to matters the person is assigned to, or opened up to every matter in the firm. Junior staff often start with own only visibility, while partners and office managers usually need the full view. This is one of the most useful controls to set thoughtfully, because it shapes how much of the firm each person sees.
Least privilege, then loosen
Start people with the access their job needs and no more, then grant extra when a real task calls for it. This is easier and safer than starting wide and clawing back, and it means a new hire cannot stumble into billing settings or client trust records on their first day.
A sensible starting shape
| Role | Typically needs | Usually does not need |
|---|---|---|
| Partner or owner | Everything, including settings and all matter visibility | Nothing withheld |
| Associate lawyer | Matters they are on, time entry, invoices for their work | Firm wide settings, staff management |
| Paralegal or assistant | Assigned matters, tasks, documents | Trust configuration, role editing |
| Reception or bookkeeper | Bookings, invoices, client contacts | All matter content, settings |
Treat this table as a starting point, not a rule. Every firm divides work differently, so adjust to how your people actually operate.