Suite CRM Role management, GM, DM, SR hierarchy

Question

Can you please explain how can i setup the role management and security groups in suiteCRM to achieve this,

1. Two General Manager, they cannot access the records of other GMs and his team records
2. Any number of Divisional Managers under GM, they cannot access the records of their own GM, other GMs, and other DM but can access the reports of SR under them.
3. SR (Sales representative) can access only their own records.

Thanks :)

Answer 1

Try this (not tested)

• Create All Security groups for DM. This is the main unit of security.
• Assign the GM users to the DM security groups they have access to. No need to create a GM group, just give them access to the groups they need.
• Create SR role and set the permissions to own. Assign SR users to this role. This will restrict users in this role to only see their own records.
• Create DM role and set the permission to group. Assign DM users to this role. Only one DM role is needed, and ALL of the GM and DM users should belong to it.
• Add SR and DM role to all the DM security groups.

The logic is like this

1. Users who try to access a record will have to go through their Roles First, if its say Own, then that's where the security logic compares the owner of the record.
2. If the users Roles have a Group setting then User groups will be scanned, and check if the record belongs to someone on those groups. If not access is denied.

So thats it, the Group setting needs to be on each module you want to restrict access to, sadly this is a manual work. Take a look at this image, you can see the different types of access you can grant on a role/action.