Zircon CRM / Administration
Runs in the browser · HU / EN / DEUser permissions shaped around each job
In Zircon CRM you set access per feature and per action: who may view, create, edit and delete. A sales rep works on their own estimates and invoices without seeing the whole company's revenue. A role is a template you fine-tune per person.
Own or all recordsRoles as templatesPortal rights per contact
In short
How do user permissions work in Zircon CRM?
User permissions decide who can see and change what in a system. Zircon CRM has three levels: administrator, role and individual permissions. In many areas you choose whether someone sees only their own records or everyone's. Your customers' contacts get a separate, simpler set of portal permissions. It is built for administrators, office managers and team leads.
Sound familiar?
Either everyone sees everything, or nobody sees anything.
If one of these rings true, access in your company does not follow job profiles yet.
- 01
The new sales rep scrolls through every invoice
On day one they can browse all of the company's invoices, although they only need their own customers.
- 02
One extra right, one more role
The project manager needs one delete right, so they get a role of their own. Soon the role list is as long as the staff list.
- 03
You cannot tell who a change affects
You want to tighten a role, but you cannot see who uses it or whether the change will apply to them.
- 04
At the customer, everyone sees everything in the portal
The bookkeeper browses project tasks and the project lead browses invoices, because the portal treats every contact the same.
What it does
How user permissions are built.
The same permission grid appears when you edit a role and on every staff member's record.
Three levels
An administrator can reach everything, system settings included. A role is a named, reusable template such as "Sales" or "Support Agent". Individual permissions let you add or remove a single capability for one person after choosing their role, without creating a new role.
Own or all records
For estimates, invoices, proposals, contracts, credit notes and expenses you choose between View (Own) and View (Global). The two exclude each other: ticking one disables the other.
Visibility from relationships
In some areas "own" visibility follows from relationships. Without View (Global), a customer is visible to the staff assigned as its customer admins, a project to its members, and a task to its assignees and followers. Help icons in the grid explain each rule.
Actions and special capabilities
Besides viewing, you set create, edit and delete, plus special capabilities such as using colleagues' contract and proposal templates or the timesheets report. Editing and deleting logged time can be granted for one's own entries or for everyone's.
Modules in the same grid
The media library, Social Manager, the MCP server, goals and hosting and domain renewals add their own rows. So you see in one place who may upload to the media library and who may manage AI connections.
Role changes on purpose
When you edit a role that is already in use, a warning tells you the change applies only to future assignments by default. One checkbox pushes it to every staff member on that role. The role page lists who uses it, and a role in use cannot be deleted.
Visible as the responsible person
You can let staff see the invoices and estimates where they are the sales agent, and the proposals assigned to them, even when a colleague created them.
Portal permissions per contact
For each customer contact you decide whether they see invoices, estimates, contracts, proposals, support tickets and projects in the portal. E-mail notifications can be switched per type too, so invoices reach the finance contact rather than everyone.
How it works
From job profile to portal.
- 01
Map your job profiles
List the roles in your company and decide per area who needs own or global visibility and which actions.
- 02
Create the roles
On the roles page, add a role and tick its capabilities, module rows included.
- 03
Set the default role
Make the narrowest common profile the Default Staff Role, so every new account starts with safe rights.
- 04
Assign and fine-tune
Pick the role on each staff record and adjust the grid for individuals where needed.
- 05
Set contact permissions
Default portal permissions are pre-ticked on every new contact. Change them where a person should see more or less.
Control
What the grid does not decide.
Administrators only
Currencies, taxes, payment modes, custom fields, GDPR settings, modules, the activity log and database backups are reserved for administrators regardless of the grid. Only administrators can grant administrator status.
Global switches
In the settings you decide whether staff see only their own departments' tickets, whether non-administrators may import leads, and whether everyone sees all tasks of their projects.
AI assistants with the staff member's permissions
An AI assistant connected through the MCP server always works with the permissions of the staff member who authorised it. A token can never do more than its owner.
Changes are logged
Creating, updating and deleting roles, and changes to a staff member's permissions, are written to the activity log. Administrators can clear that log.
Works with
Where permissions take effect.
- Staff and teamsthe role and individual permissions are set on each staff record.
- Customer managementa customer's assigned staff see that customer without global access and can set its contacts' portal permissions.
- Customer portaleach contact's permissions decide which sections they see in the portal.
- MCP server for AI assistantsthe AI assistant reads and writes within the signed-in staff member's permissions.
- REST APIintegrations get a separate API user with its own permission grid per resource and action.
- Security and sign-inpermissions apply after login, which is guarded by two-factor login and a login audit trail.
Honestly
Good to know before you start.
The grid works by feature and action, but not every single button has its own row: some modules reuse existing permissions, recurring tasks for example follow the task permissions. If you need to restrict a specific action tightly, let us check together before rollout which permission covers it.
Administrator status overrides every restriction, and the grid cannot be edited for administrators. Give it only to people who really need it.
Editing a role does not change the rights of staff already on it unless you tick the update option.
Staff "own" rules do not apply to REST API users: what an integration sees is decided only by that API user's own permission grid.
Before you write
Fair questions. Straight answers.
- 01
What is the difference between a role and individual permissions in Zircon CRM?
A role is a template: when you pick it, its permissions are copied into the staff member's own grid. Individual permissions are changes to that copy for one person. Zircon CRM therefore does not force a new role for every small exception.
- 02
How do I make sales staff see only their own invoices in Zircon CRM?
Tick View (Own) for invoices, not View (Global). If you switch on the matching setting, they also see invoices where they are the sales agent, even when a colleague issued them. The same works for estimates and proposals.
- 03
Does editing a role in Zircon CRM change everyone's access?
Only if you ask it to. Zircon CRM warns you that by default the change does not affect staff already using the role. Tick the update option and the new permission set is copied to all of them.
- 04
Can I control per contact what a customer sees in the Zircon CRM portal?
Yes. Access to invoices, estimates, contracts, proposals, support and projects can be switched for each contact. New contacts receive the default portal permissions you set in the settings.
- 05
Can an AI assistant get more rights than the staff member in Zircon CRM?
No. An AI assistant connected through the MCP server works with the permissions of the staff member who authorised it, and you can narrow it further, for example to read-only. Every call is logged.
Let's talk.
The first call costs nothing
A human replies — not a bot
Bring a list of your job profiles and who should see what. In the demo we turn it into roles and show you how the same invoice list looks to a sales rep and to a bookkeeper.
- hello@zircon.hu
- Phone
- +36 30 487 7979
- Hours
- Weekdays 9–17
- Support
- support@zircon.hu (existing clients)