Skip to main content
Access control determines which users can view and modify specific records, providing granular security beyond role-based permissions.

​
Access Control Levels

Twenty provides multiple layers of access control:
1

Role-based permissions

Baseline access defined by user roles (Admin, Member, custom roles).
2

Object-level permissions

Configure default access for entire objects.
3

Record-level sharing

Share specific records with users or teams.
4

Field-level security

Hide or restrict sensitive fields by role.

​
Object-Level Permissions

Control default access to objects:

​
Configuring Object Access

1

Navigate to object settings

Go to Settings → Data Model → Objects and select an object.
2

Go to Permissions tab

Click the Permissions tab.
3

Set default access

Configure who can access this object:
Default Access: Private

Options:
- Public: All users can view
- Private: Only owner and explicitly shared
- Team: Owner's team can view
- Custom: Define per role
4

Set role permissions

For each role, define:
  • View all, team, own, or none
  • Create yes/no
  • Edit all, team, own, or none
  • Delete all, own, or none

​
Permission Examples by Object

Common configuration:
Default Access: Public

All Roles:
  View: All companies
  Create: Yes
  Edit: All
  Delete: Own or Admin only

Reasoning:
- Companies are shared resources
- Everyone needs to see them
- Most can edit (add info)
- Only owner/admin can delete

​
Record-Level Sharing

Share specific records with users:

​
Sharing a Record

1

Open the record

Navigate to the record you want to share.
2

Click Share

Click the Share button in the record header.
3

Add users or teams

Search for and select:
  • Individual users
  • Teams
  • Roles (e.g., “All Sales Reps”)
4

Set access level

Choose permission level:
- View Only: Can see but not edit
- Can Edit: Can view and modify
- Can Delete: Full access including delete
5

Add message (optional)

Include context:
"Sharing this opportunity - please review before tomorrow's call"
6

Share

Click Share to grant access.
Users receive notification when a record is shared with them.

​
Sharing Options

View Only

User can:
  • See the record
  • View all fields
  • See related records
User cannot:
  • Edit any fields
  • Delete record
  • Share with others

Can Edit

User can:
  • View record
  • Edit fields
  • Add comments
  • Update related records
User cannot:
  • Delete record
  • Change owner
  • Modify sharing

Can Delete

User can:
  • Everything in “Can Edit”
  • Delete record
  • Change owner
  • Modify sharing settings
Full control over record.

Owner

Automatic for creator:
  • All permissions
  • Cannot be removed
  • Can transfer ownership
  • Sees record even if private

​
Sharing Patterns

Use case: Collaborate on dealsSetup:
Opportunity: Acme Corp - Q1 Deal
Share with: Sales Team
Access: Can Edit

Result:
- All sales team members can view/edit
- Collaborate on strategy
- Update as deal progresses
Use case: Keep stakeholders informedSetup:
Project: Website Redesign
Share with: Marketing Manager, VP Product
Access: View Only

Result:
- Stakeholders see progress
- Cannot accidentally change anything
- Stay informed without noise
Use case: Transfer work to another userSetup:
Lead: Qualified prospect
Share with: Account Executive
Access: Can Edit
Then: Transfer ownership

Result:
- AE receives lead
- Can take over
- Eventually becomes owner
Use case: Involve other departmentsSetup:
Opportunity: Large enterprise deal
Share with:
  - Legal Team (Can Edit - contract)
  - Finance Team (Can Edit - pricing)
  - Support Team (View Only - context)

Result:
- Each team has appropriate access
- Collaboration across departments
- Record is single source of truth

​
Field-Level Security

Control access to sensitive fields:

​
Configuring Field Security

1

Navigate to object settings

Go to Settings → Data Model → Objects → [Object] → Fields.
2

Select field

Click the field to configure.
3

Go to Security tab

Click Security to set field-level permissions.
4

Set role access

For each role:
Admin:
  View: Yes
  Edit: Yes

Sales Manager:
  View: Yes
  Edit: Yes

Sales Rep:
  View: No (Hidden)
  Edit: No

​
Sensitive Fields Examples

Restrict revenue and cost:
Company.Annual Revenue:
  Executives: View + Edit
  Sales Managers: View Only
  Sales Reps: Hidden
  Support: Hidden

Opportunity.Cost:
  Finance: View + Edit
  Sales Managers: View Only
  Sales Reps: Hidden

Opportunity.Commission:
  Sales Ops: View + Edit
  Sales Rep: View Own Only
  Others: Hidden

​
Ownership

Record ownership determines primary responsibility:

​
Record Owner

Owner has:
  • Full access to record (view, edit, delete)
  • Ability to share record
  • Ability to transfer ownership
  • Appears as “Owner” on record

​
Changing Ownership

1

Open record

Navigate to the record.
2

Click Owner field

Click the current owner name.
3

Select new owner

Search for and select new owner.
4

Confirm transfer

Click Transfer Ownership.
New owner receives notification of ownership transfer.

​
Auto-Assignment Rules

Automate ownership: 
Example: Auto-assign leads by territory

Workflow: Lead Created
Conditions:
  Country = "United States"
Actions:
  Set Owner = "US Sales Rep" (Round Robin)

Conditions:
  Country = "United Kingdom"
Actions:
  Set Owner = "UK Sales Rep"

​
Team-Based Access

Organize users into teams for easier sharing:

​
Creating Teams

1

Navigate to teams

Go to Settings → Teams.
2

Create team

Click + New Team:
Name: Enterprise Sales Team
Members:
  - Alice (Manager)
  - Bob (Rep)
  - Charlie (Rep)
3

Set team sharing defaults

Configure automatic sharing:
Opportunities:
  Share within team: Yes
  Access level: Can Edit

Result: Team members automatically see each other's opportunities

​
Team Hierarchies

Create organizational structure: 
Sales Organization
  ├─ Enterprise Sales Team
  │   ├─ Alice (Manager)
  │   ├─ Bob (Rep)
  │   └─ Charlie (Rep)
  │
  └─ SMB Sales Team
      ├─ David (Manager)
      ├─ Eve (Rep)
      └─ Frank (Rep)

Permissions:
- Team members see team's records
- Managers see all sub-teams
- Cross-team visibility requires explicit sharing

​
Access Control Best Practices

Begin with private access:
  1. Set objects to private by default
  2. Limit role permissions initially
  3. Add access when users need it
  4. Better to add than remove access
Instead of sharing individually:
  • Create teams (Sales, Support, etc.)
  • Configure team sharing rules
  • Add users to teams
  • Sharing happens automatically
Use field-level security for:
  • Financial information
  • Personal data
  • Strategic plans
  • Competitive intelligence
Quarterly access audit:
  • Review who has access to what
  • Remove unnecessary sharing
  • Adjust role permissions
  • Clean up team memberships
Create clear guidelines:
  • Who should see what
  • When to share records
  • How to request access
  • Escalation for exceptions

​
Troubleshooting Access Issues

​
User Cannot See Record

Check in order:
  1. Role permissions
    • Does role allow viewing this object?
    • Does role allow viewing records they don’t own?
  2. Object settings
    • Is object visibility restricted?
    • Is default access too restrictive?
  3. Record sharing
    • Is record shared with user?
    • Is user part of team with access?
  4. Record ownership
    • Does user own the record?
    • Can they see records they own?

​
User Cannot Edit Field

Check:
  1. Field-level security
    • Is field hidden for user’s role?
    • Is field read-only for role?
  2. Record access
    • Does user have edit access to record?
    • Sharing might be view-only
  3. Field type
    • Some fields are always read-only (ID, Created At)
    • Calculated fields cannot be edited
  4. Workflow locks
    • Workflow may lock fields in certain stages
    • Check workflow rules

​
Next Steps

User Roles

Learn about role-based permissions

Workspace Setup

Manage workspace members and teams

Build docs developers (and LLMs) love

Get started for freeTalk to us