Roles and permissions in X10 CRM
How access is built: role levels, 300+ individual permissions, limits by project and by allowed statuses, and hiding customer phone numbers.
Access in X10 CRM is not built from two or three roles along the lines of “admin and everyone else”, but from more than 300 individual permissions. That lets you assemble a role around a specific job: an operator who cannot export the database, a team lead without access to integration settings, an accountant who only sees the amounts.
#Three layers of restriction
An employee’s access is defined by three independent mechanisms. This is the most important thing to understand about the permission system.
Access mechanisms
Rolewhat you can doA set of permissions: which sections are visible, which actions are allowed, which columns appear in the table.
Projectswhose data you seeAn employee only sees leads from the projects they belong to. The role may allow editing leads, but outside their own projects they simply will not see them.
Allowed statuseswhere you can move a leadA role can be given an explicit list of statuses it may set. An operator physically cannot set “Paid for” if that is not their area of responsibility.
#Role levels
Every role has a numeric level. The lower the number, the more authority. The level does not control permissions — it controls who can manage whom.
- An employee can only assign roles below their own. A team lead cannot make someone an administrator.
- You can only manage users with a lower level. Two team leads on the same level cannot edit each other.
- The superadministrator role is not shown in the lists and cannot be edited through the interface — a safeguard against accidentally losing access to the system.
| Typical role | Level | Purpose |
|---|---|---|
| Superadministrator | highest | Technical owner of the system, full access |
| Administrator | high | CRM configuration, integrations, users |
| Team lead | middle | Runs their team and its leads, looks at the statistics |
| Manager, operator | basic | Works with leads inside their projects |
#Permission categories
Permissions are grouped by section of the system. The largest groups are the dashboard and leads, because that is where the tuning is finest.
| Category | What it controls |
|---|---|
| Dashboard | The largest group. A separate permission for every table column and every filter — you can give an operator a minimal view with no amounts and no traffic sources |
| Leads | Viewing, creating, editing, changing status, archiving, bulk actions, waybills, cart |
| Sensitive data | A separate group for customers’ personal data — above all, the full phone number |
| Calls | The ability to make calls, see the call list, listen to and download recordings |
| Statistics | How much data is visible: your own numbers, the team’s or the whole company’s |
| Settings | Access to CRM configuration, roles, users and integrations |
| Users | Creating employees, changing roles, blocking accounts |
| Operators | Managing breaks, limits and discipline |
| Dialogs and AI | Transcription, call analysis, access to the AI assistant |
| Chat and social | Internal chat, group rooms, replying to customers |
| Dialer | Taking part in campaigns, supervisor functions, the blacklist |
| Navigation | Which menu items are visible at all |
| Webmaster | Access to the partner cabinet |
#Protecting the customer base
Hiding phone numbers deserves a separate mention. It is not a decorative feature but protection against the most common way of stealing a customer base — exporting the numbers and taking them to a competitor.
- An operator can be denied sight of the full number — in the interface it appears masked.
- They can still call: the system dials the number without showing it. The work does not suffer.
- Permissions to download call recordings and export data are granted separately, and only to those who genuinely need them.
#How to create a role
- 01
Open Settings → Roles
Here is the list of all roles with their levels.
- 02
Create the role and set its level
Remember: the lower the number, the more authority. Leave gaps between levels so there is room to insert a new position later.
- 03
Tick the permissions
Permissions are grouped by category. It is easier to work forwards: switch on the minimum you need rather than switching off the excess from the full list.
- 04
Limit the allowed statuses
If a role is not supposed to move leads to the end of the pipeline, list only the statuses it is allowed to set.
- 05
Assign the role to users
In the employee’s card, set the role and the projects. Without projects the person will not see a single lead.
#Ready-made sets
| Position | What to grant | What to withhold |
|---|---|---|
| Operator | Leads in their projects, calls, cart, reminders, a limited list of statuses | The customer’s full number, downloading recordings, bulk actions, settings |
| Team lead | Everything an operator has, plus team statistics, bulk actions, listening to calls, managing breaks | Integration settings, managing roles |
| Logistics or warehouse | Leads in delivery statuses, waybills, label printing, products and stock | Calls, sales statistics, settings |
| Administrator | CRM configuration, integrations, users, full statistics | Keep the superadministrator level with a single person |
#Checklist
- Roles are built around real positions, not created “just in case”
- Levels are spaced out with gaps
- Every employee has projects assigned
- Roles with limited responsibility have an allowed-status list
- The full customer number is hidden wherever it is not needed
- Export and recording-download rights are granted case by case
- Exactly one trusted person holds the superadministrator level