Team & access
Client access
Scoping a client's workspace access and the modules they can review.
Give each client their own workspace
A Client role is scoped to a workspace, not to individual contacts, deals, or messages inside it. A client with CRM or Conversations read permission can see that workspace's records in those modules. Keep separate customers in separate workspaces before inviting them; do not use a shared workspace as a substitute for record-level access controls.
Invite the client
- Switch to the client's workspace and open Team.
- Select Invite someone, choose This workspace only, and set Workspace role to Client.
- Send the invitation to the client's own email address.
- After they accept, use Permissions on their Team row to adjust what they can review.
Do not choose Agency-wide Owner or Admin for a customer: those roles can reach every workspace in the organisation. An organisation Member with a direct Client membership reaches only the workspaces to which they have been added.
What the Client role can see
By default, Client can read CRM contacts, pipeline, conversations, calendar, forms, websites and funnels, social, payments, and analytics in that workspace. The role can also use AI Studio. It cannot normally edit records, publish, manage integrations, or manage Team. The dashboard and basic workspace shell remain available.
Check access and maintain it
- Review the workspace's records and connected accounts before inviting the client.
- Remove unneeded read permissions from their Team row; grant a write capability only for a specific task.
- Confirm the client can open only the intended workspace and modules using their own account.
- When the engagement ends, remove their workspace membership; if they have another organisation role, check that separately.
See Per-member permissions for the editor and its safeguards.