Access and permissions

How access works

Access is made of two parts:

• Capabilities: which sections and actions a person can use.
• Scope: which contacts they can see: everyone, one region, specific areas, or only themselves.

Capability	Lets the person
Contacts: view / edit / bulk	See contacts; change them; use bulk actions
Notes, Activity	Read and write notes; see the activity timeline
Map	Use the map
Groups, Geography	Manage groups/tags/roles; manage regions and areas
Templates, Campaigns	Design emails; send campaigns
Events	Manage events
Store	See orders, inventory and reports
Resources	Publish website resources
Access management	Grant access to others

Full staff (the "CRM Staff" group on the backend) have every capability with scope everyone. A regional leader typically has contacts, notes, map and events for their region. An ambassador has contacts and notes for their areas.

Steps: give someone access

1. Make sure the person has an EMAW account (created on the website with their work email) and a contact record with the same email.

2. Open the contact → Profile → Admin access card. Link the contact to their app user if it is not linked already.

3. Tick the capabilities and choose the scope (and the region or areas). Save.

   Screenshot pendingThe Admin access card on a contact

   The Admin access card on a contact

4. Tell them to sign in at the admin address with their Workspace Google account and their EMAW account.

Roles can carry a standard set of capabilities, so assigning the "Ambassador" role is often all that is needed (Groups, tags and roles).

Steps: remove access

Untick the capabilities on the Admin access card, or remove the role. The next request they make is refused; they do not need to sign out.

Rules

• Ambassadors do not get campaign sending unless explicitly authorised.
• Access is personal: never share a login.
• Everything staff do is logged with their user id for security review.
• Exports contain personal data; download only when needed and delete afterwards.