Record Visibility Rules: Who Can See What in TeamsWork Apps
Across TeamsWork apps such as CRM as a Service and Billing as a Service, the record visibility rules are set on the record itself, not on the user, and that single principle explains every access question you are likely to have. Two records owned by the same person can have completely different audiences, because each record carries its own access level.
That makes the system flexible, and it also makes it easy to get wrong in both directions, either by over-sharing a sensitive record or by locking one away from the team that needs it. This page is the complete reference for who sees what, and the same model applies identically across CRM, Billing, and the apps we are building next.
Who Always Sees a Record, Whatever the Access Level
Some people see a record regardless of the access level set on it. These access paths sit above the four levels and always apply:
The record owner sees their own records
A collaborator sees any record they are added to
An app Owner sees every record in the instance
A group owner sees every record owned by a member of a group they own
The owner is a field on the record, and it can be reassigned. When ownership changes, the previous owner loses access immediately unless they are also a collaborator on that record.
Roles Across TeamsWork Apps
Each app has three roles, Owner, Member, and Collaborator, plus two group roles, Group Owner and Group Member, that are held independently of the app roles. Each role maps to a different slice of visibility, and the same structure applies in every app.
App Owner
An app Owner has full visibility across every record, plus access to settings and configuration. The role is named after the app, for example CRM Owner in CRM as a Service, and no access level restricts it, so Private records are visible to an app Owner like any other.
Member
A Member sees their own records, records they collaborate on, and whatever the access level on each record grants them. That means a Member also sees every Group record for their groups and every Public record in the instance, not just records they own.
Collaborator
A collaborator is granted per record rather than across the instance. Adding someone as a collaborator gives them access to that one record and nothing else, across any record type.
For a full breakdown of what each role can do, see roles explained for Owners, Members, and Collaborators.
Choosing the Right Access Level
The right access level depends on how widely a record should circulate, and every record uses one of four access levels to determine who can see and edit it:
Access Level | Who Can See the Record |
Private | The record owner, their group owners, and app Owners |
Group | The above, plus all members of the shared group |
Public (Read Only) | Everyone in the instance, view only |
Public (Read/Write) | Everyone in the instance, view and edit |
Access is set per record and can be changed at any time, and the change takes effect immediately. The table shows who sees each level, so the choice comes down to how far a record needs to travel:
Private: for early-stage deals, draft documents, or sensitive accounts that one person should own before the wider team sees it
Group: when a regional or product team should work a record together without exposing it company-wide
Public (Read Only): for reference records everyone needs to find but only one team should maintain
Public (Read/Write): for shared records that anyone may need to update
A default access level is set per record type by an app Owner, so new records start consistently, and owners can change it per record afterwards.
How Group Visibility Works
A group consists of Group Owners and Group Members. When a record is set to Group access, visibility follows three rules:
Target group: the record is shared with one group only, the record owner's preferred group, which is configured in their user profile
What Group Members see: members see only records set to Group access that are shared with a group they belong to
What Group Owners see: group owners have broader visibility, seeing all records owned by their group members, including records set to Private, and all records shared with their group, whoever owns them
For setup steps, see Group Visibility in CRM as a Service.
Finding a Record Through a Linked One
A linked record can be reachable even when it would not show up in your own lists. This surprises people, so it is worth stating plainly:
A record such as a Contact or Organization linked from a record you can see is reachable in full from that record, through search
It will not appear in your own list for that record type
Access comes from the link, so a record attached to a Public record is readable by everyone in the instance
Comments