Give each teammate access to the creator records needed for their current job and assigned campaigns. Give clients a separate view of their own campaign decisions, deliverables and reports. Keep bank details, tax documents, internal negotiations and other clients' records outside that view. Audit viewing, editing, exporting and inviting separately; a person who needs to approve a video rarely needs all four.
The US Federal Trade Commission's guide to protecting personal information recommends least privilege: employees should access only the resources their jobs require. The matrix below applies that principle to creator operations. It is a recommended starting policy, not a legal requirement or a claim about any CRM's available controls.
Define what each person needs to do
Before assigning a role, finish this sentence: "This person needs this information to complete this task for this campaign."
"Works in marketing" is too broad. "Emails the selected creators for the autumn campaign" supports access to those creators' business contacts and relevant conversations. It does not support access to every creator's bank details or another client's rate negotiations.
Inventory the places where those records live:
- CRM fields, notes, attachments and linked creator profiles.
- Shared inboxes, forwarded messages and notification emails.
- Campaign folders, approval links and reporting spreadsheets.
- Finance systems, payment-provider accounts and exported files.
- Integrations or automation accounts that can copy records elsewhere.
Record who owns each location and who can grant access. The FTC guide recommends tracing information through the business and identifying everyone who has, or could have, access. A CRM review misses the problem if an old export remains shared with the whole agency.
A starting role-permission matrix
This is an illustrative operating template. Apply each permission only to assigned campaigns. "None" means no routine business access. "Selected" means a purpose-limited set of fields or documents, approved by the record owner.
| Role | Contact records | Campaign work | Commercial records | Payment records |
|---|---|---|---|---|
| Discovery researcher | Public profile references; selected business contacts | Edit shortlist and fit notes | None | None |
| Creator manager | Edit relevant contacts and conversations | Edit briefs, schedules and deliverables | Edit assigned negotiations; view agreed fees | View payment status only |
| Creative reviewer | None unless coordinating directly | View assets; comment on assigned revisions | Selected delivery requirements | None |
| Account lead | Selected contacts and conversations | View campaign; record client decisions | View own-client budget; approve within delegated authority | View invoice and payment status |
| Finance operator | Selected billing contact | View evidence needed for payment | View agreed fee and payment milestones | Process assigned invoices and payment details in finance system |
| Client reviewer | None by default | View or comment on client-ready assets and reports | View agreed client-facing costs | None; selected status if needed |
Access to a record does not automatically grant authority to approve a fee, release a payment or change who can see it. Document those powers separately. For example, a finance operator may prepare a payment while a different authorized person releases it.
An administrator needs a separate review. Some systems give administrators technical access to all records. Record that capability even if the administrator's normal job does not require reading them. Limit administrator accounts and avoid using them for routine campaign work.
For the underlying field structure, use a creator CRM organized around decisions and next actions. Keep the permission matrix attached to that field list so a newly added column receives an access decision.
Separate contact, commercial and payment data
A business email, a home delivery address and a tax identifier should not inherit the same permissions because they describe one creator.
A shipping coordinator may need a recipient name and delivery address for an active shipment. A creative reviewer needs the asset and brief. Neither task requires opening a tax document. Give finance the payment information it needs in the restricted finance system; show the campaign team a status such as "invoice received" or "payment sent."
The FTC guide recommends collecting and keeping sensitive information only when there is a legitimate business need. Apply that recommendation before deciding who can see a field. A field nobody needs should enter a retention review rather than accumulate more access restrictions. Ask qualified advisers about applicable legal retention duties and holds before deleting records.
For the storage boundary, follow the guide to keeping payment details out of general campaign notes. This access review decides who can reach those locations.
Commercial records need their own boundary. A client may need agreed campaign costs without needing the agency's internal negotiation notes, margin calculations or another client's creator rates. If your contract requires open-book reporting, have the account lead confirm which records belong in that view. Route disputed confidentiality or disclosure obligations to qualified counsel in the relevant jurisdiction.
Check what the software role permits
Role names are insufficient evidence. In its multi-user announcement, Modash describes teammates accessing lists, notes, campaigns and their contents, with member restrictions around billing and plans. That announcement illustrates why adding a teammate can grant broad visibility. It does not establish the current controls available in your account.
Ask your software owner to demonstrate these permissions with an authorized test account and synthetic records:
- Can the user open another client's campaign through search or a direct link?
- Can the user read restricted fields through attachments, comments or notifications?
- Can the user export records, download files or obtain them through an integration?
- Can the user invite someone else or change sharing settings?
- Does removal from the campaign also remove access to linked folders and inboxes?
Do not assume view-only access prevents copying. Google's My Drive permission table says viewers and commenters can download by default, subject to owner controls. It also describes inherited folder access and limited-access subfolders. Those details apply to My Drive; check your own storage system's rules.
If a CRM cannot enforce the needed separation, keep restricted data elsewhere and share a reviewed client copy. A hidden spreadsheet column or filtered view is not enough evidence that the underlying records are inaccessible.
A worked client-access decision
Consider this hypothetical case: an agency client needs to approve creator videos and see campaign progress. The agency also stores negotiation history and payment documents.
| Client task | Access decision | Evidence to test |
|---|---|---|
| Approve a video | Comment on client-ready asset | Reviewer can open that asset and submit feedback |
| Check progress | View own-campaign status report | Other client campaigns do not appear in search or direct-link tests |
| Review costs | View agreed client-facing cost summary | Internal margin and negotiation notes remain inaccessible |
| Ask about payment | View selected status where relevant | No bank or tax attachment is reachable |
If the only available invitation grants access to the whole agency workspace, do not use it for this reviewer. Prepare a separate approval space containing only the records the client needs.
Quarterly access-review checklist
Use a quarterly review as an operating cadence, then review access immediately when someone leaves, changes jobs or finishes an assignment. Quarterly timing is a recommendation here, not a schedule mandated by the cited guidance.
- Inventory. List named users, guests, pending invitations, groups, administrator accounts, integrations and broadly shared links.
- Confirm purpose. Ask each campaign owner to confirm the task, campaign scope and end date behind each grant. Investigate unexplained access.
- Check group membership and inherited folder permissions, including old exports and archived campaigns.
- Review export, download, invitation and permission-changing powers separately from viewing and editing.
- Remove expired grants. Reassign record ownership before deleting accounts where the system requires it. Revoking access does not recall downloaded copies; handle those under the agreed retention and deletion process.
- Run the authorized test-account checks again after changes. Record both allowed tasks and denied access.
- Assign an owner and deadline to every unresolved exception. Record why access continues and when it expires.
Keep a review register with the account, role, campaign, data categories, allowed actions, approving owner, review date and decision. Record completed removals as well as exceptions. When responsibilities move, pair this register with the creator-manager handover procedure.
Start with one active campaign. Have its owner justify every client and guest account, then test whether each account can reach anything outside that justification.
