Pomio CRM is built for the sales team, but sooner or later other colleagues ask for access too. Finance wants to check what was agreed before sending an invoice, support wants to know who the account manager is, and the managing director wants to look at the pipeline without asking for a report. In many small businesses the answer is improvised: someone gets the same rights as a salesperson, or borrows a login. A read-only role is usually the better choice.
Who outside sales asks for access
The requests tend to come from the same places. Finance and administration want to see the agreed amount and the contact person for invoicing. Support and customer success want the history of a customer before they pick up the phone. Delivery or project managers want to know the scope of a deal that has just been won. Management and owners want to follow the pipeline and the scoreboard. Marketing sometimes wants to know which sources produce customers. All of them need to read, almost none of them need to change deals, stages or amounts.
Why full rights are the wrong default
Giving every colleague the same rights as a salesperson feels generous, but it creates problems that show up later. A colleague from finance corrects an amount in a deal that a salesperson is still negotiating. Someone in support moves a deal to another stage because the customer mentioned it on the phone. A well-meant clean-up archives companies that sales still uses. Each change may be reasonable on its own, but the pipeline stops being the sales team's shared record and the figures on the scoreboard can no longer be explained. Edit rights belong with the people who are accountable for the deals, as described in why every open deal needs a single owner.
Why a shared login or emailed exports are worse
The two common workarounds are a shared account and a spreadsheet. A shared login means nobody can tell afterwards who looked at or changed what, and the password ends up in chat messages and notebooks; that is why every CRM user should have their own login. A spreadsheet sent by email is out of date the moment it is opened, is copied to laptops and inboxes and contains names, email addresses and phone numbers that now sit outside the CRM. Both are harder to control than a proper read-only account.
Read-only as the default for colleagues outside sales
For most businesses of five to fifty people the simple rule works best: colleagues outside sales who need customer information at least every week get their own account with a read-only role. They can open companies, contacts and deals, read notes and the activity timeline and follow the pipeline, but they cannot move, edit or archive anything. If they spot something that is wrong, they tell the owner of the record, who corrects it. That keeps responsibility where it belongs and still gives colleagues the context they need.
Limit the scope, not only the actions
Read-only says what someone can do, scope says what they can see. A support colleague for one region does not need the deals of every team, and a project manager may only need the deals of the delivery team they work with. Choose the smallest scope that does the job: own, team or the whole organisation. Management usually needs the organisation view, most other colleagues need a team. The model is explained in how RBAC own, team and tenant works in a CRM, and the same question for the sales team itself is covered in whether salespeople should see each other’s deals.
When a colleague outside sales does need to edit
There are exceptions. An office manager who registers inbound leads, a customer success manager who owns renewals or a director who still runs a few key accounts does sales work, so they need a sales role for that part of the CRM. Treat that as a deliberate decision with a named reason, not as an upgrade on request. Administrator rights are a separate matter again and should stay with one or two people, as explained in how many administrators a CRM should have.
Security and personal data
A read-only account still gives access to personal data about customers and prospects, so it deserves the same care as any other account. Switch on MFA, invite people with their work email address and suspend the account on their last working day, as with any user who leaves. Decide separately whether a colleague also needs to export data; reading a record on screen is a smaller risk than a file with every contact on a laptop. Important actions should be visible afterwards in an audit trail.
Keep the list current
Read-only accounts are easy to forget because their users rarely complain. Keep a short list of who has read-only access, for which part of the CRM and why. Check it in the quarterly access review: colleagues who changed jobs, projects that ended and accounts that have not been used for months can be suspended. A colleague who only needs one figure a quarter is better served by a report from the scoreboard than by an account.
How Pomio CRM helps
Pomio CRM has four roles: sales rep, sales manager, viewer and organisation admin, each with scope own, team or organisation, enforced on the server rather than only hidden in the screen. Users are invited by email, can be activated and suspended and can use optional MFA with an authenticator app. Deals, companies, contacts, notes and the activity timeline sit in one environment, the scoreboard shows results by period and the audit log records who did what and when for important actions. An overview of the capabilities is on the features page and the security approach on the security page.
A practical checklist
List which colleagues outside sales ask for access and why; give regular users their own account with a read-only role; choose the smallest scope that does the job; keep edit rights with the owners of the records; give a sales role only to colleagues who really do sales work, with a named reason; keep administrator rights with one or two people; switch on MFA for every account, including read-only; decide separately who may export data; replace emailed spreadsheets with access or a report; suspend read-only accounts when people leave; review the list every quarter.
Further reading
Should the managing director get read-only access?
Often, yes. A director who follows the pipeline but does not own deals is well served by a read-only role with organisation scope. A director who still runs key accounts needs a sales role for those deals.
Can read-only colleagues add notes?
Not with a strict read-only role. If colleagues in support or delivery regularly add information that sales needs, agree how they pass it on, or give that group a sales role with a limited scope.
Is a read-only account cheaper?
That depends on the CRM and the plan. Check the pricing first, and if accounts cost the same, the choice between read-only and edit rights should still follow the work, not the price.
What about external accountants or partners?
Be more careful with people outside the company. Give access only when there is a clear need and an agreement on data protection, with the smallest possible scope, and suspend the account when the work is done. Sometimes an export of only the needed fields is enough.