CRM Architecture Advise Needed

jcvieira

Hi guys,

First of all, let me thank the epesi team for making such amazing tool.

I need some advise regarding the program architecture, its been 2 years in production in our office.
To situate yourselves, when ive decided to use epesi we had a couple requirements that system did not bring by default such as:

1# - Sales Rep should not be able to view other reps companies and related information.
2# - An option to change Companies between sales rep should be created and binded only to the admins.

As a solution what ive done is the following:

1# To solve this topic, simply removed all the options from CRM Common data "Access" and left with "Private", this way only records with private status could be created and the information was not visible to other reps.

2# Created a small script that was only accessed by admins that could change the "created_by" field in the companies.

So far so good, however couple of weeks ago i had a complaint that information was missing when a Companie transfer occured between reps, no surprise (after 2 years in production i know) that the associated records with the companie are binded to the user that created them and do not "linked" simply by change company "created by" field...

Now im faced with this issue and i cant make all records public, because wil not meet requirement #1 and to make a script that would change every "created_by" field of information associated to a companie its a monster job and probably not a good idea...

Can you please provide any sort of input in this matter, how can i acomplish both 1# and 2# scenarios of the requirements?

Thanks in advance.

ghristov

I would say you went the long way around with your solution or simply the system has evolved in the last 2 year (cannot remember the status 2 years back) and can fulfill your requirements without any tweaks - just proper set up.

What you need to do is:
- install the "Account Manager" option of the CRM module. This activates a field "Account Manager" under each company record.
- assign a contact as account manager to each company
- edit "company" recordset access permissions and add a rule for employees (presume your Sales Reps have Employee clearance) setting the conditions for access on field "Account Manager" to "User Contact" option. This means that each Sales Rep (account manager) will see his assigned companies only
- you can add permission to managers to see all companies and/or other access you need
- also from permissions you have to disable the field "Account Manager" for editing and/or viewing by the employees and enable this only for managers
- make all companies public again
- to set up access to any other recordset related to company recordset use the recursive access rule. For contacts for instance add a condition "Company Name" equal "Allow View Record". This way each Sales Rep (account manager) will see contacts related to his assigned companies only.

Good luck!

Best regards,
Georgi

jcvieira

Dear ghristov, thank you so much for your input, specially for the time spent on the problem.
Your answer is very clear and i will try to replicate your advise in my env.

Thank you

jasiek

Georgi - thank you for the excellent explanation.

I would like to add that with the Permission system you can create any set of rules and pretty much unlimited number of access levels.

You should avoid using private record permission feature as it was designed to keep data protected for an individual user and never shared. Your approach - while it was working - is really cumbersome.

You can create new field for example called "Region" which will be using CommonData List - for example: East, West and use it as single select field or multiselect (if you indent to have salespeople covering more than one region). Only admins can access CommonList and edit it - you don't need to keep this field private.
Under Contacts you can add this new Region field but protect it from editing by non-managers or admins - whatever you like. In any case regular employees will see the region field but they can not change it. If you want you can also hide this field for some users, but I don't see a reason why would you like to prevent an employee from looking up which region another one covers.

Now add the same Region field to other recordsets you want to limit access to - for example Sale Opportunity or Companies. Add rules for let's say Salespeople group (access level group) to view only records with Region field set to match their Region. Here again you can create it as a single or multi-select field if you want even more flexibility.

As superadmin you can test permissions using LogIn As feature. Open another window in Incognito mode and keep it open logged on as a user with limited access rights you are testing. Play with rules until you get it right.
As this can create a real mess if you are not doing it right please always make a backup of your database before making such changes.

More on permissions: http://www.epesi.org/Utils/RecordBrowser/Permissions

Epesi ENS | Epesi Academy | epesi.cloud PaaS | GitHub

Help Me! | Download from SourceForge