Access has two separate parts, and confusing them is the most common setup mistake. A role decides what somebody may do — view, create, edit, delete. A scope decides how much they may do it to — their own records, their team’s, or everything.
Steps
- Go to Settings → Users and choose New.
- Enter their name and e-mail. The invitation goes to that address.
- Pick a role. The shipped ones are Administrator, Manager, Sales executive, Accounts and Portal.
- Save. They set their own password from the invitation link.
Changing what a role may do
- Go to Settings → Roles & permissions.
- The shipped roles cannot be edited — copy one first, which keeps your changes safe from product updates.
- Expand a module and set the actions for each submodule.
- Set the scope at the bottom: own records, team, or everything.
- Save.
Everyone starts narrow. A new user sees what they own or are assigned to. Widening that to the whole team is deliberate, and it does not require giving anyone access to Settings.
Something missing or wrong here? Tell us — a question that needed asking usually means a page that needed writing.