Assignment decides where work goes, so who may set it is a real question rather than a formality.
It follows the organisation tree
| Your scope | You can write rules for |
|---|---|
| All | Anybody in the business. This is an administrator. |
| Team | The people who report to you, however far down, plus your own role. |
| Own | Yourself. Legal, and rarely useful. |
So a sales manager writes the rules that distribute leads among their sales people, and an operations manager does the same for theirs, and neither can touch the other.
You cannot see another team's rules either
Not just “cannot edit” — cannot see. A rule tells you how a team is organised, who is on it and who is carrying what. That is exactly the thing the reporting structure exists to keep apart, so another team’s rules are simply not there.
Naming a role or a group is checked properly
If you point an entry at a whole role or group, the check is against the people inside it, not the label. A group containing one person you do not manage cannot be used to assign to them.
That closes the obvious way round the rule, and it is why you may sometimes be told you cannot use a group that looks harmless — somebody in it is outside your reach.
The same tree as everything else
This is the reporting structure already used to decide who sees whose records, set in Settings → Roles & permissions. There is no second place to keep in step, and changing who reports to whom changes both at once.
Setting it up
- Make sure the org tree is right first — who reports to whom.
- Give your managers the Assignment rules permission at scope team.
- Keep scope all for administrators only.
- Then test it: sign in as a manager and confirm you cannot see another team’s rules.
A worked structure
A business with two managers under the owner:
| Person | Scope | Can write rules for |
|---|---|---|
| Owner / administrator | All | Everybody. |
| Sales manager | Team | Their four sales people, and themselves. |
| Operations manager | Team | Their three staff. Not the sales people. |
| Sales executive | None | Nobody — they do not see the screen. |
The two managers cannot see each other’s rules at all, and neither can assign to the other’s staff. Each runs their own desk.
Checking it rather than assuming
- Make a real user on the manager role.
- Sign in as them and open Settings → Assignment.
- Confirm the screen says your own team and names the right number of people.
- Try to create a rule pointing at somebody from the other team — you should be refused, by name.
- Confirm the other team’s rules are not listed.
Step four is the one to actually perform. Permissions are the screen where being nearly right reads exactly like being right, and the refusal message names the person so you can see the boundary working.
Where to go next
Something missing or wrong here? Tell us. A question that needed asking usually means a page that needed writing.