Access control is not paperwork. It decides whether a mistake costs a minute or a customer.
Start from jobs, not people
List jobs: telecaller, sales manager, accounts, legal, partner. Give each the modules it needs, and no more.
Hide, do not just disable
In Propto, a role hides modules from the sidebar and the API refuses them, so a typed URL does not bypass the rule.
Review regularly
People change roles. Use the audit log to review who changed what and remove access that is no longer needed.
A starter set of roles
Most real estate companies can begin with a handful of roles: administrator, sales manager, sales executive or telecaller, accounts, legal, site or construction, HR and channel partner. Each role is defined by the modules it can open and the actions it can take, such as editing prices or approving payouts.
Start simple. It is easier to add a specialised role later than to untangle dozens of overlapping roles created in a hurry. Document what each role is for, so that new managers can assign the right one without guessing.
Sensitive data deserves extra care
Buyer identity documents, bank details, payment records and employee salaries are sensitive. Limit them to the roles that genuinely need them, and make sure the restriction applies everywhere, not just in the menu. Ideally, a role without permission should not be able to reach the data even by typing a web address.
Review who has administrator rights. It is common for several people to hold full access long after they needed it. Fewer administrators means fewer mistakes and a clearer line of responsibility when something changes.
Handling changes and departures
When someone changes role, update their permissions on the same day. When someone leaves, remove access immediately and reassign their leads and tasks. Delays create risk: former staff may still see buyer information, and their open work may sit untouched.
Build these steps into your HR checklist so they happen consistently. A short monthly review of active users and their roles will catch anything that slipped through, and it takes only a few minutes when the system makes roles easy to read.
Permissions and the audit trail together
Permissions prevent mistakes, and an audit log explains them when they happen. Together they let you answer difficult questions: who changed this price, who released this unit, who approved this payout. That clarity protects honest employees as much as it deters misuse.
Share the principles with your team. When people understand that permissions exist to protect buyers and the business, not to signal distrust, they accept them more readily. Clear rules, applied evenly, are part of a healthy culture as a company grows.
Partners and external users
Channel partners and vendors may need limited access to their own leads, bookings, commissions or bills. Give them dedicated roles that show only their own records and never internal notes, other partners’ data or buyer documents they do not need.
Review partner access regularly. Partners who become inactive should lose access, and those who change companies should not carry old logins with them.
Approvals as a permission layer
Some actions should require approval rather than simply being allowed or blocked. Price changes, unit releases, payout approvals and changes proposed by AI assistants are good candidates. An approval step adds a second pair of eyes without slowing routine work.
Record who approved what and when. Combined with the audit log, this makes it easy to understand decisions later and to spot patterns that might need a policy change.
A quarterly permissions review
Once a quarter, list every active user, their role and their last activity. Remove access that is no longer needed, check that administrator rights are limited and confirm that sensitive modules are restricted to the right people.
This review takes little time and prevents gradual drift. As teams grow and change, permissions tend to expand quietly; a regular review keeps them aligned with how the business actually works.
Key takeaways
Begin with a small set of roles defined by job, restrict sensitive data everywhere and keep administrator rights to a few named people. Update permissions on the day someone changes role or leaves.
Use approvals for high-impact actions such as price changes, unit releases and payouts, and rely on the audit log to explain decisions later. Give partners and vendors narrow roles that show only their own records.
Review users and roles every quarter. A few minutes of review prevents slow permission drift and keeps buyer and employee data properly protected as the company grows.
Explain the reasons to your team, too. People accept limits more readily when they understand that permissions protect buyers, partners and colleagues, not just the company.
A practical next step
Start by listing every job in your company and the three things each job must be able to do in the system. Turn that list into roles, test them with one person from each team and adjust before rolling out to everyone.
Repeat the test whenever a new team or module is added.
Can I create custom roles?
Yes. Create roles and choose which modules each may open.