We have several sales departments, each handling a specific product type. The provided image illustrates our typical sales team structure, where leads are assigned to individuals at every level.
Desired Access Hierarchy:
- Sales Executives (D, E, F, G): Should only see leads directly assigned to them.
- Team Leads (B & C): Should see their own leads plus the leads of the executives working under them. They should not see the Manager's leads.
- Sales Manager (A): Needs visibility into all leads across the entire department.
To manage this access, I created separate Teams in our EspoCRM for B's team and C's team, giving each Team Lead permission to view all leads within their respective teams. This worked perfectly at first.
However, to give the Sales Manager (A) visibility over everyone, I added A to both of those Teams. The problem is that because B and C have permission to view all leads within their teams, adding A to those groups inadvertently gave B and C access to A's personal leads.
Problem:
By adding the Sales Manager to the teams to grant him full visibility, the Team Leads inadvertently gained access to the Manager's personal leads.
Expected Solution:
How to implement a hierarchical or sub-team kind of visibility that grants the Manager top-down visibility into subordinates' leads without giving the team leads visibility to manager's leads
Caveat:
If there were only one Sales department, I would have given "all" permission to the Sales Manager. However, since there are multiple Sales departments, the Sales Manager A of this department should not be able to see the leads of other departments. Hence, we cannot use "all."