CRM access works like the rest of Rhythm. Your administrator gives you permissions that determine what you can open and what you can do. This reference explains the four ready-made CRM permission levels, the pages that need specific permissions, and the pages any signed-in staff member can open. For more about Console permissions and Access Denied messages, see How the Console Decides What You Can See.
The Four Permission Levels
Rhythm includes four ready-made CRM permission levels. Each level includes everything from the level before it.
| Level | What it lets someone do |
|---|---|
| Read-Only Access | Open CRM, list and view every contact and organization, and run, download, and schedule CRM queries. This level cannot create, edit, or delete records, and it cannot open Setup. |
| Day-to-Day Access | Do everything Read-Only Access can do, plus create, edit, and delete contacts and organizations; change a contact's or organization's status or type; email a contact; sign in to the Portal as a member; and reset a member's password or send them a password-reset email. |
| Power User Access | Do everything Day-to-Day Access can do, plus merge duplicate contacts and duplicate organizations. |
| Administrator | Use every CRM permission, including Setup, the CRM Settings page, and every maintenance task. |
Tip
Day-to-Day Access includes the ability to sign in to the Portal as a member and reset a member's password. If only a smaller group of staff should have those abilities, ask your administrator to create a custom permission grant instead of using Day-to-Day Access as-is.
Password resets and email verification both happen from the Security tab on the contact's record. Staff with Day-to-Day Access or higher can handle both tasks from that tab, without direct access to the underlying identity system. When possible, generate a password-reset link so the member can complete the reset on their own. Use a direct manual password reset only when the member can't access their email. The same Security tab also lets staff manually verify a member's email address when it has not been verified yet.
Your administrator can narrow a grant so it covers only contacts or organizations connected to a specific organization or organization type, instead of every record in your Rhythm account. Ask your administrator about narrowing a grant this way when someone should manage only one part of your membership, such as a single organization type.
Pages That Need a Specific Permission
| Page | Permission Needed |
|---|---|
| Setup and Maintenance Tasks | Administrator |
| CRM Settings | Administrator |
| Query Center | Any of the four levels above; query access is included in all of them. |
If a staff member does not have the permission a page requires, they see an Access Denied message when they try to open it. You may still see menu entries for Setup, Settings, or Maintenance Tasks because those entries appear for everyone. Rhythm checks your permission when the page opens.
An Access Denied or Forbidden message can also appear for a reason unrelated to permission levels. If the person's CRM contact record is set to Inactive, that status blocks their sign-in. Reactivating the contact record resolves it.
Pages Open to Any Signed-In Staff Member
| Page | What it shows |
|---|---|
| Overview | Account-wide counts, search across every contact and organization, and shortcuts. |
| Dashboards | The dashboard editor. |
| Training Exercises | CRM's hands-on training courses and their completion codes. |
| Reports | Currently empty; CRM reporting lives in the Query Center. |
These four pages open for anyone who can sign in to CRM, regardless of permission level.