Exactly who sees exactly what

Scopes, not just switches

"Can view leads" isn't one question. A rep might see all leads, only leads in campaigns they're on, or none. The same for opportunities, the inbox, recordings and analytics.

Custom roles and per-person exceptions

Four built-in roles to start from, unlimited custom roles, and sparse per-person overrides on top for the one person who needs one extra thing.

Enforced where it counts

Permissions are applied on the server. A rep whose inbox is scoped to their own conversations has the request narrowed before the query runs — hiding a button is not a permission.

Removal takes effect immediately

Every request re-verifies that the person is still a member of the organisation. Remove someone and their access ends on their next request, not whenever their session happens to expire.