Capability template for business systems and integrations
Record sharing access matrix
When an approved access policy has to reach the CRM, the system owner lays the current sharing setup beside the proposed one, by record type and by role, internal and external. Every change is a question for its owner; inherited and platform-fixed settings are marked unknown.
Listed under
Add it to a workflow in the Fully Powered Planner, beside the teams and roles that will run it. Book a fit call
The outcome
The people who must agree to a sharing change see its effect before anyone touches a setting. For every record type and every role, internal or external, the matrix shows what the export says people have today, what the approved policy says they should have, and whether the change widens access, narrows it or leaves it alone.
Some rows cannot be judged from an export. Access a record type takes from another record type, a setting the platform fixes, a role the export does not list for that record type and two export rows that disagree are all marked unknown, with the reason, and are never guessed. Access the export grants that the policy does not mention is listed apart, so nothing hides outside the policy.
The system owners confirm the access they intend. The CRM administrator resolves the unknowns and implements only what the owners have confirmed. Security rules on any exception. The assistant changes no setting and grants no access.
Who starts the work, and when
The CRM owner or the CRM administrator starts it once an access policy has been approved and before anyone configures it. It runs again when the policy changes or when the export is refreshed after a first round of changes. The system owners, the CRM administrator and security each read their own part of the result.
What they supply
- The sharing export: one row for each record type and role, with whether the role is internal or external, the access it has today, where that access comes from and the detail of the rule behind it.
- The approved access policy: one row for each record type and role, with the access the policy gives and, where one exists, the reference of an approved exception.
- The system-owner list: who confirms the intended access for each record type.
- The settings: the system's name, the review date and the order of the access levels, from lowest to highest.
The export holds settings, not people. No customer records, individual user names or passwords belong in it.
What comes out
One dated matrix in a fixed order, with a tie-out line that accounts for every policy row and every export row. Then five lists: access that widens; access that narrows; access that stays the same; unknowns, each with its reason; and access in the export that the policy does not mention. External roles come first in each list. A count by record type shows which parts of the CRM the change reaches. The decisions close the matrix, grouped by system owner, CRM administrator and security.
An invented example
Illustrative example with invented data. The company, the CRM, the roles, the rule names and the owners below are all invented. Wyndhollow Trade Supply is an invented distributor. Its CRM owner has an approved access policy and runs the matrix on Tuesday 10 November 2026, before the CRM administrator configures anything. First come the inputs the CRM owner supplied, in full, then the matrix the capability returned.
The inputs
1. Settings
System: Wyndhollow CRM
Review date: Tuesday 10 November 2026
Access order, lowest to highest: None, Read, Edit, Full
Run by: the CRM owner
2. Sharing export
record_type,role,user_group,current_access,source,detail
Accounts,Sales rep,internal,Edit,base setting,
Accounts,Sales manager,internal,Edit,base setting,
Accounts,Support rep,internal,Read,base setting,
Accounts,Finance analyst,internal,Read,base setting,
Accounts,Partner user,external,Read,sharing rule,Partner-owned accounts
Contacts,Sales rep,internal,Edit,inherited,Accounts
Contacts,Support rep,internal,Read,base setting,
Contacts,Customer portal user,external,None,base setting,
Opportunities,Sales rep,internal,Edit,base setting,
Opportunities,Sales manager,internal,Edit,base setting,
Opportunities,Finance analyst,internal,None,base setting,
Opportunities,Partner user,external,None,base setting,
Quotes,Sales rep,internal,Edit,inherited,Opportunities
Quotes,Finance analyst,internal,Read,base setting,
Quotes,Partner user,external,Read,platform fixed,
Cases,Support rep,internal,Full,base setting,
Cases,Finance analyst,internal,Read,sharing rule,Finance billing cases
Cases,Customer portal user,external,Read,sharing rule,Own cases only
Cases,Partner user,external,None,base setting,
3. Approved access policy
record_type,role,user_group,approved_access,exception_ref
Accounts,Sales rep,internal,Read,
Accounts,Sales manager,internal,Edit,
Accounts,Support rep,internal,Read,
Accounts,Partner user,external,None,
Contacts,Sales rep,internal,Edit,
Contacts,Support rep,internal,Edit,
Contacts,Customer portal user,external,Read,
Opportunities,Sales rep,internal,Edit,
Opportunities,Sales manager,internal,Full,
Opportunities,Finance analyst,internal,Read,
Opportunities,Partner user,external,Read,EXC-07
Quotes,Sales rep,internal,Edit,
Quotes,Finance analyst,internal,Read,
Quotes,Partner user,external,None,
Cases,Support rep,internal,Full,
Cases,Sales rep,internal,Read,
Cases,Customer portal user,external,Read,
Cases,Partner user,external,None,
4. System-owner list
record_type,system_owner
Accounts,Sales operations lead
Contacts,Sales operations lead
Opportunities,Sales operations lead
Quotes,Finance manager
Cases,Support lead
The output
SHARING ACCESS MATRIX: Wyndhollow CRM, Tuesday 10 November 2026
For: the CRM owner, for the system owners, the CRM administrator and security. Access order, lowest to highest: None, Read, Edit, Full. Nothing has been changed or granted.
Compared: 19 export rows, 18 policy rows, 5 record types, 6 roles (4 internal, 2 external). Not supplied: none.
Tie-out: 18 policy rows = 5 widen + 2 narrow + 7 stay the same + 4 unknown. 19 export rows = 17 matched to a policy row + 2 outside the policy.
Widens: 5
- P07. Contacts, Customer portal user (external): None → Read. Current comes from base setting.
- P11. Opportunities, Partner user (external): None → Read. Current comes from base setting. Exception EXC-07.
- P06. Contacts, Support rep (internal): Read → Edit. Current comes from base setting.
- P09. Opportunities, Sales manager (internal): Edit → Full. Current comes from base setting.
- P10. Opportunities, Finance analyst (internal): None → Read. Current comes from base setting.
Narrows: 2
- P04. Accounts, Partner user (external): Read → None. Current comes from sharing rule: Partner-owned accounts.
- P01. Accounts, Sales rep (internal): Edit → Read. Current comes from base setting.
Stays the same: 7
- P17. Cases, Customer portal user (external): Read. Current comes from sharing rule: Own cases only.
- P18. Cases, Partner user (external): None.
- P02. Accounts, Sales manager (internal): Edit.
- P03. Accounts, Support rep (internal): Read.
- P08. Opportunities, Sales rep (internal): Edit.
- P13. Quotes, Finance analyst (internal): Read.
- P15. Cases, Support rep (internal): Full.
Unknown: 4
- P14. Quotes, Partner user (external): export shows Read, policy proposes None. Why unknown: set by the platform.
- P05. Contacts, Sales rep (internal): export shows Edit, policy proposes Edit. Why unknown: inherited from Accounts; P01 (Accounts, Sales rep) narrows.
- P12. Quotes, Sales rep (internal): export shows Edit, policy proposes Edit. Why unknown: inherited from Opportunities; P08 (Opportunities, Sales rep) stays the same.
- P16. Cases, Sales rep (internal): export shows no row, policy proposes Read. Why unknown: no export row.
Outside the policy: 2
- X04. Accounts, Finance analyst (internal): Read. Comes from base setting.
- X17. Cases, Finance analyst (internal): Read. Comes from sharing rule: Finance billing cases.
Affected record types
- Accounts: 0 widen, 2 narrow, 2 stay the same, 0 unknown.
- Contacts: 2 widen, 0 narrow, 0 stay the same, 1 unknown.
- Opportunities: 3 widen, 0 narrow, 1 stay the same, 0 unknown.
- Quotes: 0 widen, 0 narrow, 1 stay the same, 2 unknown.
- Cases: 0 widen, 0 narrow, 3 stay the same, 1 unknown.
Decisions
System owners confirm the intended access (9 items; a row with an exception also appears under security):
- Sales operations lead: P01, P04, P06, P07, P09, P10, P11, X04.
- Support lead: X17.
Question for P items: Is the proposed access what you intend for this role on this record type? Question for X items: Should the policy gain a row for this access, or should the access go?
CRM administrator resolves the unknowns before anything is implemented (4 items): P05, P12, P14, P16. Question: What does this role get on this record type today, and can the policy's access be reached by changing the configuration?
Security rules on the exceptions (1 item): P11, EXC-07. Question: Does the exception stand?
This matrix compares an export with a policy. It changes no setting, grants no access and recommends nothing. The system owners confirm intended access, the CRM administrator implements what they approve, and security rules on exceptions.
Where it fits
- Business systems and integrations, where the CRM owner turns an approved policy into configuration.
- Information security, which owns the policy and any exception to it.
- Software and technology, where partner and customer portals put external users into the CRM.
- Professional services, where who sees which client record is a daily question.
- Manufacturing, where distributors and partners reach opportunity and quote records.
- Established businesses, where sharing settings have grown over years and nobody holds the whole picture.
- Acquisitions and integration, when two sets of access rules have to become one.
The reading of user accounts against staff lists is a different piece of work; learning system access review does it for a learning system. This capability reads sharing settings against a policy and looks at no individual's account.
What has to change for your company
Name your record types and roles exactly as your CRM does, because the assistant matches names and does not guess at near misses. Decide the order of your access levels and what each one means in your system. Agree who owns each record type and who may rule on an exception. Decide which settings your platform fixes, so the administrator can answer the unknowns quickly. Fix the export's columns once. It runs in ChatGPT, Claude, Copilot or Gemini from files you supply; it needs no connection to the CRM.
What has been checked
Fully Powered AI wrote this capability template. It was editorially reviewed on 10 November 2026. It was tried once on its invented example in Claude on 10 November 2026, and the record of that run is published with it. The run was not blind: the model had seen the example's published output before it worked the matrix again from the inputs. It has not yet been tested in a client environment. It has not yet been tested as a packaged version in ChatGPT, Claude, Copilot or Gemini.
Testing in your environment means running it on a sharing change your administrator has already worked through, with cases written in advance: a role missing from the export, two export rows that disagree, an inherited setting whose parent also changes, an exception with no owner. The administrator checks every row against the CRM before anyone relies on it. Pilot acceptance-test preparation sets those cases up.
The full capability template
Everything above is the outline. The complete capability template is the working version: the roles, the inputs, the procedure, the exceptions and stop conditions, the output format, the reviewer checklist, the acceptance tests, the instructions for an AI assistant and what to customize for your company. It comes with a download and the link to its folder in Fully Powered’s public repository.
Free with an account. Sign in by email: no password and no card.
Next step
Put this capability to work for your team: on your plan, or built with you in a sprint.
Build this in a sprint
In a sprint, Fully Powered adapts this capability template to your rules, proves it on your own work and puts it in the hands of the roles that own it.
Two ways to begin: