Navigate to Admin.
Select Role Management.
From the drop down on the main tab select Create Role.
Give your role a Name and Description.
Specify any permission required by Module and Action on the following matrix.
Choose for modules to be enabled or disabled.
Provide Standard, Administrator or Developer rights to required modules.
Choose from Owner, Owner and Selected Teams, All, Not Set or None for action level rights. Below details what each of these options means:
All - The user can perform this action on any and all records that they can access
Owner - The user can perform this action only if they are the "Assigned To" user on the record
Owner and Selected Teams - The user can perform this action if they are the "Assigned To" user on the record or if they belong to team which is designated as having extra access on the record. This option is only visible if an administrator has enabled team-based permissions for the module.
Not Set - The user is neither restricted nor granted access to this function. When permission is "Not Set", users within this role default to "All" access
None - The user cannot perform this action on any records within this Sugar module
You can also set permissions on a field by field basis using the column on the left hand side:
Choose the module the field is in you wish to edit the permissions for
Find the field you wish to change from the list and double click where it says "Not Set"
Choose the permissions you want from the following
Not Set - The user is neither restricted nor granted access to this field. When permission is "Not Set", users within this role default to "Read/Write" access
Read/Write - The user can see the value of this field and can edit it
Read/(Owner & Selected Teams) Write - The user can see the value of this field but can only edit the field's value if they are the "Assigned To" user on the record or if they belong to a team which is designated as having extra access on the record. This option is only visible if an administrator has enabled team-based permissions for the module
Read Only - The user can see the value of this field but cannot change its value
Owner Read/Owner Write - The user can only see and edit this field if they are the "Assigned To" user on the record
(Owner & Selected Teams) Read/Owner Write - The user can only see the value of this field if they are the "Assigned To" user on the record or if they belong to team which is designated as having extra access on the record, but they can edit the field only if they are the "Assigned To" user on the record. This option is only visible if an administrator has enabled team-based permissions for the module
(Owner & Selected Teams) Read/(Owner & Selected Teams) Write - The user can only see the field and edit the field's value if they are the "Assigned To" user on the record or if they belong to a team which is designated as having extra access on the record. This option is only visible if an administrator has enabled team-based permissions for the module
Be aware that it is possible to add a user to multiple roles, however for when the roles have different permission sets, the user will inherit the lesser of the two.
For example, if:
User 1 is in Role A and Role B
Role A has got edit permissions for the Accounts module, but Role B only has view permissions
then User 1 will only be able to view Accounts, he will not be able to edit.