Access

Field-level permission · hiding, locking or masking a value

Beyond saying which records a role can see, you control field by field what it can view and edit. Each field can be set to Full, Read-only, Masked or Hidden, and the rule holds in the list view, on the record screen, in the history and on writes.

Not every value on a record carries the same weight. The whole team may need to see a contact's name and phone, but only finance should see a deal's margin, and maybe nobody needs to see a person's full government ID on the day-to-day screen. Field-level permission solves that without duplicating objects or building parallel screens.

Where to set it

Open Settings and click Roles and permissions.
Click the role you want to adjust.
Scroll to the Field-level permission block.
Under Pick the object, select the object whose fields you are adjusting, for example Opportunities.
Next to each field, pick the level you want from the list. The change is saved the moment you choose it.

The four levels

Full: the role views and edits the field. It is the default for every field until someone changes it.
Read-only: the field shows the real value, but people with this role cannot change it.
Masked: the field shows the value partly hidden and cannot be changed.
Hidden: the field disappears entirely for people with this role.

What masking looks like

The system hides most of the value and keeps a minimal hint, depending on the field type:

Email: shows the first letter and the domain, for example j then dots then @company.com.
Phone, number, currency and percentage: shows only the last four digits.
Text and every other type: shows only the first letter.

Example: At a distributor, the Sales rep role gets the opportunity's Margin field set to Hidden and the contact's Government ID field set to Masked. The rep opens the deal and does not even know a margin field exists; on the contact, they read the ID as its last four digits, enough to confirm it with the customer on the phone, without carrying the full number on screen.

Where the rule is enforced

In the record list, including whatever is carried into exports run from it.
On the open record screen.
In the record history: the before and after values of each change also arrive hidden or masked.
On writes: a field set to Read-only, Masked or Hidden is refused when the role tries to change it.

One important detail about masking: the real value never leaves the server for someone who is not allowed to see it. The screen is not merely covering up text that already reached the browser.

Who can do this, and how to undo it

Only people with permission to manage settings can open and change this section.
Every change is written to the audit trail, with the field affected and the level chosen.
To undo everything for a role at once, use Restore default at the top of the role screen. That rewrites the permission matrix from the default template and returns every field to the Full level.
A role marked as read-only does not offer the Full option in the list: the available levels are Read-only, Masked and Hidden.

💡 Hiding a field does not delete it and does not erase the stored value. Another role with access still sees the data normally. If your intent is to remove the data for good, the path is deleting the field under Settings, Objects, or anonymizing the data subject on the record screen.

Open this article inside the system →