In a small company CRM access usually starts per person. The first salesperson gets everything, the bookkeeper gets a few extra rights to look up an invoice, a temporary colleague gets access to one pipeline. After two years nobody can say why a particular user can export all contacts or delete deals. Pomio CRM recommends assigning permissions per role instead, and treating personal exceptions as exactly that: exceptions.
Why per-person permissions drift
Permissions given to one person are rarely taken back. People change jobs inside the company, take over a colleague's customers for a while or help out in another team, and each time a right is added. Nobody removes it afterwards, because nobody remembers it was added. The result is a CRM where access depends on history rather than on the job someone does. A quarterly access review then becomes a long list of individual settings that nobody can judge.
What a role-based setup looks like
Start with the work, not with the people. Most SMEs need four or five roles: salesperson, sales manager, colleagues outside sales with read-only access, and a small number of administrators. Per role, decide which records people see (their own, their team's or the whole tenant, as described in own, team and tenant scope) and what they may do: edit, bulk edit, merge, export or delete. Every user gets exactly one role and their own login.
When a personal exception is acceptable
Sometimes one person needs something their role does not give, for example a salesperson who temporarily covers a colleague's region. That is fine, as long as the exception is written down with a reason, an owner who approved it and an end date. If the same exception keeps coming back for several people, it is not an exception: adjust the role or add a new one.
Roles make joiners, movers and leavers simpler
With roles, a new colleague gets the right access on day one by choosing one role. Someone who moves from sales to customer service changes role, and old rights disappear automatically. Someone who leaves is suspended on their last day, and you do not have to check which personal rights they had. The review becomes two questions: is each user in the right role, and is each role still right?
A practical rule for SMEs
Keep the number of roles small enough that someone outside IT can explain each one in a sentence. Avoid a separate role per person, because that is per-person permissions under another name. Write the roles down, review them once a quarter together with the users per role, and let every change to a role go through the CRM owner.