# Admin Groups & Data Access Rules Admin Groups and Data Access Rules give you granular control over what data each administrator can see and edit. Instead of every admin having identical access to all records, you can tailor permissions to match your team structure, operational boundaries, and security requirements. Access to this feature is tightly governed. The ability to create, view, and modify Admin Groups is controlled by a dedicated permission - **"Can manage Admin Groups"** - which is off by default. Until this permission is explicitly granted, the Admin Groups interface is not visible. This means your organisation decides who can configure access, and everyone else simply operates within the access they've been given. ### Admin Groups An Admin Group is a collection of administrators who share the same level of access. You'll find them under **Users > Admin Groups**.

The Admin Groups list under Users > Admin Groups

Each group has: * **Members** - the admin users who belong to the group * **One or more Data Access Rules** - the rules that define what those members can see and do An admin can belong to multiple groups. When they do, the system combines all their rules and grants the **highest level of access** found for each record type ( more details below ). This means adding someone to a group can only maintain or increase their access, it never reduces it. ### Data Access Rules A Data Access Rule is attached to an Admin Group and defines two things: **what level of access** the group has to each record type, and **which records** that access applies to. For each record type, a rule specifies one of three levels: | Access Level | What It Means | | --------------- | ------------------------------------ | | **Full Access** | View and edit records | | **Read Only** | View records but cannot make changes | | **No Access** | Records are hidden entirely |

Setting access levels for each record type using the dropdowns

### Record types The following record types can be controlled: | Record Type | What It Covers | | ----------------- | ---------------------------------------------------- | | Applicants | Applicant and provider profiles | | Funding Rounds | Funding programmes and their settings | | Applications | Funding applications submitted by applicants | | Assessments | Assessment reviews of applications | | Conditions | Conditions placed on approved applications | | Milestones | Contract and application milestones and deliverables | | Contracts | Funding contracts | | Payments | Payment records and batches | | Internal Comments | Admin-only comments on records | ### Criteria (scope) Each rule also defines **which records** the access levels apply to: * **Any Criteria** - the access levels apply to all records across the entire organisation. Use this for senior administrators, system administrators, or finance teams who need visibility of everything. * **Specific Funding Rounds** - the access levels apply only to records linked to selected funding rounds or funding categories. Use this for programme managers, regional teams, or anyone who should only see specific programmes. When using specific criteria, you can select: * **Individual funding rounds** - e.g. "2025 Community Fund Round 1" * **Funding categories** - e.g. "Youth Programmes" (automatically includes all rounds in that category, including any future rounds added to it) * **A combination of both**

Choosing Specific Funding Rounds criteria with funding categories and individual rounds

### The Default Group Every organisation has a **Default Group**. This group: * Automatically includes all current administrators * Automatically adds any new administrators when they are created * Cannot have members manually removed The Default Group establishes a baseline level of access that every admin receives. Out of the box, it comes with an unrestricted Data Access Rule (Full Access to all record types with Any Criteria), so all admins start with the same access they had before this feature was introduced. You can adjust the Default Group's Data Access Rule to set a different baseline - for example, Read Only across the board - and then use additional groups to grant higher access where needed. ### Governance & the "Can manage Admin Groups" Permission The entire Admin Groups feature is gated behind a single permission: **"Can manage Admin Groups"**. This permission is **disabled by default** for all roles, and it controls everything - creating groups, viewing group membership, editing Data Access Rules, and deleting groups. This design is deliberate. The administrators who decide *who can see what* should be a small, trusted group - typically system administrators or team leads responsible for access governance. Granting this permission broadly would undermine the purpose of having controlled access in the first place.

The "Can manage Admin Groups" permission on the administrator permissions form

### How Permissions Stack When an admin belongs to multiple groups, the system evaluates all their Data Access Rules and grants the **highest access level** found for each record type. **Example:** An admin belongs to two groups: * Group A grants **Read Only** to Applications * Group B grants **Full Access** to Applications The admin receives **Full Access** to Applications (the higher of the two). The priority order is: **Full Access > Read Only > No Access**. Because the model is additive, the only way to reduce an admin's access is to remove them from a group or change that group's Data Access Rule. ### Setting Up Access #### Step 1: Plan your groups Think about which teams or roles in your organisation need different levels of access. Common groupings include: * By programme (e.g. Youth Grants Team, Arts Funding Team) * By function (e.g. Programme Managers, Finance, Auditors) * By seniority (e.g. Senior Admins with full access, Junior Admins with read-only) #### Step 2: Create a group 1. Go to **Users > Admin Groups** 2. Click **Add Group** 3. Enter a name for the group 4. Select the admin members

The admin group form showing name, members, and Data Access Rules sections

#### Step 3: Add Data Access Rules Each group needs at least one Data Access Rule. On the group form: 1. Under **Data Access Rules**, set the access level for each record type using the dropdown (Full Access, Read Only, or No Access) 2. Choose the criteria: * Select **Any Criteria** if the rule should apply to all records * Select **Specific Funding Rounds** to restrict to particular rounds or categories, then tick the relevant funding categories and/or individual funding rounds 3. To add additional rules to the same group, click **Add Data Access Rule** and configure it #### Step 4: Review the Default Group Decide what baseline access every admin should have. If the out-of-the-box unrestricted access is appropriate, no changes are needed. If you want a more restrictive baseline, edit the Default Group's Data Access Rule. ### Common Configurations #### Unrestricted admin For admins who need full access to everything - the same experience as before this feature was introduced. * **Criteria:** Any Criteria * **Access:** Full Access to all record types #### Programme-specific team For teams who manage a specific funding programme and should only see records related to their programme. * **Criteria:** Specific Funding Rounds -- select the relevant funding category or individual rounds * **Access:** Full Access to the record types they work with (e.g. Rounds, Applications, Contracts, Payments) #### Read-only auditor For external auditors or observers who need to review data without making changes. * **Criteria:** Any Criteria * **Access:** Read Only to all record types #### Separation of duties For organisations that want to separate who manages applications from who manages payments. **Programme Managers group:** * **Criteria:** Any Criteria * **Access:** Full Access to Rounds, Applications, Assessments. No Access to Payments, Contracts **Finance group:** * **Criteria:** Any Criteria * **Access:** Read Only to Applications (for context). Full Access to Contracts, Payments #### Restricted baseline with promoted access For organisations that want new admins to start with limited access and gain more as they are trained. **Default Group (all admins):** * **Criteria:** Any Criteria * **Access:** Read Only to Rounds and Applications. No Access to everything else **Experienced Staff group:** * **Criteria:** Any Criteria * **Access:** Full Access to all record types New admins automatically get read-only access through the Default Group. Once trained, adding them to the Experienced Staff group gives them full access. ### Things to Know * **Changes take effect immediately.** When you update a group's membership or Data Access Rules, the changes apply on the admin's next page load. No restart or waiting period is required. * **Funding categories are forward-looking.** When you scope a rule to a funding category, any new funding round added to that category in the future is automatically covered. You don't need to update the rule each time a new round is created. * **No disruption for existing users.** The Default Group with unrestricted access means all existing admins continue to see and do everything they could before. Access only changes when you deliberately configure it. * **Audit-friendly.** The group structure gives you a clear, reviewable record of who has access to what, supporting compliance and governance requirements.