> For the complete documentation index, see [llms.txt](https://help.tahua.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.tahua.io/knowledge-base/administrator-help-guides/administrator-permissions-and-user-management/admin-groups-and-data-access-rules/example-admin-group-configurations.md).

# Example Admin Group Configurations

Common Admin Group and Data Access Rule setups to use as a starting point for your own organisation.

{% hint style="info" %}
See [How to Create an Admin Group and Set Data Access Rules](/knowledge-base/administrator-help-guides/administrator-permissions-and-user-management/admin-groups-and-data-access-rules/how-to-create-an-admin-group-and-set-data-access-rules.md) for the setup steps, and [Admin Groups & Data Access Rules](/knowledge-base/administrator-help-guides/administrator-permissions-and-user-management/admin-groups-and-data-access-rules.md) for how access levels and criteria work.
{% endhint %}

### Unrestricted admin

For admins who need full access to everything - the same experience as before this feature was introduced.

* **Criteria:** Any Criteria
* **Access:** Full Access to all record types

### Programme-specific team

For teams who manage a specific funding programme and should only see records related to their programme.

* **Criteria:** Specific Funding Rounds -- select the relevant funding category or individual rounds
* **Access:** Full Access to the record types they work with (e.g. Rounds, Applications, Contracts, Payments)

### Read-only auditor

For external auditors or observers who need to review data without making changes.

* **Criteria:** Any Criteria
* **Access:** Read Only to all record types

### Separation of duties

For organisations that want to separate who manages applications from who manages payments.

**Programme Managers group:**

* **Criteria:** Any Criteria
* **Access:** Full Access to Rounds, Applications, Assessments. No Access to Payments, Contracts

**Finance group:**

* **Criteria:** Any Criteria
* **Access:** Read Only to Applications (for context). Full Access to Contracts, Payments

{% hint style="warning" %}
Data Access Rules alone won't complete this. Approving a payment is an **action**, controlled by the *Can approve Payment Batches* permission — so you also need to grant that to the Finance group's members and withhold it from everyone else. See [Administrator Permissions](/knowledge-base/administrator-help-guides/administrator-permissions-and-user-management/administrator-permissions.md).
{% endhint %}

### Payment approval separated from bank account changes

For organisations that need to ensure the person approving a payment cannot also change the bank account it pays to.

**Payment approvers:**

* **Permissions:** Can approve Payment Batches, Can access Payments
* **Criteria:** Any Criteria
* **Access:** Full Access to Payments. **Read Only to Contracts and Applicants** — bank account details live on those records, so read-only access lets them see the account without being able to change it

**Applicant record maintainers:**

* **Permissions:** no payment approval permissions
* **Criteria:** Any Criteria
* **Access:** Full Access to Applicants and Contracts. No Access or Read Only to Payments

Remember that access is additive — check the Default Group isn't granting Full Access that undoes the split.

### Restricted baseline with promoted access

For organisations that want new admins to start with limited access and gain more as they are trained.

**Default Group (all admins):**

* **Criteria:** Any Criteria
* **Access:** Read Only to Rounds and Applications. No Access to everything else

**Experienced Staff group:**

* **Criteria:** Any Criteria
* **Access:** Full Access to all record types

New admins automatically get read-only access through the Default Group. Once trained, adding them to the Experienced Staff group gives them full access.