Access and roles

Each role sees its own scope: the objects it reads, those it changes. The chat, the agents and the assistants connected through MCP respect exactly the same rights as the screen.

Two levels of roles

In the Escouade account: owner, administrator or member. These roles say who manages the organisation, its members and its invoice. See The account.
In the Escouade workspace: the workspace’s roles say what each person sees and changes in the data. A member enters the workspace with the role the account gives them, then a workspace administrator adjusts it.

A role’s rights

For each object (contacts, deals, invoices…), a role can read, create, change and put in the bin, or not. A role can also have hidden fields: margins, for example, stay invisible to those who should not see them, on the record, in lists, in the chat and through Claude.

A screen follows the right to read its object: the Accounting tab of invoices opens to whoever reads invoices, the deals’ schedule to whoever reads deals.

Beyond their role, a person can receive rights through a group or through an exception in their name; what is withdrawn from them stays withdrawn.

The "Share" button opens a record or a mailbox to a role, a person or a team, at a given level; the share can be changed or removed. Artefacts are private until their author shares them, administrators included.

Mailboxes

An email is read by whoever reads its mailbox. A mailbox can be:

personal: connected by a person, for themselves;
the workspace’s: a shared mailbox or a Drive, connected for the workspace in Settings › Accounts. The departure of the person who connected it stops nothing. Those who manage the workspace’s mailboxes and Drives can reconnect them, disconnect them and switch on their ingestion.

A member who still has personal mailboxes connected cannot be removed from the workspace: the screen says which ones to move to the workspace first.

Shared connectors

A shared connector (a workspace Drive, invoice software, electronic signature, Meet…) is connected once for the whole company. Who manages it (connecting it, configuring it, disconnecting it, offering it in the chat) is set role by role on its card; by default, administrators. Other members see it, without being able to change it.

Assistants and MCP servers

Through Claude or ChatGPT, each person has exactly their rights in the application. The MCP server settings are added on top, in Settings › MCP: which roles have read, write and integrator, at which level, object by object, and who can send emails through the assistant. See Escouade’s MCP servers.

Deleting a role also removes it from the settings that named it: MCP access, sending emails, connectors, default role.

Checking access

The integrator MCP server tests a person’s access, without changing anything: what they read, create, change and put in the bin, object by object, the fields hidden from them, the mailboxes they read and their MCP servers. For a record, it says whether they see it and, if not, why: the bin, their role, or an email from a mailbox they do not read. It also lists the Claude connections still valid, account by account, and flags a connector connected under a shared mailbox’s account.