Overview of Managing Field-Level Permissions for Normal Users in Horilla CRM
Controlling access at the model level — who can create, view, edit, or delete records — is a foundational part of CRM security. But in real sales environments, that level of control is often not enough. Two users with the same role may still need different visibility into specific fields on the same record. A sales representative might need to see a lead’s contact details, but should not be able to modify the assigned territory. A support agent might not need to see financial fields at all.
Thank you for reading this post, don't forget to subscribe!Field-level permissions in Horilla CRM extend the standard permission model down to individual fields. Administrators can control whether a specific field on any model is fully editable, read-only, or completely hidden — configured per user, directly from the Roles and Permissions interface. This provides precise data governance without creating separate interfaces or custom views for every user type.
Navigating to User Permissions
Field-level permissions for normal users are managed from the central permissions interface.
To get there:
- Go to Settings from the left sidebar
- Select Roles and Permissions under the General section
- Click the Permissions tab at the top of the page
The Permissions tab opens the User Permissions section, which lists all non-superuser accounts in the system. Each user appears as a collapsible row showing their name and assigned role in parentheses.
User Permissions List
The User Permissions section displays all users in an accordion layout.
Each row shows:
- User’s full name
- Role assigned in parentheses
- A collapse/expand control on the right
A search bar at the top lets you quickly locate a specific user by name. The Assign button on the right side of the header enables bulk permission assignment across multiple users at once, which is covered separately below.
Expanding a User to View Model Permissions
Clicking a user’s row expands it to reveal their model-level permissions.
The expanded view shows a table of all models in the system. For each model, the following permissions are displayed as checkboxes:
- Create and Create Own
- Change and Change Own
- View and View Own
- Delete and Delete Own
A search bar inside the expanded section lets you filter the model list. A Select All option is available to grant or revoke permissions across all models at once.
This expanded view covers standard model-level access. Field-level permissions are configured separately from this same view by interacting with individual model rows.
Opening the Field Level Permissions Modal
The Field Level Permissions modal appears when clicking any model row for which field-level permissions need to be configured.
Clicking a model row opens a dialog that displays:
- User — the name of the user being configured
- Role — the role currently assigned to that user
- Model — the name of the model whose field permissions are being configured
A yellow informational note at the top of the modal explains that fields marked as required cannot be hidden during record creation. However, the configured permission settings are fully enforced when editing existing records.
The modal contains a table with one row for each configurable field in the selected model.
Each row includes:
- Field Name — the label as it appears in forms. Required fields are marked with a red asterisk.
- Read Only — radio button
- Read and Write — radio button (default selection)
- Don’t Show — radio button
The currently active permission for each field is automatically pre-selected, based either on previously saved settings or the system default of Read and Write.
Read Only
The field remains visible in forms and displays its current value, but the user cannot modify it. The input appears visually disabled to clearly indicate the restriction.
If a user attempts to submit a modified value for a read-only field, the system ignores the change and preserves the original value.
Read and Write
The field is fully visible and editable.
This is the default permission applied to all fields unless a different permission is explicitly configured.
Don’t Show
The field is completely hidden from the form for the selected user. It does not appear in edit forms or detail views.
If the field is marked as required, the Don’t Show setting is ignored during record creation or duplication. The field remains visible in those cases, so the system can enforce required data validation and maintain data integrity.
Saving Field-Level Permissions
After selecting the appropriate permission level for each field, click Save All Changes at the bottom of the modal.
The permissions take effect immediately. The next time the user opens a form for that model, the fields will reflect the configured access levels. Hidden fields will not appear. Read-only fields will appear with disabled styling and will not respond to edit attempts.
Bulk Assignment: Setting Field Permissions for Multiple Users at Once
When the same field permission configuration needs to be applied to several users simultaneously, the Assign button in the User Permissions header provides a bulk assignment workflow.
Step 1 — Open the Assign Users modal
Click the Assign button in the top-right corner of the User Permissions section. The Assign Users modal opens.
Step 2 — Select users
In the Users field at the top of the modal, search for and select the users you want to configure. Selected users appear as removable tags. The modal shows the model permission table below, listing all models with their Create, Change, View, and Delete checkboxes.
Step 3 — Open Field Level Permissions for a model
Click any model row inside the Assign Users modal to open the Field Level Permissions modal for that model.
- Selected Users: [count] — the number of users selected for this bulk operation
- Model — the name of the model being configured
The same three-column radio button table appears, showing all configurable fields for that model.
Step 4 — Configure and save
Select the desired permission level for each field and click Save All Changes. The configuration is applied to all selected users simultaneously.
How Permissions Are Reflected in the Interface
Once field permissions are saved, the changes are reflected in every context where that model appears for the user:
In edit forms
Read-only fields appear with their current value but cannot be changed. Don’t Show fields are removed from the form entirely.
In list views
Hidden fields are excluded from the visible column list for that user. They do not appear in the column selector or in exported data.
During record creation
Required fields override the Don’t Show setting. If a field is marked required, it will always be visible when creating or duplicating a record, regardless of the field permission. The Don’t Show setting applies only in the edit context.
In validation
If a user attempts to submit a changed value for a read-only field through any method, the system discards the change and keeps the original value. The restriction is enforced server-side, not just in the UI.
Permission Hierarchy
When the system determines a user’s access level for a specific field, it follows a resolution order:
- User-specific permission — A permission set directly on the user from the User Permissions interface takes the highest priority.
- Role permission — If no user-specific setting exists, the permission configured on the user’s role is applied.
- Model default — If neither the user nor the role has a specific setting, the model’s built-in defaults are used.
- System default — If none of the above apply, the system falls back to Read and Write access.
Superuser accounts always receive full Read and Write access to all fields and are not affected by field permission configuration.
Key Benefits
Field-level permissions for normal users in Horilla CRM provide several practical advantages:
- Configured directly from the Roles and Permissions interface without navigating away
- Applies per user individually for precise overrides on top of role-level settings
- Bulk assignment allows the same configuration to be applied to multiple users in a single operation
- Required fields are always protected during record creation, preventing data integrity issues
- Permissions are enforced in forms, list views, exports, and server-side validation consistently
Field-level permissions in Horilla CRM give administrators granular control over what individual users can see and edit on any model in the system. Accessed directly from the Permissions tab under Roles and Permissions, the interface allows field permissions to be set per user through the User Permissions section or applied across multiple users at once using the bulk Assign workflow. The three permission levels — Read Only, Read and Write, and Don’t Show — cover the full range of access control requirements, and the system enforces these settings consistently across every part of the interface where the field appears.
